Wazuh agents on Windows and Linux endpoints feed Sysmon process telemetry into ARIA continuously. A YARA signature library scans files weekly. ARIA detects ransomware precursors, credential dumping, and lateral movement before they complete.
ARIA's endpoint visibility layer is built on Wazuh, an open-source security monitoring agent that runs on Windows and Linux endpoints and ships event data to a central manager. Wazuh collects file integrity events, process execution records, registry changes (Windows), authentication logs, and system-level anomalies — all of which feed into ARIA's triage pipeline.
The agent is lightweight and runs as a background service. It does not perform inline blocking — it observes and reports. Containment actions (network isolation of a compromised endpoint, for example) are proposed by ARIA and require explicit security engineer approval before execution.
Wazuh agents are deployed during the ARIA onboarding process, with configuration tuned to the specific environment — which directories to monitor for file integrity, which process categories to prioritize, and which log sources to ingest from the operating system's event subsystem.
On Windows endpoints, ARIA deploys Microsoft's Sysinternals System Monitor (Sysmon) alongside the Wazuh agent. Sysmon provides process-level telemetry that the standard Windows event log does not: process creation with full command-line arguments, parent-child process relationships, network connection events with the initiating process identified, file creation timestamps, and registry modifications.
This telemetry is the basis for detecting the behaviors that matter most in endpoint-targeted attacks:
Shadow copy deletion via vssadmin.exe delete shadows or wmic.exe shadowcopy delete is the most reliable pre-encryption indicator in Windows ransomware campaigns — attackers delete backups before encrypting to eliminate the victim's recovery path. Sysmon captures the process creation event with full command-line arguments. ARIA detects this immediately, before encryption begins.
Living-off-the-land binaries — legitimate Windows tools used for malicious purposes — are a primary attacker technique for avoiding signature detection. Sysmon's process creation events, with parent-child relationships, identify anomalous usage patterns: mshta.exe spawning powershell.exe, wscript.exe making network connections, certutil.exe downloading files from external URLs. These combinations are rare in legitimate workflows and reliable indicators of post-exploitation activity.
LSASS process access — tools attempting to read credential material from the Local Security Authority Subsystem — is captured by Sysmon's process access events. ARIA detects suspicious processes accessing LSASS with memory read permissions, which is the foundational indicator for credential dumping tools including Mimikatz and its derivatives.
Network connections from unusual processes, authentication events across the domain combined with credential access indicators, and remote service installation events on adjacent hosts are the primary lateral movement signals Sysmon and the Wazuh agent surface. ARIA correlates these across endpoints in the tenant — a single endpoint's activity may be ambiguous; the same pattern appearing on three hosts in sequence is not.
YARA is a pattern-matching tool used to identify files that match known malware signatures or structural patterns. SeenProtect maintains a YARA signature library updated weekly from threat intelligence sources. The Wazuh agent runs this library against files on monitored endpoints on a weekly schedule.
YARA scanning catches known malware dropped to disk — commodity ransomware families, known remote access tools, credential harvesters — that behavioral detection may miss during the installation phase. It is a complement to the behavioral detection from Sysmon, not a replacement for it.
A YARA match produces an alert in ARIA's pipeline. ARIA investigates: when was the file created, which process wrote it, what network connections has the process made, and is the file referenced in any other alert. The investigation determines whether the file represents an active threat or a detection artifact.
The Wazuh agent runs on managed endpoints where installation is possible. Devices where agent deployment is not supported — unmanaged personal devices accessing company systems, network equipment, IoT devices, cloud infrastructure — are outside the agent's scope. Cloud workload monitoring (EC2, GCE, containers) requires separate configuration and is available on Enterprise plans.
ARIA's endpoint detection is behavioral and signature-based. It does not perform vulnerability scanning or patch status assessment as part of the continuous monitoring pipeline. Vulnerability management is a separate function.
A 30-minute call and a Wazuh agent trial deployment on a representative endpoint. ARIA produces a findings report within 48 hours — including any active indicators on the monitored hosts.
Book Free AssessmentARIA monitors email, identity, and cloud activity alongside endpoints — correlated across the same triage pipeline.
View All Use Cases