Overview

This project focused on enhancing the endpoint security monitoring capabilities of a Wazuh deployment by integrating it with VirusTotal, a widely used malware scanning and reputation service. The goal was to automate the process of checking newly detected files against VirusTotal, enabling rapid classification of suspicious files as malicious or benign. By combining Wazuh’s real-time file monitoring with VirusTotal’s threat intelligence, the project created an automated malware detection and alerting pipeline. This integration demonstrates how security teams can leverage external threat intelligence to improve situational awareness and accelerate incident response.

The Challenge

Modern malware frequently uses polymorphic techniques and evasion strategies that allow it to bypass traditional signature-based defenses. Detecting such threats at the endpoint requires access to updated intelligence and the ability to correlate telemetry with external sources. The key challenge addressed in this project was automating the verification of detected files against a reliable threat intelligence source without introducing significant latency or operational overhead. Ensuring that the integration was secure, accurate, and compatible with Wazuh’s monitoring and alerting framework was critical.

Tools

• Wazuh manager and Windows/Linux agents for telemetry collection and event correlation
• VirusTotal API for real-time malware reputation and scanning
• Python for scripting automated API queries and handling responses
• Custom Wazuh rules for alerting on malicious file detections
• Active Response module in Wazuh for automated threat containment
• Test environment with virtual machines to safely simulate malware and benign files

Execution

Configuring File Integrity Monitoring (FIM) on the Endpoint

As the first step in enabling automated malware detection via VirusTotal, I configured Wazuh’s File Integrity Monitoring (FIM) on the endpoint to watch for new or modified files. This ensures that any file creation or change ( such as a downloaded malware payload ) triggers Wazuh to capture relevant data (including file hash) that can then be sent to VirusTotal for scanning.

1. Opened the agent’s configuration file which is located at C:\Program Files (x86)\ossec-agent\ossec.conf.
2. Located the <syscheck> block in ossec.conf, and ensured that <disabled> was set to no. This enables FIM.
3. Added a directory to be monitored in (near) real-time. In my case I configured Wazuh to monitor the Downloads folder of a all the users on the endpoint

<syscheck>
  …
  <directories realtime="yes">C:\Users\*\Downloads</directories>
  …
</syscheck>