mirror of
https://github.com/CheckPointSW/InviZzzible
synced 2026-06-08 10:35:43 +00:00
chkp-ramanl
55 lines
1.7 KiB
Plaintext
55 lines
1.7 KiB
Plaintext
{
|
|
"Hyper-V HKLM Registry Keys": {
|
|
"description": "Check if `HKLM\\SOFTWARE\\Microsoft\\Hyper-V' or `HKLM\\SOFTWARE\\Microsoft\\VirtualMachine' Registry Keys are present.",
|
|
"countermeasures": "Remove `HKLM\\SOFTWARE\\Microsoft\\Hyper-V' and `HKLM\\SOFTWARE\\Microsoft\\VirtualMachine' Registry Keys.",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "exists",
|
|
"hkey": "HKLM",
|
|
"key": [
|
|
"SOFTWARE\\Microsoft\\Hyper-V",
|
|
"SOFTWARE\\Microsoft\\VirtualMachine"
|
|
]
|
|
},
|
|
"score": 10
|
|
},
|
|
"Hyper-V Services Registry Keys": {
|
|
"description": "Check if `HKLM\\SYSTEM\\ControlSet001\\Services\\vmic*' Registry Keys are present.",
|
|
"countermeasures": "Remove `HKLM\\SYSTEM\\ControlSet001\\Services\\vmic*' Registry Keys.",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "exists",
|
|
"hkey": "HKLM",
|
|
"key": [
|
|
"SYSTEM\\ControlSet001\\Services\\vmicheartbeat",
|
|
"SYSTEM\\ControlSet001\\Services\\vmicvss",
|
|
"SYSTEM\\ControlSet001\\Services\\vmicshutdown",
|
|
"SYSTEM\\ControlSet001\\Services\\vmicexchange"
|
|
]
|
|
},
|
|
"score": 8
|
|
},
|
|
"Hyper-V Directory Device Object": {
|
|
"description": "Check if specific directory object `\\Device' contains the following object: `VmGenerationCounter'.",
|
|
"countermeasures": "Stop specific service.",
|
|
"type": "object",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"directory" : "\\Device",
|
|
"name": "VmGenerationCounter"
|
|
},
|
|
"score": 7
|
|
},
|
|
"Hyper-V CPU HypervisorID": {
|
|
"description": "Check if processor HypervisorID does not equal to: `Microsoft Hv'.",
|
|
"countermeasures": "cpuid instruction mask.",
|
|
"type": "cpuid_h",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"vendor": ["Microsoft Hv"]
|
|
},
|
|
"score": 10
|
|
}
|
|
} |