Issue

The following alert was shared on Monday 28.08.2026.

{
  "_index": "wazuh-alerts-4.x-2026.07.27",
  "_id": "vyMIop8Bt8-sklwxHBVs",
  "_score": null,
  "_source": {
    "input": {
      "type": "log"
    },
    "agent": {
      "ip": "10.11.6.14",
      "name": "AlejandroM",
      "id": "032"
    },
    "manager": {
      "name": "hetzner-backend3"
    },
    "data": {
      "file": "/usr/bin/md5sum",
      "title": "Trojaned version of file detected."
    },
    "rule": {
      "firedtimes": 20,
      "mail": false,
      "level": 7,
      "pci_dss": [
        "10.6.1"
      ],
      "description": "Host-based anomaly detection event (rootcheck).",
      "groups": [
        "ossec",
        "rootcheck"
      ],
      "id": "510",
      "gdpr": [
        "IV_35.7.d"
      ]
    },
    "location": "rootcheck",
    "decoder": {
      "name": "rootcheck"
    },
    "id": "1785129866.4509548",
    "full_log": "Trojaned version of file '/usr/bin/md5sum' detected. Signature used: 'bash|^/bin/sh|file\\.h|proc\\.h|/dev/[^cfhlnrstuw]|^/bin/.*sh' (Generic).",
    "timestamp": "2026-07-27T05:24:26.907+0000"
  },
  "fields": {
    "timestamp": [
      "2026-07-27T05:24:26.907Z"
    ]
  },
  "sort": [
    1785129866907
  ]
}

• After sharing all the logs with claude, this issue was recorded as a false positive due to the following findings: Verdict: false positive. Not a compromise. Closed 2026-07-27.

• Cause. The host (Ubuntu 26.04 LTS) uses Rust uutils coreutils 0.8.0. All 114 applets under /usr/lib/cargo/bin/coreutils/ are hardlinks to one 11 MB inode (2884235). Rootcheck opens the same file 20 times under 20 names and returns the same verdict each time. That single binary holds the string constants of every utility (bash, /bin/sh, /dev/…, file.h), so it trips generic signatures written for per-utility GNU binaries — including for echo, uname, date, which as GNU binaries would be too small to match.

• Integrity is intact. All 21 checked paths OK, no CHANGED. All four coreutils packages verify clean (coreutils-from-uutils, rust-coreutils, gnu-coreutils, coreutils). All 20 flagged paths share one sha256 (48893b0f…46e8c0).

• Alert shape is fixed and benign: exactly 10 utilities (ls, env, echo, chown, chmod, chgrp, cat, uname, date, md5sum) × /bin + /usr/bin = 20 per cycle. No non-coreutils binary from Wazuh's trojan list ever fired.

• Two false reassurances found in the prior verification — both would have let a real compromise through: dpkg -S /bin/<util>returns no owner on merged-/usr, so the check ran dpkg -V "" and printed OK for all ten /bin/* paths without verifying anything. dpkg -V coreutils is an Architecture: all meta package with no binaries — it verifies clean unconditionally.

• Non-indicators, for the record: the agent IP roamed 192.168.1.7 → 10.11.6.14 → 10.11.1.6 (laptop, also on Tailscale); rule.firedtimes resets to 1 each cycle; scan cadence tracks reboots, not the 12 h timer, so rising volume ≠ rising risk.

• One likely escalation trap: the ls signature literally contains duarawkz (a named rootkit marker) as a regex alternative, but the alert is still (Generic) and Wazuh doesn't report which alternative matched. Confirm with strings before escalating.

Recommendations

1. Suppress centrally, not per host. Create a workstations agent group on hetzner-backend3 with <rootcheck><check_trojans>no</check_trojans></rootcheck>. The trojan DB cannot produce a meaningful result against a multi-call binary, so this loses no detection value.

2. Do it before the fleet upgrades. utils is the default on 26.04 LTS — this becomes the fleet norm, not an edge case. Per-host ignore lists (Option B) would need 20 paths each and reopen every time Wazuh adds a coreutils name.

3. Fix the integrity check wherever else it's used. The merged-/usr and meta-package traps are not specific to this runbook; any dpkg -S/dpkg -V verification in tooling has the same blind spots.

4. Keep rule 510 active elsewhere. Only scope out multi-call-coreutils hosts. Escalate if: any CHANGED/UNKNOWN, a flagged file outside the fixed 20, a non-coreutils binary, or more than one distinct hash across the flagged paths.