Detecting Malicious C2 Server Traffic via Google Calendar Phishing Attack Using Wazuh & Suricata

This guide details configuring Wazuh Manager to execute an active response that isolates a Windows host when a 'certutil' download event (rule 92075) is detected, and provides a workaround to block a suspicious IP using a Bash script after difficulties aligning a Suricata-triggered response; the isolation disables all network traffic on the affected endpoint until manually reversed.