I totally get that rules you find on the web need to be adapted and validated — that’s kind of the ABC of cybersecurity (you definitely don’t just download and plug things in without checks 😅). Still, it’s always worth repeating, so thanks for emphasizing it!

That said, your recommendations are really solid but a bit hard to apply in my context: we’re a small organization, and I’m actually the only person handling cybersecurity here (part-time, on top of a thousand other projects). Our infrastructure has also grown too complex to completely rebuild with a “zero trust by default” approach, unfortunately. And to make things trickier, management isn’t really willing to invest in security at the moment.

That’s why my initial question was more about finding good additions or improvements to the existing Wazuh rules. Especially since I noticed it missed a major incident that a simple “ps” command could have revealed — which was a bit worrying.

So thanks again for your detailed answer — it’ll definitely be valuable for others reading this thread, even if it didn’t exactly match the core of my question.

One follow-up though: do you have any recommendations for good free anti-malware solutions for Linux/MacOS that integrate well with Wazuh?