This article details the configuration of Wazuh to automatically remove detected malware using its Active Response feature, integrating with VirusTotal for threat intelligence. This approach aims to provide immediate response to malicious file introductions without manual intervention.

Previous Configuration and Current Objective

Previously, a Wazuh manager was configured to query VirusTotal via API calls upon file modifications or additions detected by Wazuh agents. This process involved retrieving a file's hash, submitting it to VirusTotal, and receiving threat intelligence. While this provided alerts about malicious files, it lacked an automated removal mechanism. The current objective is to implement an Active Response script that proactively removes identified malware, thereby reducing the window of opportunity for the malware to execute.

Configuration Steps

Achieving this automated removal requires several key configuration components on both the Wazuh manager and agent.

Wazuh Manager Configuration

1. Decoder and Rule Creation:

   • A custom decoder is added to localdecoder.xml to log active response messages in active-response.log. This decoder specifically looks for the string "remove positive threat located in".
   • A new rule is added to local_rules.xml. This rule, with ID 1000092 and level 12, is triggered when signature ID 607 fires. Signature ID 607 is a built-in Wazuh rule that fires when an active response script is executed. The new rule further refines this by matching the decoded string "remove positive" from the custom decoder, correlating it with a file removal due to a VirusTotal positive detection. The rule's description dynamically includes the file path of the removed file.

2. Active Response Script Integration:

   • A custom script, named custom-remove-threat, is created and placed in the /var/ossec/integrations/ directory on the Wazuh manager. This script enables the Wazuh manager to send an event to the agent via an AR socket, utilizing kernel modules for interaction with the Linux agent.
   • Permissions for this script are set to executable (chmod +x) and ownership is changed to root:ossec (chown root:ossec).

3. ossec.conf Configuration:

   • The ossec.conf file on the manager is modified to define the active response command and integration.
   • Command Definition: A <command> block is added to define a new command named remove-threat. This command points to the executable remove-threat.sh (which will reside on the agent) and expects a file_name variable.
   • Active Response Definition: An <active-response> block is configured. It specifies the command name as remove-threat, sets the location to local (meaning it runs on the agent that triggered the response), and is not disabled.
   • Integration Definition: An <integration> block is added for custom-remove-threat. This integration is configured to run when rule ID 87105 fires, which is the built-in Wazuh rule for VirusTotal positive detections. The alert format is set to json.

4. Manager Restart: After applying these changes, the Wazuh manager must be restarted for the configurations to take effect.

Wazuh Agent Configuration

1. Active Response Script Deployment:

   • A bash script named remove-threat.sh is created in the /var/ossec/active-response/bin/ directory on the Wazuh agent.
   • The script uses the rm -f command to forcefully remove a specified file.
   • Upon successful removal, it logs "remove positive threat" followed by the file path. If an error occurs, it logs an error message.
   • Permissions are set to executable (chmod +x) and ownership to root:ossec (chown root:ossec).

2. ossec.conf Configuration (Agent):

   • Within the agent's ossec.conf, the syscheck configuration is reviewed.
   • The realtime setting within the syscheck configuration must be set to yes. This ensures that the Wazuh agent monitors directories in real-time, allowing for immediate detection and response when new files are added. If realtime is disabled, syscheck scans occur at intervals (defaulting to every 12 hours), which would delay the detection and removal of malware.
   • The Wazuh agent must be restarted after enabling realtime monitoring.

Testing the Configuration

To test the automated removal process:

1. Tail Active Response Log: On the Wazuh manager, tail the active-response.log file (tail -f /var/ossec/logs/active-response.log).
2. Download Malware Sample: On the Wazuh agent, download a known malware sample. For testing purposes, the website dosmalware.eu is suggested as a source for malware samples. A wget command can be used to download a .zip file containing malware.
3. Observe Results:
   • The Wazuh manager should receive the VirusTotal alert (rule ID 87105).
   • The manager will then trigger the remove-threat.sh active response script on the agent.
   • The malicious file should be automatically removed from the agent's file system.
   • The active-response.log on the manager will show the execution of the remove-threat.sh script.
   • An ls command on the agent's directory where the file was downloaded should confirm the file's absence.

Conclusion and Caution

This configuration enables Wazuh to act as a basic anti-virus solution by automatically removing detected malicious files. This automation provides immediate response capabilities, significantly reducing the risk posed by newly introduced malware.

However, users are advised to exercise caution with any automation. There is a potential for active response scripts to inadvertently remove critical system or application files if not configured precisely. It is crucial to ensure that the active response script targets only known malicious files and does not pose a risk to legitimate system operations.

The scripts and configuration syntax for this setup are available in the provided GitHub repository.