{
	"VirtualPC Driver Files": {
		"description": "Check if specific files are present in the `C:\\WINDOWS\\system32' folder or subfolders. Check if specific directories are present.",
		"countermeasures": "Exclude files from enumeration using filter driver. Hook GetFileAttributes function to return appropriate result.",
		"type": "file",
		"enabled": "yes",
		"arguments": {
			"name": [
				"C:\\WINDOWS\\system32\\drivers\\vmsrvc.sys",
				"C:\\WINDOWS\\system32\\drivers\\vpc-s3.sys"
			]
		},
		"score": 10
	},
	"VirtualPC Services Registry Keys": {
		"description": "Check if `HKLM\\SYSTEM\\ControlSet001\\Services\\vpc*' and `HKLM\\SYSTEM\\ControlSet001\\Services\\msvmmouf' Registry Keys are present.",
		"countermeasures": "Remove `HKLM\\SYSTEM\\ControlSet001\\Services\\vpc*' and `HKLM\\SYSTEM\\ControlSet001\\Services\\msvmmouf' Registry Keys.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "exists",
			"hkey": "HKLM",
			"key": [
				"SYSTEM\\ControlSet001\\Services\\vpcbus",
				"SYSTEM\\ControlSet001\\Services\\vpc-s3",
				"SYSTEM\\ControlSet001\\Services\\vpcuhub",
				"SYSTEM\\ControlSet001\\Services\\msvmmouf"
			]
		},
		"score": 7
	},
	"VirtualPC EnumPCI Registry SubKey": {
		"description": "Check if `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\PCI' Registry Key has SubKey that contains `VEN_5333'.",
		"countermeasures": "Patch the name of `HKLM\\HARDWARE\\Description\\System' Registry Key SubKey that contains `VEN_5333'.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "enum_keys",
			"hkey": "HKLM",
			"key": "SYSTEM\\CurrentControlSet\\Enum\\PCI",
			"subkey": "VEN_5333"
		},
		"score": 7
	},
	"FirmwareRaw Table": {
		"description": "Check if raw firmware table content contains the following identifier: `S3 Corp.'.",
		"countermeasures": "On systems older than Vista change memory content of Csrss.exe. On Vista and higher systems hook NtQuerySystemInformation for SystemFirmwareTableInformation class and parse SFTI structure.",
		"type": "firmware",
		"enabled": "yes",
		"arguments": {
			"check": "firm",
			"name": "S3 Corp."
		},
		"score": 7
	},
	"FirmwareSMBIOS Table": {
		"description": "Check if SMBIOS firmware table content contains the following identifier: `VS2005R2'.",
		"countermeasures": "On systems older than Vista change memory content of Csrss.exe. On Vista and higher systems hook NtQuerySystemInformation for SystemFirmwareTableInformation class and parse SFTI structure.",
		"type": "firmware",
		"enabled": "yes",
		"arguments": {
			"check": "rsmb",
			"name": "VS2005R2"
		},
		"score": 7
	},
	"VirtualPC Disk Name": {
		"description": "Check if disk name does not contain the following identifier: `VIRTUAL HD'.",
		"countermeasures": "Multiple.",
		"type": "disk",
		"enabled": "yes",
		"arguments": {
			"name": "VIRTUAL HD"
		},
		"score": 8
	},
	"VirtualPC Processes": {
		"description": "Check if one of the following processes is running: `vmsrvc.exe', `vmusrvc.exe'",
		"countermeasures": "Exclude `vmsrvc.exe', `vmusrvc.exe' processes from enumeration or terminate them.",
		"type": "process",
		"enabled": "yes",
		"arguments": {
			"name": ["vmsrvc.exe", "vmusrvc.exe"]
		},
		"score": 10
	},
	"Directory Device Object": {
		"description": "Check if specific directory object `\\Device' contains the following object: `VirtualMachineServices'.",
		"countermeasures": "Stop specific service.",
		"type": "object",
		"enabled": "yes",
		"arguments": {
			"directory" : "\\Device",
			"name": "VirtualMachineServices"
		},
		"score": 10
	},
	"Directory Driver Object": {
		"description": "Check if specific directory object `\\Driver' contains the following object: `1-driver-vmsrvc'.",
		"countermeasures": "Stop specific service.",
		"type": "object",
		"enabled": "yes",
		"arguments": {
			"directory" : "\\Driver",
			"name": "1-driver-vmsrvc"
		},
		"score": 10
	}
}