Wazuh Proof of Concept

Vorbereitung beim Nutzen eines Debian Systems

• sudo apt install iptables
• sudo update-alternatives --set iptables /usr/sbin/iptables-nft
• sudo iptables -L

Proof of Concept

• Blocking a known malicious actor
• File integrity monitoring
• Detecting a brute-force attack
• Monitoring Docker events
• Detecting unauthorized processes
• Network IDS integration
• Detecting an SQL injection attack
• Detecting suspicious binaries
• Detecting and removing malware using VirusTotal integration
• Detecting a Shellshock attack
• Vulnerability detection

Source

• https://documentation.wazuh.com/current/proof-of-concept-guide/index.html