AI-Powered Assessment of Wazuh for Obfuscated Threat Detection

Malware obfuscation techniques pose a significant challenge to modern security monitoring solutions, enabling malicious code to evade detection and persist within compromised systems. Wazuh, a widely used open-source security monitoring platform, provides real-time threat detection and log analysis, facilitating robust security monitoring. However, its effectiveness against obfuscated malware remains largely unexplored. This research investigates the effectiveness of Wazuh’s logging and alerting capabilities in detecting malware obfuscation techniques. By deploying a controlled sandbox environment with a Wazuh server and Windows 11 agent, we analyze different alerts that are generated during the execution of different code functions and signatures. These alerts, generated by the Wazuh server, are then exported as a CSV and processed by artificial intelligence (AI) models to detect suspicious behaviors in the logs that may require further investigation. The findings of this study aim to provide insight into the Wazuh’s strengths and limitations in detecting obfuscated threats, providing recommendations for enhancing its detection mechanisms and comparing its effective log-generation capabilities for training AI models on predicting what alerts are potential threats and require further attention.