Endpoint Monitoring with Wazuh Agent
Date: Sep 10, 2026
Tags: Endpoint Security System Administration Web Application Security Endpoint Monitoring SIEM Wazuh Sysmon Auditd PowerShell Apache
I. Project Summary
In my previous lab entry, I developed SIEM rules for the firewall to capture potential indicators of compromise. However, some rules can be evaded by using low-and-slow tactics, making network-only detections insufficient.
To solve this, I deployed an EDR with Sysmon, PowerShell Script Block Logging, and Auditd on Windows and Linux hosts using Wazuh Agent. This gives better visibility on multi-stage execution chains and Living Off the Land (LOTL) techniques.
II. Key Engineering Decisions
1. Endpoint Detection and Response (Wazuh Agent)
- Deployed Wazuh agents on Windows and Linux endpoints to forward logs to a central Wazuh manager that parses, indexes, and matches telemetry against existing detection rules. This creates a central place to view and analyze events from multiple sources.
2. Increased Windows Endpoint Visibility (Sysmon, Script Logging)
- Implemented Sysmon to capture detailed events like process creation, file activity, and network connections. PowerShell Script Block Logging also records executed scripts. Together, they help detect fileless execution, malwares using Windows built-in tools, and multi-stage attacks.
3. Linux Process Visibility (Auditd)
- Implemented Auditd on a Linux endpoint to capture command-related contexts including parameters, PID, user, and working directory. This is also useful for investigating incidents thoroughly, understanding the scope, and impact of the attacks.
4. Application-Layer Context Integration (Apache Access & Error Logs)
- Configured the Wazuh agent to forward Apache web server
access.loganderror.log. This logs HTTP requests and their parameters along with client IP addresses. This adds extra critical context for mapping the full attack chain which helps in developing remediation strategies.
III. Challenges
| Challenges | Probable Cause | Fixes |
|---|---|---|
Some PowerShell Script Block (4104) log doesn't match my custom rules. |
~ The log matches a pre-compiled parent rule first that drops it before reaching my custom rules. ~ Missing logs were labeled as Verbose and logs matching the rules as Warning. |
~ Verified log exist on windows event viewer and ingested via archive.log.~ Tried overwriting built-in Windows base eventchannel and then PowerShell base rules.~ Tested the massive event 4104 log on wazuh-logtest but it matches on json decoder instead of eventchannel. |
IV. Validation and Testing
The summary table below shows that the additional endpoint log sources were ingested and correlated across the different layers of the endpoint.
| Log Source | Test | Result |
|---|---|---|
| Sysmon | Process creation and file creation | Passed |
| PowerShell Script Block Logging | Executed PowerShell script | Passed |
| Auditd | Executed linux command | Passed |
| Apache Web Logs | GET request | Passed |
V. Lessons Learned
- Default Wazuh agent was not able to detect the indicators of compromise on endpoints. Which highlights the need integrating custom logging sources on applications running in the environment.
- Input validation should be applied on both front and back-end to make the UI intuitive for normal users and protected against those with malicious intent.
- Sysmon, PS Script Block Logging, Auditd are crucial sources of endpoint telemetry.
VI. Next Steps
- Investigate and reconstruct a multi-stage simulated cyber attacks.
- Configure Wazuh's File Integrity Monitoring (FIM), active response, and VirusTotal API.