Overview

This engagement extended the existing Wazuh monitoring deployment to include a Windows endpoint with focused detection and containment logic for the XWorm remote access trojan. The objective was to demonstrate end to end detection: collect Windows telemetry, match indicators and behaviors tied to XWorm, and automate containment using Wazuh CDB lists and Active Response. The result is a repeatable pattern for adding tailored malware detection and response capabilities to an open source security stack.

The Challenge

XWorm is a stealthy RAT that uses persistence, obfuscated binaries, and common system utilities to blend into normal activity. Detecting it requires not only signature matching but also behavioral correlation across process, file and registry events. The challenge was to create high fidelity detection logic that minimizes false positives while enabling automatic containment. Key constraints included operating in a mixed environment where Windows telemetry needed to be normalized and false positives could disrupt business operations.

XWorm Behavior

XWorm is a stealthy Windows-based Remote Access Trojan designed to evade traditional defenses through script-based execution, in-memory operations, and multi-stage payload delivery. When launched on a Windows endpoint, it relies heavily on PowerShell to load and decrypt its components, establish persistence, and initiate command-and-control activity.

Typical behavior observed during execution includes:

• Launching PowerShell with ExecutionPolicy set to Bypass and the window hidden, preventing user visibility and bypassing policy restrictions.
• Running heavily obfuscated or Base64-encoded code, allowing the malware to conceal its true functionality.
• Decrypting and loading an AES-encrypted second-stage payload directly in memory, reducing forensic artifacts on disk.
• Dropping additional malicious .vbs and .bat helper files into: C:\Users\<USER>\AppData\Local\Adobe-Hub\
• Using wscript.exe to execute the malicious VBS script and cmd.exe to run the accompanying batch file for system modification.
• Operating primarily through in-memory execution, a technique that helps it evade signature-based antivirus detection and remain persistent.

Tools used

• Wazuh Manager for centralized collection, correlation and Active Response orchestration
• Wazuh Windows agent for WinEventLog and Sysmon ingestion
• Sysmon for high fidelity process, file, and registry telemetry on the Windows host
• Wazuh CDB lists for efficient indicator matching
• Active Response scripts for automated remediation actions such as process kill and file deletion