FIM scanning
CRIZ
Hello Wazuh Community,
I have a question regarding how Wazuh FIM handles malicious hash detection during the initial scan of an agent.
For example, suppose a server is rebuilt using a backup that already contains a known malicious file. After the server is rebuilt, the Wazuh agent is installed and the initial FIM scan is performed. The malicious file is already present on the filesystem, and no changes are made to the file afterward.
In this scenario, will FIM detect the file's hash and check it against the configured malicious hash database during the initial scan?
Or does the malicious hash check occur only when FIM detects a subsequent change to the file, such as a change in its hash, size, permissions, or other monitored attributes?
In other words, if a malicious file already exists when the agent performs its first FIM scan and the file never changes afterward, should we expect Wazuh to generate an alert for the malicious hash?
Could you please clarify how this works and, if possible, point me to the relevant documentation or configuration details?
Thank you for your help.
Best regards,
CRIZ
Md. Nazmur Sakib
FIM monitors file system changes to detect the creation, modification, and deletion of files. It does not create any alert for the initial scan. It keeps the initial scan as a base to compare it with the next scan to get information about any kind of creation, modification, and deletion of files on the monitored path.
So, if the agent is installed on an OS that already has malicious files before installing the agent. The FIM module will not be able to trigger any alert for those. As I have mentioned, FIM does not trigger any alert for the initial scan result.
Ref: File integrity monitoring > How it works
To get these kinds of alerts in Wazuh will need to use other log sources for file monitoring, like antivirus, Windows Defender, etc logs.
Further, you can request a feature request using our GitHub, so that the development team prioritizes this while planning the future roadmap.
https://github.com/wazuh/wazuh/issues
Let me know if you need any further information on this.