Wazuh decoders and rules for Kaspersky KES logs

17 views
Skip to first unread message

Junior Gonçalves

unread,
Jan 6, 2026, 12:35:05 PM (3 days ago) Jan 6
to Wazuh | Mailing List

Hi everyone 

I’m looking for help creating Wazuh decoders and rules for Kaspersky KES logs. I’ve already tried a few approaches, but I’m currently stuck and not able to move forward.

The log is arriving correctly at the Wazuh Manager, for example:

Jan  5 17:29:47 ti04.teste.brasil KES|11.0.0.0 Event type: Object deleted\r\nName: SearchProtocolHost.exe\r\nApplication path: C:\Windows\System32\r\nProcess ID: 21056\r\nResult description: Deleted\r\nType: Virus\r\nName: EICAR-Test-File\r\nUser: BRASILSP\TI04$ (Initiator)\r\nObject: C:\Users\user.teste\Desktop\eicar_com (3).zip//eicar.com\r\nSHA256: 275A021BBFB6489E54D471899F7DB9D1663FC695EC2FE2A2C4538AABF651FD0F\r\nMD5: 44D88612FEA8A8F36DE82E1278ABB02F


  I already tried creating some basic decoders, like these:

<decoder name="kaspersky-kes-base">
  <prematch>KES\|</prematch>
</decoder>

<decoder name="kaspersky-kes-object-deleted">
  <prematch>KES\|11\.0\.0\.0 Event type: Object deleted</prematch>
  <regex>Event type:\s(Object deleted)</regex>
  <order>event_type</order>
</decoder>

<decoder name="kaspersky-kes-sha256">
  <prematch>SHA256:</prematch>
  <regex>SHA256:\s([A-Fa-f0-9]{64})</regex>
  <order>sha256</order>
</decoder>

However, I’m still struggling to properly structure:

  • The decoders (regex, order, multiline handling, correct prematch)

  • The rules (severity level, groups, correlation, descriptions)

My goal is to generate clear Wazuh alerts, such as:

  • Malware detection (virus / quarantined / deleted)

  • Extracting user, affected file, and hash values

  • Proper severity classification

If anyone has experience with Kaspersky KES + Wazuh or can share examples or best practices for decoders and rules, any help or guidance would be greatly appreciated 🙏

Thanks in advance!   

Olamilekan Abdullateef Ajani

unread,
Jan 6, 2026, 2:39:09 PM (3 days ago) Jan 6
to Wazuh | Mailing List
Hello Junior,

I wrote some decoders and rules based on the log you shared. You can use this as a guide to write decoders and rules when needed. Please see below:

 /var/ossec/etc/decoders/local_decoder.xml

<decoder name="kes-parent">
      <prematch type="pcre2">^KES\|</prematch>
   </decoder>

<decoder name="kes-object-detection">
  <parent>kes-parent</parent>
  <regex type="pcre2">KES\|[0-9.]+\s+Event type:\s*([^\r\n]+)\\r\\nName:\s*([^\r\n]+)\\r\\nApplication path:\s*([^\r\n]+)\\r\\nProcess ID:\s*([0-9]+)\\r\\nResult description:\s*([^\r\n]+)\\r\\nType:\s*([^\r\n]+)\\r\\nName:\s*([^\r\n]+)\\r\\nUser:\s*([^\r\n]+)\\r\\nObject:\s*([^\r\n]+)\\r\\nSHA256:\s*([A-F0-9]+)\\r\\nMD5:\s*([A-F0-9]+)</regex>
   <order>event_type,process_name,app_path,pid,result,malware_type,malware_name,user,object,hash-sha256,hash-md5</order>
</decoder>

For rules: /var/ossec/etc/rules/local_rules.xml

<group name="KES-event">
<rule id="120100" level="10">
  <decoded_as>kes-parent</decoded_as>
  <description>KES Malware Deleted — $(malware_name) on $(object)</description>
 
</rule>
</group>

That being said, you can also check out the documentation below on writing decoders and rules:

Please let me know if you need further assistance on this.
KSC-EVENTS.png

Junior Gonçalves

unread,
Jan 7, 2026, 7:55:01 AM (3 days ago) Jan 7
to Wazuh | Mailing List

Hello,

Thank you very much for your help and for sharing the decoders and rules. I tested them in my environment and they worked correctly — I was able to parse the fields and generate alerts as expected. This was extremely helpful.

I have one additional question:
Is it possible to create a generic rule to capture all Kaspersky (KES) alerts, regardless of the event type, while still keeping the main fields separated (such as event type, malware name, object, hashes, user, etc.)?

My idea would be to have:

  • one generic rule for visibility of all Kaspersky events, and

  • more specific rules (like malware detected/deleted) built on top of it.

If you have any recommendation or best practice for this approach, I would really appreciate it.

Thank you again for your time and support.

Best regards,
Junior

Olamilekan Abdullateef Ajani

unread,
Jan 7, 2026, 8:34:20 AM (3 days ago) Jan 7
to Wazuh | Mailing List
Hello Junior,

I am glad the decoders and rule worked for you. In response to your second question, yes, you can use a single generic decoder for group logs. However, you should also note that the logs need to be related in the fields present so the decoder can match them. You must sample the logs and tune the decoders to match them, not just create them. Once that has been set, the rules should not be an issue.

That being said, you can also check out the documentation below for writing decoders and rules:
A good example would be the decoders and rules found in the repository below, they are not similar to what you shared. So you need to properly sample all the logs side by side and identify related fields you need to extract before creating the decoders.


Reply all
Reply to author
Forward
0 new messages