Reply to thread

Message

<blockquote data-quote="javier.castro" data-source="post: 1103739" data-attributes="member: 117282">From Santiago Bassett:The article, written by a Kaspersky analyst (<a href="https://www.linkedin.com/in/alexander-kryazhev-78078a252/" target="_blank">Alexander Kryazhev</a>), explains how Wazuh is misused by attackers who already had full administrative privileges over the victim&#039;s system. This scenario is similar to how attackers might abuse other legitimate tools, like SSH, once they control a system.According to the article, attackers installed the Wazuh agent and enabled &quot;remote_commands&quot; feature, which requires manual activation and admin-level access. This feature is useful for incident responders and digital forensics, and it is common in XDR (eXtended Detection and Response) products. The attackers misused it to run commands in the already compromised system.In summary, Wazuh is not the attack vector. The system was already fully compromised. This is a common case of attackers abusing legitimate tools for malicious purposes after gaining admin access.Wazuh itself is a defensive tool designed to protect systems, not to attack them.I hope it helps.</blockquote>

[QUOTE="javier.castro, post: 1103739, member: 117282"] From Santiago Bassett: The article, written by a Kaspersky analyst ([URL='https://www.linkedin.com/in/alexander-kryazhev-78078a252/']Alexander Kryazhev[/URL]), explains how Wazuh is misused by attackers who already had full administrative privileges over the victim's system. This scenario is similar to how attackers might abuse other legitimate tools, like SSH, once they control a system. According to the article, attackers installed the Wazuh agent and enabled "remote_commands" feature, which requires manual activation and admin-level access. This feature is useful for incident responders and digital forensics, and it is common in XDR (eXtended Detection and Response) products. The attackers misused it to run commands in the already compromised system. In summary, Wazuh is not the attack vector. The system was already fully compromised. This is a common case of attackers abusing legitimate tools for malicious purposes after gaining admin access. Wazuh itself is a defensive tool designed to protect systems, not to attack them. I hope it helps. [/QUOTE]

Verification