Wazuh Agent Remote Execution

X__Junior

Detects enabling of remote commands in the Wazuh agent. By setting this value to 1, the agent is allowed to accept and execute remote commands from the Wazuh manager or other controlling systems. This could be used for legitimate remote administration, but it also opens up the potential for misuse if the Wazuh manager or server it's connecting to is malicious or compromised, as it grants significant control over the agent.

2024-10-07 00:00:00

None

efab1f46-b043-4546-a747-962b42906493

attack.t1033

Nextron Sigma feed only (private)