mirror of
https://github.com/CheckPointSW/InviZzzible
synced 2026-06-08 10:35:43 +00:00
chkp-ramanl
40 lines
1.5 KiB
Plaintext
40 lines
1.5 KiB
Plaintext
{
|
|
"JoeBox Windows Product ID Registry Key": {
|
|
"description": "Check if `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion' has value `ProductID'=`55274-640-2673064-23950'.",
|
|
"countermeasures": "Patch the content of `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion' Registry Key value `ProductID'",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "contains",
|
|
"hkey": "HKLM",
|
|
"key": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
|
|
"value_name": "ProductID",
|
|
"value_data": "55274-640-2673064-23950"
|
|
},
|
|
"score": 7
|
|
},
|
|
"JoeBox Windows NT Product ID Registry Key": {
|
|
"description": "Check if `HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' has value `ProductID'=`55274-640-2673064-23950'.",
|
|
"countermeasures": "Patch the content of `HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' Registry Key value `ProductID'",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "contains",
|
|
"hkey": "HKLM",
|
|
"key": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
|
|
"value_name": "ProductID",
|
|
"value_data": "55274-640-2673064-23950"
|
|
},
|
|
"score": 7
|
|
},
|
|
"JoeBox Processes": {
|
|
"description": "Check if one of the following processes is running: `joeboxserver.exe', `joeboxcontrol.exe'",
|
|
"countermeasures": "Exclude `joeboxserver.exe', `joeboxcontrol.exe' processes from enumeration or terminate them.",
|
|
"type": "process",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": ["joeboxserver.exe", "joeboxcontrol.exe"]
|
|
},
|
|
"score": 10
|
|
}
|
|
} |