mirror of
https://github.com/CheckPointSW/InviZzzible
synced 2026-06-08 10:35:43 +00:00
chkp-ramanl
109 lines
3.8 KiB
Plaintext
109 lines
3.8 KiB
Plaintext
{
|
|
"VirtualPC Driver Files": {
|
|
"description": "Check if specific files are present in the `C:\\WINDOWS\\system32' folder or subfolders. Check if specific directories are present.",
|
|
"countermeasures": "Exclude files from enumeration using filter driver. Hook GetFileAttributes function to return appropriate result.",
|
|
"type": "file",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": [
|
|
"C:\\WINDOWS\\system32\\drivers\\vmsrvc.sys",
|
|
"C:\\WINDOWS\\system32\\drivers\\vpc-s3.sys"
|
|
]
|
|
},
|
|
"score": 10
|
|
},
|
|
"VirtualPC Services Registry Keys": {
|
|
"description": "Check if `HKLM\\SYSTEM\\ControlSet001\\Services\\vpc*' and `HKLM\\SYSTEM\\ControlSet001\\Services\\msvmmouf' Registry Keys are present.",
|
|
"countermeasures": "Remove `HKLM\\SYSTEM\\ControlSet001\\Services\\vpc*' and `HKLM\\SYSTEM\\ControlSet001\\Services\\msvmmouf' Registry Keys.",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "exists",
|
|
"hkey": "HKLM",
|
|
"key": [
|
|
"SYSTEM\\ControlSet001\\Services\\vpcbus",
|
|
"SYSTEM\\ControlSet001\\Services\\vpc-s3",
|
|
"SYSTEM\\ControlSet001\\Services\\vpcuhub",
|
|
"SYSTEM\\ControlSet001\\Services\\msvmmouf"
|
|
]
|
|
},
|
|
"score": 7
|
|
},
|
|
"VirtualPC EnumPCI Registry SubKey": {
|
|
"description": "Check if `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\PCI' Registry Key has SubKey that contains `VEN_5333'.",
|
|
"countermeasures": "Patch the name of `HKLM\\HARDWARE\\Description\\System' Registry Key SubKey that contains `VEN_5333'.",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "enum_keys",
|
|
"hkey": "HKLM",
|
|
"key": "SYSTEM\\CurrentControlSet\\Enum\\PCI",
|
|
"subkey": "VEN_5333"
|
|
},
|
|
"score": 7
|
|
},
|
|
"FirmwareRaw Table": {
|
|
"description": "Check if raw firmware table content contains the following identifier: `S3 Corp.'.",
|
|
"countermeasures": "On systems older than Vista change memory content of Csrss.exe. On Vista and higher systems hook NtQuerySystemInformation for SystemFirmwareTableInformation class and parse SFTI structure.",
|
|
"type": "firmware",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "firm",
|
|
"name": "S3 Corp."
|
|
},
|
|
"score": 7
|
|
},
|
|
"FirmwareSMBIOS Table": {
|
|
"description": "Check if SMBIOS firmware table content contains the following identifier: `VS2005R2'.",
|
|
"countermeasures": "On systems older than Vista change memory content of Csrss.exe. On Vista and higher systems hook NtQuerySystemInformation for SystemFirmwareTableInformation class and parse SFTI structure.",
|
|
"type": "firmware",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "rsmb",
|
|
"name": "VS2005R2"
|
|
},
|
|
"score": 7
|
|
},
|
|
"VirtualPC Disk Name": {
|
|
"description": "Check if disk name does not contain the following identifier: `VIRTUAL HD'.",
|
|
"countermeasures": "Multiple.",
|
|
"type": "disk",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": "VIRTUAL HD"
|
|
},
|
|
"score": 8
|
|
},
|
|
"VirtualPC Processes": {
|
|
"description": "Check if one of the following processes is running: `vmsrvc.exe', `vmusrvc.exe'",
|
|
"countermeasures": "Exclude `vmsrvc.exe', `vmusrvc.exe' processes from enumeration or terminate them.",
|
|
"type": "process",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": ["vmsrvc.exe", "vmusrvc.exe"]
|
|
},
|
|
"score": 10
|
|
},
|
|
"Directory Device Object": {
|
|
"description": "Check if specific directory object `\\Device' contains the following object: `VirtualMachineServices'.",
|
|
"countermeasures": "Stop specific service.",
|
|
"type": "object",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"directory" : "\\Device",
|
|
"name": "VirtualMachineServices"
|
|
},
|
|
"score": 10
|
|
},
|
|
"Directory Driver Object": {
|
|
"description": "Check if specific directory object `\\Driver' contains the following object: `1-driver-vmsrvc'.",
|
|
"countermeasures": "Stop specific service.",
|
|
"type": "object",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"directory" : "\\Driver",
|
|
"name": "1-driver-vmsrvc"
|
|
},
|
|
"score": 10
|
|
}
|
|
} |