mirror of
https://github.com/CheckPointSW/InviZzzible
synced 2026-06-08 10:35:43 +00:00
chkp-ramanl
114 lines
4.2 KiB
Plaintext
114 lines
4.2 KiB
Plaintext
{
|
|
"Parallels Driver Files": {
|
|
"description": "Check if specific files are present in the `C:\\WINDOWS\\system32' folder or subfolders.",
|
|
"countermeasures": "Exclude files from enumeration using filter driver. Hook GetFileAttributes function to return appropriate result.",
|
|
"type": "file",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": [
|
|
"C:\\Windows\\system32\\prleth.sys",
|
|
"C:\\Windows\\system32\\prlfs.sys",
|
|
"C:\\Windows\\system32\\prlmouse.sys",
|
|
"C:\\Windows\\system32\\prlvideo.sys",
|
|
"C:\\Windows\\system32\\prltime.sys",
|
|
"C:\\Windows\\system32\\prl_pv32.sys",
|
|
"C:\\Windows\\system32\\prl_paravirt_32.sys"
|
|
]
|
|
},
|
|
"score": 10
|
|
},
|
|
"EnumPCI Registry SubKey": {
|
|
"description": "Check if `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\PCI' Registry Key has SubKey that contains `VEN_1AB8'.",
|
|
"countermeasures": "Patch the name of `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\PCI' Registry Key SubKey that contains `VEN_1AB8'.",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "enum_keys",
|
|
"hkey": "HKLM",
|
|
"key": "SYSTEM\\CurrentControlSet\\Enum\\PCI",
|
|
"subkey": "VEN_1AB8"
|
|
},
|
|
"score": 7
|
|
},
|
|
"Parallels SystemBiosVersion Registry Key": {
|
|
"description": "Check if `HKLM\\HARDWARE\\Description\\System' Registry Key has value `SystemBiosVersion'=`PARALLELS'.",
|
|
"countermeasures": "Patch the content of `HKLM\\HARDWARE\\Description\\System' Registry Key value `SystemBiosVersion'.",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "contains",
|
|
"hkey": "HKLM",
|
|
"key": "HARDWARE\\Description\\System",
|
|
"value_name": "SystemBiosVersion",
|
|
"value_data": "PARALLELS"
|
|
},
|
|
"score": 10
|
|
},
|
|
"Parallels VideoBiosVersion Registry Key": {
|
|
"description": "Check if `HKLM\\HARDWARE\\Description\\System' Registry Key has value `VideoBiosVersion'=`PARALLELS'.",
|
|
"countermeasures": "Patch the content of `HKLM\\HARDWARE\\Description\\System' Registry Key value `VideoBiosVersion'.",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "contains",
|
|
"hkey": "HKLM",
|
|
"key": "HARDWARE\\Description\\System",
|
|
"value_name": "VideoBiosVersion",
|
|
"value_data": "PARALLELS"
|
|
},
|
|
"score": 10
|
|
},
|
|
"FirmwareRaw Table": {
|
|
"description": "Check if raw firmware table content contains the following identifier: `Parallels(R)'.",
|
|
"countermeasures": "On systems older than Vista change memory content of Csrss.exe. On Vista and higher systems hook NtQuerySystemInformation for SystemFirmwareTableInformation class and parse SFTI structure.",
|
|
"type": "firmware",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "firm",
|
|
"name": "Parallels(R)"
|
|
},
|
|
"score": 7
|
|
},
|
|
"FirmwareSMBIOS Table": {
|
|
"description": "Check if SMBIOS firmware table content contains the following identifier: `Parallels Software International'.",
|
|
"countermeasures": "On systems older than Vista change memory content of Csrss.exe. On Vista and higher systems hook NtQuerySystemInformation for SystemFirmwareTableInformation class and parse SFTI structure.",
|
|
"type": "firmware",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "rsmb",
|
|
"name": "Parallels Software International"
|
|
},
|
|
"score": 7
|
|
},
|
|
"Parallels Processes": {
|
|
"description": "Check if one of the following processes is running: `prl_cc.exe', `prl_tools.exe'",
|
|
"countermeasures": "Exclude `prl_cc.exe', `prl_tools.exe' processes from enumeration or terminate them.",
|
|
"type": "process",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": ["prl_cc.exe", "prl_tools.exe"]
|
|
},
|
|
"score": 10
|
|
},
|
|
"Directory Device Object": {
|
|
"description": "Check if specific directory object `\\Device' contains one of the following objects: `prl_pv', `prl_tg', `prl_time'.",
|
|
"countermeasures": "Stop specific services.",
|
|
"type": "object",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"directory" : "\\Device",
|
|
"name": ["prl_pv", "prl_tg", "prl_time"]
|
|
},
|
|
"score": 8
|
|
},
|
|
"Parallels CPU HypervisorID": {
|
|
"description": "Check if processor HypervisorID does not equal to any of these names: `prl hyperv ' or ` lrpepyh vr'.",
|
|
"countermeasures": "cpuid instruction mask.",
|
|
"type": "cpuid_h",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"vendor": ["prl hyperv ", " lrpepyh vr"]
|
|
},
|
|
"score": 10
|
|
}
|
|
} |