Kalos Cybersecurity LLC
Student lab

Lab 0A — EICAR, YARA, Microsoft Defender, and Wazuh Validation — v20

Chapter and Lab Alignment

Alignment Placement
Primary lab alignment Lab 0 — Operational Health Validation
Reused by Lab 5 — Sysmon Investigation
Primary chapter alignment Chapter 3 — Building the Wazuh Security Operations Center Laboratory
Supporting chapter alignment Chapter 5 — Detection Engineering with Wazuh and Suricata
Supporting references Appendix C — Operational Readiness Validation; Appendix D — Operational Readiness Troubleshooting and Recovery

Purpose

Use the industry-standard EICAR anti-malware test file to validate four controls without using real malware:

  1. A local YARA rule matches the EICAR identifier.
  2. Microsoft Defender detects or quarantines the test file.
  3. Defender records detection telemetry.
  4. The Wazuh agent forwards the relevant Windows event and the event becomes searchable.

EICAR validates a defined telemetry and detection path; it does not prove that every malware-prevention, containment, eradication, or recovery capability is effective. Record each observation separately and base the final conclusion only on the controls actually tested (Souppaya & Scarfone, 2013).

Controlled-lab requirement: Perform this exercise only on the authorized WIN11 lab endpoint. EICAR is not malware, but security products intentionally treat it as malware. Do not use real malware, disable Defender globally, or run this exercise on production equipment.

Files

  • Lab_00A_Create_Controlled_EICAR_Test_File_v20.ps1
  • Lab_00A_Review_Defender_EICAR_Events_v20.ps1
  • Lab_00A_EICAR_Test_Rule_v20.yar

Copy the PowerShell helpers into C:\WazuhLabs\Scripts\ and copy Lab_00A_EICAR_Test_Rule_v20.yar into C:\WazuhLabs\YARA\ without changing its filename.

Phase 1 — Prepare the Controlled Directory

From Administrator PowerShell:

WIN11 · PowerShell (Administrator)

$TestDirectory = 'C:\WazuhLabs\YARA\EICAR-Test'
New-Item -ItemType Directory -Path $TestDirectory -Force
Add-MpPreference -ExclusionPath $TestDirectory

The exclusion is intentionally limited to one temporary lab directory. Do not exclude a drive, user profile, Downloads directory, or the complete C:\WazuhLabs tree.

Confirm the exact path appears in (Get-MpPreference).ExclusionPath before continuing.

Phase 2 — Create and Validate the EICAR Artifact with YARA

WIN11 · PowerShell (Administrator)

& 'C:\WazuhLabs\Scripts\Lab_00A_Create_Controlled_EICAR_Test_File_v20.ps1' -ConfirmControlledLab
yara -s 'C:\WazuhLabs\YARA\Lab_00A_EICAR_Test_Rule_v20.yar' 'C:\WazuhLabs\YARA\EICAR-Test\eicar.com'

Expected YARA result: EICAR_Test_File matches eicar.com and identifies the matching string.

Record the command, timestamp, rule name, target path, and result. The script writes only the standard printable EICAR test string; it does not download or execute software.

Phase 3 — Remove the Exclusion and Allow Defender to Detect

Remove the temporary exclusion immediately after the YARA result is captured:

WIN11 · PowerShell (Administrator)

$TestDirectory = 'C:\WazuhLabs\YARA\EICAR-Test'
Remove-MpPreference -ExclusionPath $TestDirectory
Start-MpScan -ScanType CustomScan -ScanPath $TestDirectory

Defender may quarantine the artifact before the explicit scan begins. Either outcome is acceptable if the detection is recorded. Do not recreate the artifact repeatedly.

Phase 4 — Validate Defender Telemetry

WIN11 · PowerShell (Administrator)

& 'C:\WazuhLabs\Scripts\Lab_00A_Review_Defender_EICAR_Events_v20.ps1'

The helper searches the Microsoft Defender Operational log for recent EICAR-related events and excludes Event ID 5007 because that event represents a configuration change, not proof of detection.

Capture the event timestamp, event ID, detection name, affected path, and action or status shown by Defender.

Phase 5 — Validate Wazuh Receipt

In the Wazuh Dashboard, search the WIN11 agent over a time range that includes the Defender event. Begin with the verified agent name and provider/channel fields available in the installed environment, then narrow by EICAR and the observed Defender event ID.

Do not assume a field name from a screenshot or another Wazuh release. Expand the indexed document and record the actual field/value pair used in the successful query.

Evidence must show:

  • The local Defender event.
  • The corresponding Wazuh event on WIN11.
  • Matching or reasonably correlated timestamps.
  • The query and deployed field names.

Cleanup and Validation

WIN11 · PowerShell (Administrator)

$TestDirectory = 'C:\WazuhLabs\YARA\EICAR-Test'
Remove-MpPreference -ExclusionPath $TestDirectory -ErrorAction SilentlyContinue
Remove-Item -LiteralPath $TestDirectory -Recurse -Force -ErrorAction SilentlyContinue
(Get-MpPreference).ExclusionPath

Confirm that the temporary exclusion is absent. If Defender quarantined the file, leave the quarantine record intact for evidence and follow the lab reset procedure rather than attempting to restore the test artifact.

Technical References