admin/CheckPointSW-InviZzzible
1
0
Fork 0
mirror of https://github.com/CheckPointSW/InviZzzible synced 2026-06-08 10:35:43 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
CheckPointSW-InviZzzible/config/vmware.conf
T
chkp-ramanl 17f2a5a483 Fixed indents in configuration files
2021-05-04 12:39:36 +03:00

482 lines
18 KiB
Plaintext
Raw Permalink Blame History

{
"VMWare Tools Registry Machine Key": {
"description": "Check if `HKLM\\SOFTWARE\\VMware, Inc.\\VMware Tools' Registry Key is present.",
"countermeasures": "Remove `HKLM\\SOFTWARE\\VMware, Inc.\\VMware Tools' Registry Key.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "exists",
"hkey": "HKLM",
"key": "SOFTWARE\\VMware, Inc.\\VMware Tools"
},
"score": 10
},
"VMWare Tools Registry User Key": {
"description": "Check if `HKCU\\SOFTWARE\\VMware, Inc.\\VMware Tools' Registry Key is present.",
"countermeasures": "Remove `HKCU\\SOFTWARE\\VMware, Inc.\\VMware Tools' Registry Key.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "exists",
"hkey": "HKCU",
"key": "SOFTWARE\\VMware, Inc.\\VMware Tools"
},
"score": 10
},
"VMWare Service Registry Key": {
"description": "Check if one of the following SubKeys are present under `HKLM\\SYSTEM\\ControlSet001\\Services\\' Key: `vmdebug', `vmmouse', `VMTools', `VMMEMCTL', `vmware', `vmci', `vmx86', `vmxnet', `vmx_svga'.",
"countermeasures": "Remove the following SubKeys under `HKLM\\SYSTEM\\ControlSet001\\Services\\' key: `vmdebug', `vmmouse', `VMTools', `VMMEMCTL', `vmware', `vmci', `vmx86', `vmxnet', `vmx_svga'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "exists",
"hkey": "HKLM",
"key": [
"SYSTEM\\ControlSet001\\Services\\vmdebug",
"SYSTEM\\ControlSet001\\Services\\vmmouse",
"SYSTEM\\ControlSet001\\Services\\VMTools",
"SYSTEM\\ControlSet001\\Services\\VMMEMCTL",
"SYSTEM\\ControlSet001\\Services\\vmware",
"SYSTEM\\ControlSet001\\Services\\vmci",
"SYSTEM\\ControlSet001\\Services\\vmx86",
"SYSTEM\\ControlSet001\\Services\\vmxnet",
"SYSTEM\\ControlSet001\\Services\\vmx_svga"
]
},
"score": 10
},
"ScsiPort0 Registry Key": {
"description": "Check if `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key has value `Identifier'=`VMWARE'.",
"countermeasures": "Patch the content of `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key value `Identifier'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0",
"value_name": "Identifier",
"value_data": "VMWARE"
},
"score": 7
},
"ScsiPort1 Registry Key": {
"description": "Check if `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key has value `Identifier'=`VMWARE'.",
"countermeasures": "Patch the content of `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key value `Identifier'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0",
"value_name": "Identifier",
"value_data": "VMWARE"
},
"score": 7
},
"ScsiPort2 Registry Key": {
"description": "Check if `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key has value `Identifier'=`VMWARE'.",
"countermeasures": "Patch the content of `HKLM\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' Registry Key value `Identifier'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0",
"value_name": "Identifier",
"value_data": "VMWARE"
},
"score": 7
},
"DiskIdentifier Registry Key": {
"description": "Check if `HKLM\\SYSTEM\\ControlSet001\\Services\\Disk\\Enum' Registry Key has values `0'=`VMware' and/or `1'=`VMware'.",
"countermeasures": "Patch the content of `HKLM\\SYSTEM\\ControlSet001\\Services\\Disk\\Enum' Registry Key values `0' and/or `1'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "SYSTEM\\ControlSet001\\Services\\Disk\\Enum",
"value_name": ["0", "1"],
"value_data": "VMware"
},
"score": 7
},
"Driver Description Registry Keys": {
"description": "Check if `SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000' Registry Keys contain values `VMware' and/or `vmx' in registry items `CoInstallers32', `DriverDesc', `InfSection', `ProviderName'.",
"countermeasures": "Patch the content of `SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000' Registry Key values `CoInstallers32', `DriverDesc', `InfSection', and `ProviderName'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000",
"value_name": ["CoInstallers32", "DriverDesc", "InfSection", "ProviderName"],
"value_data": ["VMware", "vmx"]
},
"score": 4
},
"ControlSet001 Registry Key": {
"description": "Check if `HKLM\\SYSTEM\\ControlSet001\\Enum' Registry Key has values `DeviceDesc'=`VMware' and/or `FriendlyName'=`VMware' recursively.",
"countermeasures": "Patch the content of `HKLM\\SYSTEM\\ControlSet001\\Enum' Registry Key values `DeviceDesc' and/or `FriendlyName' recursively.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKLM",
"key": "SYSTEM\\ControlSet001\\Enum",
"value_name": ["DeviceDesc", "FriendlyName"],
"value_data": "VMware"
},
"score": 7
},
"ControlSet002 Registry Key": {
"description": "Check if `HKLM\\SYSTEM\\ControlSet002\\Enum' Registry Key has values `DeviceDesc'=`VMware' and/or `FriendlyName'=`VMware' recursively.",
"countermeasures": "Patch the content of `HKLM\\SYSTEM\\ControlSet002\\Enum' Registry Key values `DeviceDesc' and/or `FriendlyName' recursively.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKLM",
"key": "SYSTEM\\ControlSet002\\Enum",
"value_name": ["DeviceDesc", "FriendlyName"],
"value_data": "VMware"
},
"score": 7
},
"ControlSet003 Registry Key": {
"description": "Check if `HKLM\\SYSTEM\\ControlSet003\\Enum' Registry Key has values `DeviceDesc'=`VMware' and/or `FriendlyName'=`VMware' recursively.",
"countermeasures": "Patch the content of `HKLM\\SYSTEM\\ControlSet003\\Enum' Registry Key values `DeviceDesc' and/or `FriendlyName' recursively.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKLM",
"key": "SYSTEM\\ControlSet003\\Enum",
"value_name": ["DeviceDesc", "FriendlyName"],
"value_data": "VMware"
},
"score": 7
},
"ProductsInstaller Registry Key": {
"description": "Check if `HKCR\\Installer\\Products' Registry Key has value `ProductName'=`vmware tools' recursively.",
"countermeasures": "Patch the content of `HKCR\\Installer\\Products' Registry Key value `ProductName' recursively.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKCR",
"key": "Installer\\Products",
"value_name": "ProductName",
"value_data": "vmware tools"
},
"score": 4
},
"ProductsUninstaller Registry Key (CurrentUser)": {
"description": "Check if `HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall' Registry Key has value `DisplayName'=`vmware tools' recursively.",
"countermeasures": "Patch the content of `HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall' Registry Key value `DisplayName' recursively.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKCU",
"key": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
"value_name": "DisplayName",
"value_data": "vmware tools"
},
"score": 4
},
"ProductsUninstaller Registry Key (LocalMachine)": {
"description": "Check if `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall' Registry Key has value `DisplayName'=`vmware tools' recursively.",
"countermeasures": "Patch the content of `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall' Registry Key value `DisplayName' recursively.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKLM",
"key": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
"value_name": "DisplayName",
"value_data": "vmware tools"
},
"score": 4
},
"SystemBiosVersion Registry Key": {
"description": "Check if `HKLM\\HARDWARE\\Description\\System' Registry Key has value `SystemBiosVersion'=`VMWARE' or `SystemBiosVersion'=`INTEL - 6040000'.",
"countermeasures": "Patch the content of `HKLM\\HARDWARE\\Description\\System' Registry Key value `SystemBiosVersion'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\Description\\System",
"value_name": "SystemBiosVersion",
"value_data": ["INTEL - 6040000", "VMWARE"]
},
"score": 9
},
"VideoBiosVersion Registry Key": {
"description": "Check if `HKLM\\HARDWARE\\Description\\System' Registry Key has value `VideoBiosVersion'=`VMWARE'.",
"countermeasures": "Patch the content of `HKLM\\HARDWARE\\Description\\System' Registry Key value `VideoBiosVersion'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\Description\\System",
"value_name": "VideoBiosVersion",
"value_data": "VMWARE"
},
"score": 9
},
"EnumPCI Registry SubKey": {
"description": "Check if `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\PCI' Registry Key has SubKey that contains `VEN_15AD'.",
"countermeasures": "Patch the name of `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\PCI' Registry Key SubKey that contains `VEN_15AD'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "enum_keys",
"hkey": "HKLM",
"key": "SYSTEM\\CurrentControlSet\\Enum\\PCI",
"subkey": "VEN_15AD"
},
"score": 4
},
"EnumIDE Registry SubKey": {
"description": "Check if `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\IDE' Registry Key has SubKey that contains `CdRomNECVMWar' or `DiskVMware'.",
"countermeasures": "Patch the name of `HKLM\\SYSTEM\\CurrentControlSet\\Enum\\IDE' Registry Key SubKey that contains `CdRomNECVMWar' or `DiskVMware'.",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "enum_keys",
"hkey": "HKLM",
"key": "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\IDE",
"subkey": [
"CdRomNECVMWar",
"DiskVMware"
]
},
"score": 6
},
"VMWare Device HGFS": {
"description": "Check if the following devices is present: `\\\\.\\HGFS'.",
"countermeasures": "Stop specific service.",
"type": "device",
"enabled": "yes",
"arguments": {
"name": "\\\\.\\HGFS"
},
"score": 8
},
"VMWare Device vmci": {
"description": "Check if the following devices is present: `\\\\.\\vmci'.",
"countermeasures": "Stop specific service.",
"type": "device",
"enabled": "yes",
"arguments": {
"name": "\\\\.\\vmci"
},
"score": 8
},
"VMWare Files": {
"description": "Check if the following files are present in the `C:\\WINDOWS\\system32' folder: `hgfs.sys', `vmhgfs.sys'. Check if the following files are present in the `C:\\WINDOWS\\system32\\drivers' folder: `vmmouse.sys', `vmnet.sys', `vmxnet.sys', `vmhgfs.sys', `vmx86.sys'. Check if `C:\\program files\\VMware\\' directory is present.",
"countermeasures": "Exclude files from enumeration using filter driver. Hook GetFileAttributes function to return appropriate result.",
"type": "file",
"enabled": "yes",
"arguments": {
"name": [
"C:\\WINDOWS\\system32\\drivers\\vmmouse.sys",
"C:\\WINDOWS\\system32\\drivers\\vmnet.sys",
"C:\\WINDOWS\\system32\\drivers\\vmxnet.sys",
"C:\\WINDOWS\\system32\\drivers\\vmhgfs.sys",
"C:\\WINDOWS\\system32\\drivers\\vmx86.sys",
"C:\\Windows\\system32\\hgfs.sys",
"C:\\Windows\\system32\\vmhgfs.sys",
"C:\\program files\\VMware\\"
]
},
"score": 10
},
"VMWare Processes": {
"description": "Check if one of the following processes is running: `vmtoolsd.exe', `vmacthlp.exe', `vmwaretray.exe', `vmwareuser.exe', `vmware.exe', `vmount2.exe'.",
"countermeasures": "Exclude `vmtoolsd.exe', `vmacthlp.exe', `vmwaretray.exe', `vmwareuser.exe', `vmware.exe', `vmount2.exe' processes from enumeration or terminate them.",
"type": "process",
"enabled": "yes",
"arguments": {
"name": [
"vmtoolsd.exe",
"vmacthlp.exe",
"vmwaretray.exe",
"vmwareuser.exe",
"vmware.exe",
"vmount2.exe"
]
},
"score": 10
},
"Forbidden MACs": {
"description": "Check if MAC vendor is one of the following ones: `000569', `000C29', `001C14', `005056'.",
"countermeasures": "Change MAC address for the virtual machine.",
"type": "mac",
"enabled": "yes",
"arguments": {
"vendor": ["000569", "000C29", "001C14", "005056"]
},
"score": 6
},
"Adapter": {
"description": "Check if adapter name contains the following identifier: `VMWare'.",
"countermeasures": "Multiple.",
"type": "adapter",
"enabled": "yes",
"arguments": {
"name": "VMWare"
},
"score": 6
},
"FirmwareRaw Table": {
"description": "Check if raw firmware table content contains the following identifier: `VMware'.",
"countermeasures": "On systems older than Vista change memory content of Csrss.exe. On Vista and higher systems hook NtQuerySystemInformation for SystemFirmwareTableInformation class and parse SFTI structure.",
"type": "firmware",
"enabled": "yes",
"arguments": {
"check": "firm",
"name": "VMware"
},
"score": 7
},
"FirmwareSMBIOS Table": {
"description": "Check if SMBIOS firmware table content contains the following identifier: `VMware'.",
"countermeasures": "On systems older than Vista change memory content of Csrss.exe. On Vista and higher systems hook NtQuerySystemInformation for SystemFirmwareTableInformation class and parse SFTI structure.",
"type": "firmware",
"enabled": "yes",
"arguments": {
"check": "rsmb",
"name": "VMware"
},
"score": 7
},
"Directory Device Object": {
"description": "Check if specific directory object `\\Device' contains the following object: `vmmemctl'.",
"countermeasures": "Stop specific service.",
"type": "object",
"enabled": "yes",
"arguments": {
"directory" : "\\Device",
"name": "vmmemctl"
},
"score": 8
},
"VMWare HypervisorID": {
"description": "Check if processor HypervisorID does not equal to: `VMwareVMware'.",
"countermeasures": "cpuid instruction mask.",
"type": "cpuid_h",
"enabled": "yes",
"arguments": {
"vendor": ["VMwareVMware"]
},
"score": 10
},
"VMWare Disk Name": {
"description": "Check if disk name does not contain the following identifiers: `VMware'.",
"countermeasures": "Multiple.",
"type": "disk",
"enabled": "yes",
"arguments": {
"name": "VMware"
},
"score": 8
},
"VMWare Drive Model": {
"description": "Check if drive model does not contain the following identifiers: `VMware'.",
"countermeasures": "Filter specific IOCTLs: DFP_RECEIVE_DRIVE_DATA (SMART_RCV_DRIVE_DATA), IOCTL_STORAGE_QUERY_PROPERTY.",
"type": "drive_model",
"enabled": "yes",
"arguments": {
"name": "VMware"
},
"score": 5
},
"HypervisorPort": {
"description": "Check if hypervisor port returns specific value.",
"countermeasures": "Disable hypervisor port.",
"type": "custom",
"enabled": "yes",
"score": 10
},
"HypervisorPortEnum": {
"description": "Enum hypervisor port commands and check if #GP exception is not raised.",
"countermeasures": "Restrict backdoor usage.",
"type": "custom",
"enabled": "yes",
"score": 5
},
"HypervisorBit": {
"description": "Check if hypervisor bit is enabled.",
"countermeasures": "cpuid instruction mask.",
"enabled": "yes",
"score": 10
},
"VMWare DiskEnum Registry Key": {
"description": "Check if `System\\CurrentControlSet\\Services\\Disk\\Enum' Registry Key has value `0'=`*vmware*'.",
"countermeasures": "Patch the registry to hide this indicator",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "System\\CurrentControlSet\\Services\\Disk\\Enum",
"value_name": "0",
"value_data": "vmware"
},
"score": 10
},
"VMWare Physical Display Adapter VendorId": {
"description": "Check if vendor ID of physical display adapter matches the one used in VMWare.",
"countermeasures": "Set up hook on a function `GetAdapterIdentifier` from `d3d9.dll`, check if the queried adapter is related to DirectX and replace return values.",
"type": "display_adapter",
"enabled": "yes",
"arguments": {
"value_name": "VendorId",
"value_data": "0x15AD"
},
"score": 7
},
"VMWare Physical Display Adapter DeviceId": {
"description": "Check if device ID of physical display adapter matches the one used in VMWare (must be used in combination with VendorId check).",
"countermeasures": "Set up hook on a function `GetAdapterIdentifier` from `d3d9.dll`, check if the queried adapter is related to DirectX and replace return values.",
"type": "display_adapter",
"enabled": "yes",
"arguments": {
"value_name": "DeviceId",
"value_data": "0x405"
},
"score": 7
},
"VMWare Physical Display Adapter Driver": {
"description": "Check if driver for physical display adapter matches one of used in VMWare.",
"countermeasures": "Set up hook on a function `GetAdapterIdentifier` from `d3d9.dll`, check if the queried adapter is related to DirectX and replace return values.",
"type": "display_adapter",
"enabled": "yes",
"arguments": {
"value_name": "Driver",
"value_data": ["vm3dum.dll", "vm3dum64_loader.dll"]
},
"score": 7
},
"VMWare Physical Display Adapter Description": {
"description": "Check if description of physical display adapter matches the one used in VMWare.",
"countermeasures": "Set up hook on a function `GetAdapterIdentifier` from `d3d9.dll`, check if the queried adapter is related to DirectX and replace return values.",
"type": "display_adapter",
"enabled": "yes",
"arguments": {
"value_name": "Description",
"value_data": "VMware SVGA 3D"
},
"score": 7
}
}
Reference in New Issue View Git Blame Copy Permalink