src/rootcheck/db/win_audit_rcl.txt

   1 # @(#) $Id$
   2 #
   3 # OSSEC Windows Audit - (C) 2007 Daniel B. Cid - dcid@ossec.net
   4 #
   5 # Released under the same license as OSSEC.
   6 # More details at the LICENSE file included with OSSEC or online
   7 # at: http://www.ossec.net/en/licensing.html
   8 #
   9 # [Application name] [any or all] [reference]
  10 # type:<entry name>;
  11 #
  12 # Type can be:
  13 #             - f (for file or directory)
  14 #             - r (registry entry)
  15 #             - p (process running)
  16 #
  17 # Additional values:
  18 # For the registry , use "->" to look for a specific entry and another
  19 # "->" to look for the value.
  20 # For files, use "->" to look for a specific value in the file.
  21 #
  22 # Values can be preceeded by: =: (for equal) - default
  23 #                             r: (for ossec regexes)
  24 #                             >: (for strcmp greater)
  25 #                             <: (for strcmp  lower)
  26 # Multiple patterns can be specified by using " && " between them.
  27 # (All of them must match for it to return true).
  28
  29
  30
  31
  32 # http://technet2.microsoft.com/windowsserver/en/library/486896ba-dfa1-4850-9875-13764f749bba1033.mspx?mfr=true
  33 [Disabled Registry tools set] [any] []
  34 r:HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System -> DisableRegistryTools -> 1;
  35 r:HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System -> DisableRegistryTools -> 1;
  36
  37
  38
  39 # http://support.microsoft.com/kb/825750
  40 [DCOM disabled] [any] []
  41 r:HKEY_LOCAL_MACHINE\Software\Microsoft\OLE -> EnableDCOM -> N;
  42
  43
  44
  45 # http://web.mit.edu/is/topics/windows/server/winmitedu/security.html
  46 [LM authentication allowed (weak passwords)] [any] []
  47 r:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA -> LMCompatibilityLevel -> 0;
  48 r:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA -> LMCompatibilityLevel -> 1;
  49
  50
  51
  52 # http://research.eeye.com/html/alerts/AL20060813.html
  53 # Disabled by some Malwares (sometimes by McAfee and Symantec
  54 # security center too).
  55 [Firewall/Anti Virus notification disabled] [any] []
  56 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center -> FirewallDisableNotify -> !0;
  57 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center -> antivirusoverride -> !0;
  58 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center -> firewalldisablenotify -> !0;
  59 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center -> firewalldisableoverride -> !0;
  60
  61
  62
  63 # Checking for the microsoft firewall.
  64 [Microsoft Firewall disabled] [all] []
  65 r:HKEY_LOCAL_MACHINE\software\policies\microsoft\windowsfirewall\domainprofile -> enablefirewall -> 0;
  66 r:HKEY_LOCAL_MACHINE\software\policies\microsoft\windowsfirewall\standardprofile -> enablefirewall -> 0;
  67
  68
  69
  70 #http://web.mit.edu/is/topics/windows/server/winmitedu/security.html
  71 [Null sessions allowed] [any] []
  72 r:HKLM\System\CurrentControlSet\Control\Lsa -> RestrictAnonymous -> 0;
  73
  74
  75
  76 [Error reporting disabled] [any] [http://windowsir.blogspot.com/2007/04/something-new-to-look-for.html]
  77 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting -> DoReport -> 0;
  78 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting -> IncludeKernelFaults -> 0;
  79 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting -> IncludeMicrosoftApps -> 0;
  80 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting -> IncludeWindowsApps -> 0;
  81 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting -> IncludeShutdownErrs -> 0;
  82 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting -> ShowUI -> 0;
  83
  84
  85
  86 # http://support.microsoft.com/default.aspx?scid=315231
  87 [Automatic Logon enabled] [any] [http://support.microsoft.com/default.aspx?scid=315231]
  88 r:HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon -> DefaultPassword;
  89 r:HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon -> AutoAdminLogon -> 1;
  90
  91
  92 [Winpcap packet filter driver found] [any] []
  93 f:%WINDIR%\System32\drivers\npf.sys;
  94
  95
  96 # EOF #