admin/CheckPointSW-InviZzzible
1
0
Fork 0
mirror of https://github.com/CheckPointSW/InviZzzible synced 2026-06-08 10:35:43 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
CheckPointSW-InviZzzible/config/vbox.conf
T
chkp-ramanl 17f2a5a483 Fixed indents in configuration files
2021-05-04 12:39:36 +03:00

351 lines
13 KiB
Plaintext
Raw Permalink Blame History

{
"VBox Guest Additions Registry Key": {
"description": "Check if `HKLM\\SOFTWARE\\Oracle\\VirtualBox Guest Additions' Registry Key is present.",
"countermeasures": "Remove `HKLM\\SOFTWARE\\Oracle\\VirtualBox Guest Additions' Registry Key.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "exists",
"hkey": "HKLM",
"key": "SOFTWARE\\Oracle\\VirtualBox Guest Additions"
},
"score": 10
},
"SystemBiosDate Registry Key": {
"description": "Check if `HKLM\\HARDWARE\\DESCRIPTION\\System' Registry Key has value `SystemBiosDate'=`06/29/99'.",
"countermeasures": "Patch the content of `HKLM\\HARDWARE\\DESCRIPTION\\System' Registry Key value `SystemBiosDate'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\DESCRIPTION\\System",
"value_name": "SystemBiosDate",
"value_data": "06/23/99"
},
"score": 10
},
"Hardware Device Registry Keys": {
"description": "Check if `HKLM\\HARDWARE\\ACPI\\*\\VBOX__' Registry Keys are present.",
"countermeasures": "Remove `HKLM\\HARDWARE\\ACPI\\*\\VBOX__' Registry Keys.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "exists",
"hkey": "HKLM",
"key": ["HARDWARE\\ACPI\\DSDT\\VBOX__", "HARDWARE\\ACPI\\FADT\\VBOX__", "HARDWARE\\ACPI\\RSDT\\VBOX__"]
},
"score": 7
},
"VBox Services Registry Keys": {
"description": "Check if `HKLM\\SYSTEM\\ControlSet001\\Services\\VBox*' Registry Keys are present.",
"countermeasures": "Remove `HKLM\\SYSTEM\\ControlSet001\\Services\\VBox*' Registry Keys.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "exists",
"hkey": "HKLM",
"key": [
"SYSTEM\\ControlSet001\\Services\\VBoxMouse",
"SYSTEM\\ControlSet001\\Services\\VBoxService",
"SYSTEM\\ControlSet001\\Services\\VBoxSF",
"SYSTEM\\ControlSet001\\Services\\VBoxVideo",
"SYSTEM\\ControlSet001\\Services\\VBoxGuest"
]
},
"score": 7
},
"ScsiPort0 Registry Key": {
"description": "Check if `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key has value `Identifier'=`VBOX'.",
"countermeasures": "Patch the content of `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key value `Identifier'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0",
"value_name": "Identifier",
"value_data": "VBOX"
},
"score": 7
},
"ScsiPort1 Registry Key": {
"description": "Check if `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key has value `Identifier'=`VBOX'.",
"countermeasures": "Patch the content of `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key value `Identifier'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0",
"value_name": "Identifier",
"value_data": "VBOX"
},
"score": 7
},
"ScsiPort2 Registry Key": {
"description": "Check if `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key has value `Identifier'=`VBOX'.",
"countermeasures": "Patch the content of `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key value `Identifier'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0",
"value_name": "Identifier",
"value_data": "VBOX"
},
"score": 7
},
"SystemBiosVersion Registry Key": {
"description": "Check if `HKLM\\HARDWARE\\Description\\System' Registry Key has value `SystemBiosVersion'=`VBOX'.",
"countermeasures": "Patch the content of `HKLM\\HARDWARE\\Description\\System' Registry Key value `SystemBiosVersion'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\Description\\System",
"value_name": "SystemBiosVersion",
"value_data": "VBOX"
},
"score": 9
},
"VideoBiosVersion Registry Key": {
"description": "Check if `HKLM\\HARDWARE\\Description\\System' Registry Key has value `VideoBiosVersion'=`VIRTUALBOX'.",
"countermeasures": "Patch the content of `HKLM\\HARDWARE\\Description\\System' Registry Key value `VideoBiosVersion'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\Description\\System",
"value_name": "VideoBiosVersion",
"value_data": "VIRTUALBOX"
},
"score": 9
},
"VBox EnumPCI Registry SubKey": {
"description": "Check if `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\PCI' Registry Key has SubKey that contains `VEN_80EE'.",
"countermeasures": "Patch the name of `HKLM\\HARDWARE\\Description\\System' Registry Key SubKey that contains `VEN_80EE'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "enum_keys",
"hkey": "HKLM",
"key": "SYSTEM\\CurrentControlSet\\Enum\\PCI",
"subkey": "VEN_80EE"
},
"score": 7
},
"ControlSet001 Registry Key": {
"description": "Check if `HKLM\\SYSTEM\\ControlSet001\\Enum' Registry Key has values `DeviceDesc'=`VBOX' and/or `FriendlyName'=`VBOX' recursively.",
"countermeasures": "Patch the content of `HKLM\\SYSTEM\\ControlSet001\\Enum' Registry Key values `DeviceDesc' and/or `FriendlyName' recursively.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKLM",
"key": "SYSTEM\\ControlSet001\\Enum",
"value_name": ["DeviceDesc", "FriendlyName"],
"value_data": "VBOX"
},
"score": 7
},
"ControlSet002 Registry Key": {
"description": "Check if `HKLM\\SYSTEM\\ControlSet002\\Enum' Registry Key has values `DeviceDesc'=`VBOX' and/or `FriendlyName'=`VBOX' recursively.",
"countermeasures": "Patch the content of `HKLM\\SYSTEM\\ControlSet002\\Enum' Registry Key values `DeviceDesc' and/or `FriendlyName' recursively.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKLM",
"key": "SYSTEM\\ControlSet002\\Enum",
"value_name": ["DeviceDesc", "FriendlyName"],
"value_data": "VBOX"
},
"score": 7
},
"ControlSet003 Registry Key": {
"description": "Check if `HKLM\\SYSTEM\\ControlSet003\\Enum' Registry Key has values `DeviceDesc'=`VBOX' and/or `FriendlyName'=`VBOX' recursively.",
"countermeasures": "Patch the content of `HKLM\\SYSTEM\\ControlSet003\\Enum' Registry Key values `DeviceDesc' and/or `FriendlyName' recursively.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKLM",
"key": "SYSTEM\\ControlSet003\\Enum",
"value_name": ["DeviceDesc", "FriendlyName"],
"value_data": "VBOX"
},
"score": 7
},
"VBox Processes": {
"description": "Check if one of the following processes is running: `vboxservice.exe', `vboxtray.exe'",
"countermeasures": "Exclude `vboxservice.exe', `vboxtray.exe' processes from enumeration or terminate them.",
"type": "process",
"enabled": "yes",
"arguments": {
"name": ["vboxservice.exe", "vboxtray.exe"]
},
"score": 10
},
"VBox Devices": {
"description": "Check if one of the following devices is present: `\\\\.\\VBoxMiniRdr', `\\\\.\\VBoxMiniRdDN', `\\\\.\\VBoxMiniRdrDN', `\\\\.\\VBoxGuest', `\\\\.\\VBoxTrayIPC', `\\\\.\\VBoxMouse', `\\\\.\\VBoxVideo', `\\\\.\\pipe\\VBoxMiniRdDN', `\\\\.\\pipe\\VBoxTrayIPC'.",
"countermeasures": "Disable access to `\\\\.\\VBoxMiniRdr', `\\\\.\\VBoxMiniRdDN', `\\\\.\\VBoxMiniRdrDN', `\\\\.\\VBoxGuest', `\\\\.\\VBoxTrayIPC', `\\\\.\\VBoxMouse', `\\\\.\\VBoxVideo', `\\\\.\\pipe\\VBoxMiniRdDN', `\\\\.\\pipe\\VBoxTrayIPC' devices for the not-trusted porcesses or remove applications that use these devices.",
"type": "device",
"enabled": "yes",
"arguments": {
"name": [
"\\\\.\\VBoxMiniRdr",
"\\\\.\\VBoxMiniRdDN",
"\\\\.\\VBoxMiniRdrDN",
"\\\\.\\VBoxGuest",
"\\\\.\\VBoxTrayIPC",
"\\\\.\\VBoxMouse",
"\\\\.\\VBoxVideo",
"\\\\.\\pipe\\VBoxMiniRdDN",
"\\\\.\\pipe\\VBoxTrayIPC"
]
},
"score": 10
},
"VBox Driver Files": {
"description": "Check if specific files are present in the `C:\\WINDOWS\\system32' folder or subfolders. Check if specific directories are present.",
"countermeasures": "Exclude files from enumeration using filter driver.",
"type": "file",
"enabled": "yes",
"arguments": {
"name": [
"C:\\WINDOWS\\system32\\drivers\\VBoxMouse.sys",
"C:\\WINDOWS\\system32\\drivers\\VBoxGuest.sys",
"C:\\WINDOWS\\system32\\drivers\\VBoxSF.sys",
"C:\\WINDOWS\\system32\\drivers\\VBoxVideo.sys",
"C:\\WINDOWS\\system32\\vboxdisp.dll",
"C:\\WINDOWS\\system32\\vboxhook.dll",
"C:\\WINDOWS\\system32\\vboxmrxnp.dll",
"C:\\WINDOWS\\system32\\vboxogl.dll",
"C:\\WINDOWS\\system32\\vboxoglarrayspu.dll",
"C:\\WINDOWS\\system32\\vboxoglcrutil.dll",
"C:\\WINDOWS\\system32\\vboxoglerrorspu.dll",
"C:\\WINDOWS\\system32\\vboxoglfeedbackspu.dll",
"C:\\WINDOWS\\system32\\vboxoglpackspu.dll",
"C:\\WINDOWS\\system32\\vboxoglpassthroughspu.dll",
"C:\\WINDOWS\\system32\\vboxservice.exe",
"C:\\WINDOWS\\system32\\vboxtray.exe",
"C:\\WINDOWS\\system32\\VBoxControl.exe",
"C:\\program files\\oracle\\virtualbox guest additions\\"
]
},
"score": 10
},
"FirmwareRaw Table": {
"description": "Check if raw firmware table content contains one of the following identifiers: `VirtualBox', `Oracle', `innotek'.",
"countermeasures": "On systems older than Vista change memory content of Csrss.exe. On Vista and higher systems hook NtQuerySystemInformation for SystemFirmwareTableInformation class and parse SFTI structure.",
"type": "firmware",
"enabled": "yes",
"arguments": {
"check": "firm",
"name": ["VirtualBox", "Oracle", "innotek"]
},
"score": 7
},
"FirmwareSMBIOS Table": {
"description": "Check if SMBIOS firmware table content contains one of the following identifiers: `VirtualBox', `Oracle', `innotek'.",
"countermeasures": "On systems older than Vista change memory content of Csrss.exe. On Vista and higher systems hook NtQuerySystemInformation for SystemFirmwareTableInformation class and parse SFTI structure.",
"type": "firmware",
"enabled": "yes",
"arguments": {
"check": "rsmb",
"name": ["VirtualBox", "Oracle", "innotek"]
},
"score": 7
},
"Directory Device Object": {
"description": "Check if specific directory object `\\Device' contains one of the following objects: `VBoxGuest', `VBoxMiniRdr'.",
"countermeasures": "Stop specific services.",
"type": "object",
"enabled": "yes",
"arguments": {
"directory" : "\\Device",
"name": ["VBoxGuest", "VBoxMiniRdr"]
},
"score": 8
},
"Directory Driver Object": {
"description": "Check if specific directory object `\\Driver' contains one of the following objects: `VBoxVideo', `VBoxMouse'.",
"countermeasures": "Stop specific services.",
"type": "object",
"enabled": "yes",
"arguments": {
"directory" : "\\Driver",
"name": ["VBoxVideo", "VBoxMouse"]
},
"score": 8
},
"Window Class Name": {
"description": "Check if window with the `VBoxTrayToolWndClass' class name is present.",
"countermeasures": "Exclude such window with the `VBoxTrayToolWndClass' class name or modify it.",
"type": "window",
"enabled": "yes",
"arguments": {
"check": "class",
"name": "VBoxTrayToolWndClass"
},
"score": 10
},
"Window Name": {
"description": "Check if window with the `VBoxTrayToolWnd' name is present.",
"countermeasures": "Exclude such window with the `VBoxTrayToolWnd' name or modify it.",
"type": "window",
"enabled": "yes",
"arguments": {
"check": "window",
"name": "VBoxTrayToolWnd"
},
"score": 10
},
"VBox Shared Folders": {
"description": "Check if shared folder with `VirtualBox Shared Folders' is present.",
"countermeasures": "Patch/Hook WNetGetProviderName to return filtered information.",
"type": "shared",
"enabled": "yes",
"arguments": {
"name": "VirtualBox Shared Folders"
},
"score": 6
},
"VBox Disk Name": {
"description": "Check if disk name does not contain the following identifier: `VBOX'.",
"countermeasures": "Multiple.",
"type": "disk",
"enabled": "yes",
"arguments": {
"name": "VBOX"
},
"score": 8
},
"VBox Drive Model": {
"description": "Check if drive model does not contain the following identifier: `VBox'.",
"countermeasures": "Filter specific IOCTLs: DFP_RECEIVE_DRIVE_DATA (SMART_RCV_DRIVE_DATA), IOCTL_STORAGE_QUERY_PROPERTY.",
"type": "drive_model",
"enabled": "yes",
"arguments": {
"name": "VBox"
},
"score": 8
},
"Forbidden MACs": {
"description": "Check if MAC vendor is the following: `080027'.",
"countermeasures": "Change MAC address for the virtual machine.",
"type": "mac",
"enabled": "yes",
"arguments": {
"vendor": "080027"
},
"score": 6
}
}
Reference in New Issue View Git Blame Copy Permalink