Evaluation and Enhancement of Wazuh Detection Coverage Against MITRE ATT&CK Techniques in a Linux Environment

This research evaluates the detection coverage of Wazuh SIEM against selected MITRE ATT&CK techniques in an Ubuntu 24.04 Linux environment. A controlled laboratory setup was created using VirtualBox and Ubuntu, where multiple ATT&CK techniques including privilege escalation, account manipulation, persistence, discovery, and defense evasion activities were manually executed. Detection results were analyzed using Wazuh alerts and logs. The study identified detection gaps in discovery-related techniques and demonstrated how custom Wazuh detection rules improved overall coverage from 72.7% to 100% for the selected test cases. The paper provides a reproducible methodology for evaluating and enhancing open-source SIEM deployments.