Comparative Malware Behavior Analysis in a Docker-Based Wazuh Security Operations Center Testbed

Abstract

Modern security monitoring requires laboratory environments that are not only effective for threat observation but also practical to deploy and reproduce. This research presents a Docker-based Wazuh Security Operations Center (SOC) testbed for comparative malware behavior analysis in an isolated Windows 10 environment instrumented with Wazuh Agent and Sysmon. The testbed integrates the Wazuh Manager, Indexer, and Dashboard as containerized services to collect, correlate, and visualize endpoint telemetry. Three malware scenarios were examined, namely a ransomware-like encryptor, a cryptominer, and a reverse-shell payload, to compare how each threat category generated distinct behavioral traces under the same monitoring setup. The analysis focused on alert characteristics, relevant event sources, observed indicators of compromise, and MITRE ATT&CK-aligned behavior patterns. The results show that the proposed testbed was able to differentiate the three malware categories through distinct telemetry profiles, such as mass file modification activity for the encryptor, resource abuse and persistence-related traces for the cryptominer, and suspicious process execution with remote access indicators for the reverse-shell scenario. In the evaluated laboratory setting, the deployed SOC stack also showed a low observed resource footprint, which supports its practical use as a lightweight and reproducible platform for malware behavior observation and security monitoring experiments.