How to detect Medusa Ransomware with Wazuh?

Ransomware attacks are no longer rare or limited to large corporations. Today, they’re everywhere—more common, more aggressive, and increasingly harder to detect. One of the most talked-about names lately is Medusa, a ransomware-as-a-service (RaaS) variant that first emerged in June 2021 and has already affected over 300 organizations worldwide.

This malware has struck critical sectors such as healthcare, education, legal, insurance, technology, and even manufacturing. How does it do it? In most cases, it enters through the usual weak spots: phishing emails and unpatched software vulnerabilities. And the worst part? No matter how secure you think your organization is, Medusa finds a way in. Since February 2025, it's come back stronger, and the number of attacks is rising.

It specifically targets Windows systems, encrypts files, demands enormous ransoms, and leaves chaos in its wake—operations come to a halt, financial losses mount, and reputations suffer.

In this article, we’ll show you how to detect this threat early using Wazuh—an open-source security platform that helps you monitor your infrastructure, trigger alerts, and respond quickly to suspicious activity.

Table of Contents

• How Does Wazuh Detect Medusa?
• Wazuh Server Setup
• How to View Medusa Alerts in the Wazuh Dashboard
• How Does Wazuh Remove Malicious Files?

¿Qué hace exactamente el ransomware Medusa cuando ataca?

Medusa doesn't arrive quietly. Once it gains access to a system—whether through a phishing email or by exploiting an unpatched vulnerability—it gets to work immediately.

The first thing it does is terminate processes and services that could interfere with its operation. It comes prepared with a list and executes commands like:

net stop "{Nombre del servicio}" /y
taskkill /F /im {Nombre del proceso} /T

These commands essentially tell the system: “Shut this down, get it out of my way.”

Next, it starts encrypting files on the compromised machine, appending its own file extension to make it clear who’s in control now. It’s “smart” about this too—it avoids encrypting certain system directories like C:\Windows, C:\PerfLogs, and others, so the machine doesn’t crash completely... at least not right away.

To make recovery nearly impossible, it deletes all shadow copies with the following command: vssadmin delete shadows /all /quiet. As a final touch, it drops a ransom note in every affected folder. The file is typically named: !!!READ_ME_MEDUSA!!!.txt.

In it, the attackers specify the ransom amount (usually in cryptocurrency) and outline what will happen if you don’t comply. Spoiler: it’s nothing good.

What Infrastructure Did Wazuh Use for Testing?

To test the detection of Medusa ransomware, Wazuh set up a practical and easily replicable lab environment. Here's what they used:

1. A pre-configured Wazuh OVA (version 4.11.2), which includes everything essential: the server, indexer, and dashboard. Essentially, it's a ready-to-deploy virtual machine that lets you get started immediately.
   
   
2. A Windows 11 endpoint acting as the victim system, where they installed the Wazuh agent (version 4.11.2) and connected it to the server.

This setup allowed them to closely monitor what Medusa does once it gains access.

Read more: Ransomware Definition: How to Stay Protected

How Does Wazuh Detect Medusa?

Custom Rules to Identify the Threat

To detect Medusa in action, you need to know exactly what to look for. It's not enough to rely on a traditional antivirus or casually browse through logs—you need to pay close attention to the behavioral patterns that this ransomware leaves behind.

For this purpose, the Wazuh team set up a monitoring environment using a Windows machine and leveraged Sysmon, a powerful tool that provides deep visibility into system activity.

From the events generated by Sysmon, they created custom detection rules on the Wazuh server to identify suspicious behaviors, such as:

1. Sudden termination of processes

2. Unexpected shutdown of services

3. Unusual file modifications or renaming patterns

All of these are red flags that may indicate Medusa (or another ransomware) is actively compromising the system.

These custom rules form the backbone of Wazuh’s ability to detect ransomware attacks in real time, allowing security teams to respond quickly before damage spreads.

How to Configure Sysmon on Windows to Work with Wazuh

If you want to replicate Wazuh’s approach for detecting ransomware like Medusa, here’s a step-by-step guide to setting up Sysmon on a Windows machine and integrating it with the Wazuh agent:

Step 1: Download Sysmon

1. Get Sysmon from the official Microsoft Sysinternals page.

2. Extract the ZIP file to your preferred folder.

Step 2: Download the Sysmon Configuration File

Open PowerShell as Administrator and run the following command (replace the path with your actual Sysmon directory): wget -Uri https://wazuh.com/resources/blog/emulation-of-attack-techniques-and-detection-with-wazuh/sysmonconfig.xml -OutFile <SYSMON_EXECUTABLE_PATH>\sysmonconfig.xml

Step 3: Install Sysmon with the Configuration

Navigate to the folder where you have Sysmon64.exe, then execute: .\Sysmon64.exe -accepteula -i sysmonconfig.xml

Step 4: Configure the Wazuh Agent to Collect Sysmon Logs

Edit the following file: C:\Program Files (x86)\ossec-agent\ossec.conf

Inside the <ossec_config> block, add: 

<localfile>
  <location>Microsoft-Windows-Sysmon/Operational</location>
  <log_format>eventchannel</log_format>
</localfile>

Step 5: Restart the Wazuh Agent

To apply the changes, restart the agent with this PowerShell command: Restart-Service -Name wazuh

With this setup, Sysmon and Wazuh will now work together to monitor your Windows environment for suspicious behavior—giving you a powerful toolset to detect ransomware threats like Medusa before they cause serious damage.

Wazuh Server Configuration

To effectively detect Medusa, it’s also essential to prepare the Wazuh server with custom detection rules that identify the typical behaviors of this ransomware on Windows systems.

Step 1: Create the Rule File: On your Wazuh server, create a new XML rule file at the following location: /var/ossec/etc/rules/medusa_ransomware_rules.xml

Step 2: Add Custom Detection Rules: 

<group name="medusa,ransomware,">

<!--Detects system process termination -->

<rule id="100012" level="2">

<if_sid>61603</if_sid>

<field name="win.eventdata.commandLine" type="pcre2">(?i)taskkill \/F \/IM .*. \/T</field>

<field name="win.eventdata.parentImage" type="pcre2">(?i)[C-Z]:.*\\\\.*.exe</field>

<description>System process terminated using $(win.eventdata.originalFileName). Suspicious activity detected.</description>

<mitre>

<id>T1490</id>

<id>T1059.003</id>

</mitre>

</rule>

<!--Detects multiple system process termination -->

<rule id="100013" level="12" frequency="10" timeframe="300">

<if_matched_sid>100012</if_matched_sid>

<description>Multiple system processes terminated using $(win.eventdata.originalFileName). Suspicious activity detected.</description>

<mitre>

<id>T1490</id>

<id>T1059.003</id>

</mitre>

</rule>

<!--Detects system service termination -->

<rule id="100014" level="2">

<if_sid>92031</if_sid>

<field name="win.eventdata.parentImage" type="pcre2">(?i)[C-Z]:.*\\\\.*.exe</field>

<field name="win.eventdata.commandLine" type="pcre2">(?i)[C-Z]:.*\\\\.*.net.*. stop \\.*.\\" \/y</field>

<description>System service terminated using $(win.eventdata.originalFileName). Suspicious activity detected.</description>

<mitre>

<id>T1490</id>

<id>T1059.003</id>

</mitre>

</rule>

<!--Detects multiple system service termination -->

<rule id="100015" level="12" frequency="60" timeframe="500" ignore="500">

<if_matched_sid>100014</if_matched_sid>

<description>Multiple system services terminated using $(win.eventdata.originalFileName). Suspicious activity detected.</description>

<mitre>

<id>T1490</id>

<id>T1059.003</id>

</mitre>

</rule>

<!-- Ransom note file creation -->

<rule id="100016" level="15" timeframe="200" frequency="2">

<if_sid>61613</if_sid>

<field name="win.eventdata.image" type="pcre2">(?i)[C-Z]:.*\\\\.*.exe</field>

<field name="win.eventdata.targetFilename" type="pcre2">(?i)[C-Z]:.*.\\\\!!!READ_ME_MEDUSA!!!.txt</field>

<description>Medusa ransom note $(win.eventdata.targetFilename) has been created in multiple directories. Possible Medusa ransomware detected.</description>

<mitre>

<id>T1486</id>

</mitre>

</rule>

<rule id="100017" level="15" timeframe="300" frequency="2" ignore="100">

<if_matched_sid>100015</if_matched_sid>

<if_sid>100013</if_sid>

<description>Possible Medusa ransomware detected.</description>

<mitre>

<id>T1486</id>

</mitre>

</rule>

</group>

Read more:  How the SolarWinds Cyber Attack Worked: Lessons Learned

How Does Wazuh Remove Malicious Files Before They Cause Damage?

When ransomware manages to execute, it’s usually too late—the damage is done, files are encrypted, and system recovery becomes a nightmare. That’s why the goal is to detect and eliminate malicious files before they can run. Sounds ideal, right? Well, Wazuh makes this possible through a powerful preventive approach.

Proactive Protection with Wazuh

To prevent execution of malicious files, Wazuh recommends enabling pre-execution protection by combining its File Integrity Monitoring (FIM) module with tools like VirusTotal or YARA.

Here’s how it works:

1. Whenever a new file is created or downloaded, Wazuh calculates its hash.

2. It then checks this hash against known malware signatures in threat intelligence databases.

3. If a match or suspicious pattern is found, Wazuh triggers an automated response to delete the file—before it can be executed.

How It Works with YARA

In this part of the lab, Wazuh configured its FIM module to monitor a specific directory. Every time a file is created or modified in that folder, the following happens:

1. FIM triggers a YARA scan of the file.

2. YARA evaluates the file using predefined detection rules designed to catch ransomware signatures.

3. If the file matches a known malicious pattern, Wazuh executes an Active Response script that automatically deletes the file.

This setup ensures that suspicious files are neutralized before they can initiate any encryption or spread across the network—cutting off Medusa (or any malware) before it even gets started.

How to Prepare a Windows Endpoint for YARA Integration with Wazuh

In order for Wazuh to use YARA to detect malicious files on a Windows system, the endpoint needs to be properly set up. Here’s a detailed step-by-step guide to get everything ready:

Pre-requisites

Before starting, make sure you have the following installed:

1. Python 3.12.2 or later

   1. It comes with pip by default.

   2. During installation, be sure to check the box that says:
      “Add python.exe to PATH” — this is essential to run scripts from any location.

2. Microsoft Visual C++ 2015 Redistributable

   1. Required for certain components to function properly.

   2. Tip: Run all the following commands from PowerShell as Administrator to avoid permission issues.

Download and Install YARA

1. Download the latest YARA release using PowerShell: Invoke-WebRequest -Uri https://github.com/VirusTotal/yara/releases/download/v4.5.2/yara-v4.5.2-2326-win64.zip -OutFile yara.zip

2. Extract the contents of the ZIP archive: Expand-Archive yara.zip

3. Create the directory where YARA will reside: mkdir 'C:\Program Files (x86)\ossec-agent\active-response\bin\yara\'.
4. Copy the YARA binary into the appropriate folder: cp .\yara-v4.5.2-2326-win64\yara64.exe 'C:\Program Files (x86)\ossec-agent\active-response\bin\yara\'

Once these steps are completed, the YARA engine will be in place and ready to be triggered by Wazuh’s Active Response module whenever suspicious file activity is detected.

Download YARA Rules Using the Valhalla API

Now it’s time to download the actual YARA rules. To do this, you’ll use a small Python utility.

1. Use pip to install the Valhalla API client: pip install valhallaAPI

2. Create a file named download_yara_rules.py and paste the following code into it: 
   
   from valhallaAPI.valhalla import ValhallaAPI
   
   v = ValhallaAPI(api_key="1111111111111111111111111111111111111111111111111111111111111111")
   response = v.get_rules_text()
   
   with open('yara_rules.yar', 'w') as fh:
       fh.write(response)
   
   
3. Run the script to download the latest YARA rules from Valhalla: python download_yara_rules.py

Copy YARA Rules to the Correct Location

Once the rules file is ready, move it to the correct location so Wazuh can access and use it.

1. Create the rules directory: mkdir 'C:\Program Files (x86)\ossec-agent\active-response\bin\yara\rules\'

2. Copy the rules file into the directory: cp yara_rules.yar 'C:\Program Files (x86)\ossec-agent\active-response\bin\yara\rules\'