mirror of
https://github.com/CheckPointSW/InviZzzible
synced 2026-06-08 10:35:43 +00:00
chkp-ramanl
80 lines
2.3 KiB
Plaintext
80 lines
2.3 KiB
Plaintext
{
|
|
"Xen Hardware Device Registry Keys": {
|
|
"description": "Check if `HKLM\\HARDWARE\\ACPI\\*\\xen' Registry Keys are present.",
|
|
"countermeasures": "Remove `HKLM\\HARDWARE\\ACPI\\*\\xen' Registry Keys.",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "exists",
|
|
"hkey": "HKLM",
|
|
"key": [
|
|
"HARDWARE\\ACPI\\DSDT\\xen",
|
|
"HARDWARE\\ACPI\\FADT\\xen",
|
|
"HARDWARE\\ACPI\\RSDT\\xen"
|
|
]
|
|
},
|
|
"score": 7
|
|
},
|
|
"Xen Services Registry Keys": {
|
|
"description": "Check if `HKLM\\SYSTEM\\ControlSet001\\Services\\xen*' Registry Keys are present.",
|
|
"countermeasures": "Remove `HKLM\\SYSTEM\\ControlSet001\\Services\\xen*' Registry Keys.",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "exists",
|
|
"hkey": "HKLM",
|
|
"key": [
|
|
"SYSTEM\\ControlSet001\\Services\\xenevtchn",
|
|
"SYSTEM\\ControlSet001\\Services\\xennet",
|
|
"SYSTEM\\ControlSet001\\Services\\xennet6",
|
|
"SYSTEM\\ControlSet001\\Services\\xensvc",
|
|
"SYSTEM\\ControlSet001\\Services\\xenvdb"
|
|
]
|
|
},
|
|
"score": 8
|
|
},
|
|
"Xen Processes": {
|
|
"description": "Check if one of the following processes is running: `xenservice.exe', `xsvc_depriv.exe'",
|
|
"countermeasures": "Exclude `xenservice.exe', `xsvc_depriv.exe' processes from enumeration or terminate them.",
|
|
"type": "process",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"name": ["xenservice.exe", "xsvc_depriv.exe"]
|
|
},
|
|
"score": 10
|
|
},
|
|
"Xen CPU VendorID": {
|
|
"description": "Check if processor VendorID does not equal to: `XenVMMXenVMM'.",
|
|
"countermeasures": "cpuid instruction mask.",
|
|
"type": "cpuid_v",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"vendor": ["XenVMMXenVMM"]
|
|
},
|
|
"score": 10
|
|
},
|
|
"Xen CPU HypervisorID": {
|
|
"description": "Check if processor HypervisorID does not equal to: `XenVMMXenVMM'.",
|
|
"countermeasures": "cpuid instruction mask.",
|
|
"type": "cpuid_h",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"vendor": ["XenVMMXenVMM"]
|
|
},
|
|
"score": 10
|
|
},
|
|
"Xen DiskEnum Registry Key": {
|
|
"description": "Check if `System\\CurrentControlSet\\Services\\Disk\\Enum' Registry Key has value `0'=`*xen*'.",
|
|
"countermeasures": "Patch the registry to hide this indicator",
|
|
"type": "registry",
|
|
"enabled": "yes",
|
|
"arguments": {
|
|
"check": "contains",
|
|
"hkey": "HKLM",
|
|
"key": "System\\CurrentControlSet\\Services\\Disk\\Enum",
|
|
"value_name": "0",
|
|
"value_data": "xen"
|
|
},
|
|
"score": 7
|
|
}
|
|
} |