Key Takeaways
- Ransomware is a race. Detection must be fast and paired with automated containment, because manual response is usually too slow once encryption starts.
- File integrity monitoring (FIM) is a core signal: ransomware causes a burst of file modifications and new encrypted files with odd extensions across directories.
- Behavioural signals matter more than hashes. Watch for shadow copy deletion (vssadmin delete shadows), backup tampering, mass file renames and known encryptor process patterns.
- Active response closes the loop: a high-severity ransomware rule can trigger host isolation, process kill or account disable automatically, buying minutes that matter.
- Tune against backups and bulk jobs so legitimate mass file operations do not cause false isolation.
Why Ransomware Needs Automated Detection
Ransomware behaves differently from most threats. Where an intruder may dwell quietly for weeks, ransomware is deliberately fast and destructive once it executes: it deletes backups, disables recovery, and encrypts files across local and network drives in minutes. By the time a human analyst reads an alert, significant damage may already be done.
That speed changes the detection strategy. It is not enough to detect ransomware; you need to detect it early in its sequence and respond automatically. Wazuh is well placed for this because it combines file integrity monitoring, log-based process detection and an active response framework in one agent, so detection and containment happen on the endpoint without waiting for a central decision.
File Integrity Monitoring as a Ransomware Signal
Wazuh file integrity monitoring (FIM, the syscheck module) watches directories for file creation, modification and deletion. Ransomware produces a very distinctive FIM pattern: a rapid burst of modifications across many files, the appearance of new files with unusual or random extensions, and often ransom-note files (readme or how-to-decrypt text files) dropped into every affected folder.
To use FIM for ransomware, enable real-time monitoring on the directories that hold user and business data, not just system files. A Wazuh frequency rule can then alert when the number of FIM change events from one host crosses a threshold within a short window, which captures the mass-encryption burst. Watching specifically for the creation of ransom-note filenames and known malicious extensions adds a second, high-confidence signal.
Need Help Building These Detections?
Codesecure designs, deploys and tunes Wazuh-based SOC stacks (manager, indexer, dashboard, agents, custom rules, decoders and active response) for businesses across India, Singapore, UAE and Malaysia. ISO/IEC 27001:2022 certified delivery, named OSCP, CEH and CISSP consultants, fixed-price proposals.
See SOC and SIEM Services →Behavioural and Process Signals
FIM detects the encryption itself, but earlier signals let you catch ransomware before most files are lost. The classic precursor is shadow copy deletion: ransomware runs commands like vssadmin delete shadows or wmic shadowcopy delete to prevent recovery. Collecting process-creation events (Windows 4688 or Sysmon Event ID 1) lets a Wazuh rule alert the moment these commands run, which is a strong early indicator.
Other behavioural signals include tampering with or stopping backup and security services, bcdedit commands that disable recovery, mass file renames, and known encryptor binaries or living-off-the-land patterns. On Linux, watch for rapid file changes plus suspicious process activity. These command-line and process detections are higher confidence than file bursts alone and give you a few extra seconds, which for ransomware is meaningful.
Known Indicators and Threat Intelligence
Behavioural detection is the backbone, but known indicators add coverage for recognised families. Integrating threat intelligence, for example matching file hashes, IPs and domains against a MISP feed or VirusTotal, lets Wazuh flag known ransomware tooling and command-and-control infrastructure. Wazuh can enrich alerts through integrations that check observed indicators against intelligence sources.
Keep the balance right: signatures and hashes catch known threats but miss new variants, while behavioural detection catches novel ransomware by what it does rather than what it is. A layered approach, behavioural FIM and process rules first, indicators second, gives both breadth and precision. Mapping these detections to MITRE ATT&CK (data encrypted for impact is T1486, inhibit system recovery is T1490) helps you confirm coverage of the ransomware kill chain.
Automated Containment with Active Response
The payoff of fast detection is automated containment. Wazuh active response can run a script on the endpoint when a rule of sufficient severity fires. For ransomware, a high-confidence detection (such as shadow copy deletion combined with a FIM burst) can trigger an active response that isolates the host from the network, kills the offending process, or disables the compromised account, all within seconds and without human intervention.
Automated isolation is powerful but must be deployed carefully. Scope it to high-confidence, high-severity rules so a false positive does not needlessly take a production server offline. A safe pattern is to isolate only when two independent signals agree (for example process command and file burst), to exclude known backup and bulk-processing hosts, and to alert the SOC immediately so a human confirms and manages recovery. Used with discipline, active response turns Wazuh from a detector into a first responder.
Running Wazuh But Missing Attacks?
Whether you need custom rule development, active response playbooks, a detection coverage review against MITRE ATT&CK, or full tuning, our SOC lead is available for a 30-minute free scoping call. No obligation, no slideware.
Talk to a SOC Engineer →Tuning to Avoid False Isolation
The biggest risk with ransomware automation is a false positive that isolates a healthy system. Legitimate operations can look like ransomware: a backup job touching thousands of files, a bulk media import, a software deployment, or an archive extraction. Without tuning, these could trigger a FIM-burst rule and, worse, an automated isolation.
Tune by excluding known bulk-processing paths and hosts from the aggressive FIM-burst rules, by requiring a behavioural signal (like shadow deletion) in addition to the file burst before isolating, and by setting thresholds from your own baseline rather than a generic default. Test the active response in a controlled way before enabling it in production. The aim is automation you can trust: aggressive enough to stop real ransomware, precise enough that it never fires on normal business activity.
Frequently Asked Questions
How does Wazuh detect ransomware?
Wazuh detects ransomware through several layers: file integrity monitoring spots the burst of file changes and new encrypted files that encryption produces; process and command-line rules catch early behaviours like shadow copy deletion and backup tampering; and threat intelligence integration matches known ransomware indicators. Behavioural detection is the backbone because it catches new variants by what they do, not just known signatures.
Can Wazuh stop ransomware automatically?
Yes, through active response. A high-confidence, high-severity ransomware rule can trigger a script on the endpoint that isolates the host from the network, kills the process or disables the account within seconds. To avoid false isolation, scope automated containment to high-confidence detections (for example requiring both a process signal and a file burst) and exclude known bulk-processing hosts.
What is the earliest signal of ransomware I can detect?
Shadow copy deletion is one of the earliest and highest-value signals. Ransomware commonly runs commands such as vssadmin delete shadows or wmic shadowcopy delete to prevent recovery before it encrypts files. Collecting process-creation events (Windows 4688 or Sysmon Event ID 1) lets a Wazuh rule alert the moment these run, often before most files are lost.
Which directories should FIM watch for ransomware?
Enable real-time FIM on directories that hold user and business data (documents, shares, databases and backups), not just system directories, because that is what ransomware encrypts. Pair directory monitoring with a frequency rule that alerts when file-change events from one host exceed a baseline threshold in a short window, and watch for ransom-note filenames and known malicious extensions.
How do I stop ransomware detection from causing false isolation?
Tune carefully. Exclude known bulk-processing paths and hosts (backup servers, media imports, deployment systems) from aggressive FIM-burst rules, require a second behavioural signal such as shadow deletion before triggering automated isolation, and set thresholds from your own baseline rather than a generic value. Test active response in a controlled setting before enabling it in production.
Can Codesecure set up ransomware detection and response in Wazuh?
Yes. Codesecure builds layered Wazuh ransomware detection (FIM bursts, behavioural and command-line rules, threat-intel enrichment) and carefully scoped active response for automated containment, tuned against your environment to avoid false isolation. ISO/IEC 27001:2022 certified delivery with named OSCP, CEH and CISSP consultants across India, Singapore, UAE and Malaysia.
Stop Ransomware In Minutes, Not After The Damage
Codesecure builds layered Wazuh ransomware detection and carefully scoped active response, so a high-confidence detection isolates the host automatically before encryption spreads. Tuned against your environment by named OSCP, CEH and CISSP consultants.
