admin/CheckPointSW-InviZzzible
1
0
Fork 0
mirror of https://github.com/CheckPointSW/InviZzzible synced 2026-06-08 10:35:43 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
c871f84df599ed866ddabb613e42a35e57f9e244
CheckPointSW-InviZzzible/config/vmware.conf
T

306 lines
7.8 KiB
Plaintext
Raw Blame History

{
"VMWare Tools registry key": {
"description": "Check if VMWare Tools registry key that compromises VMWare is present",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "exists",
"hkey": "HKLM",
"key": "SOFTWARE\\VMware, Inc.\\VMware Tools"
}
},
"Scsi Port 0": {
"description": "Check if Scsi Port 0 has specific value",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0",
"value_name": "Identifier",
"value_data": "VMWARE"
}
},
"Scsi Port 1": {
"description": "Check if Scsi Port 1 has specific value",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0",
"value_name": "Identifier",
"value_data": "VMWARE"
}
},
"Scsi Port 2": {
"description": "Check if Scsi Port 2 has specific value",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0",
"value_name": "Identifier",
"value_data": "VMWARE"
}
},
"Disks": {
"description": "Check if Disks has specific value",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "SYSTEM\\ControlSet001\\Services\\Disk\\Enum",
"value_name": ["0", "1"],
"value_data": "VMware"
}
},
"ControlSet001 Enum": {
"description": "Check if ControlSet001\\Enum subkeys have specific value",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKLM",
"key": "SYSTEM\\ControlSet001\\Enum",
"value_name": ["DeviceDesc", "FriendlyName"],
"value_data": "VMware"
}
},
"ControlSet002 Enum": {
"description": "Check if ControlSet002\\Enum subkeys have specific value",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKLM",
"key": "SYSTEM\\ControlSet002\\Enum",
"value_name": ["DeviceDesc", "FriendlyName"],
"value_data": "VMware"
}
},
"ControlSet003 Enum": {
"description": "Check if ControlSet003\\Enum subkeys have specific value",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKLM",
"key": "SYSTEM\\ControlSet003\\Enum",
"value_name": ["DeviceDesc", "FriendlyName"],
"value_data": "VMware"
}
},
"Products Installer": {
"description": "Check if Installer\\Products has VMware Tools",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKCR",
"key": "Installer\\Products",
"value_name": "ProductName",
"value_data": "vmware tools"
}
},
"Products Uninstaller Current User": {
"description": "Check if Products Uninstaller contains specific value",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKCU",
"key": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
"value_name": "DisplayName",
"value_data": "vmware tools"
}
},
"Products Uninstaller Local Machine": {
"description": "Check if Products Uninstaller contains specific value",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"recursive": "yes",
"hkey": "HKLM",
"key": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
"value_name": "DisplayName",
"value_data": "vmware tools"
}
},
"SystemBiosVersion": {
"description": "Check if SystemBiosVersion has specific value",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\Description\\System",
"value_name": "SystemBiosVersion",
"value_data": ["INTEL - 6040000", "VMWARE"]
}
},
"VideoBiosVersion": {
"description": "Check if VideoBiosVersion has specific value",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "contains",
"hkey": "HKLM",
"key": "HARDWARE\\Description\\System",
"value_name": "VideoBiosVersion",
"value_data": "VMWARE"
}
},
"Enum PCI": {
"description": "Check if Enum PCI key has specific subkeys",
"countermeasures": "Fill",
"type": "registry",
"enabled": "yes",
"arguments": {
"check": "enum_keys",
"hkey": "HKLM",
"key": "SYSTEM\\CurrentControlSet\\Enum\\PCI",
"subkey": "VEN_15AD"
}
},
"Device HGFS": {
"description": "Check if HGFS device is available on the system",
"countermeasures": "Fill",
"type": "device",
"enabled": "yes",
"arguments": {
"name": "\\\\.\\HGFS"
}
},
"Device vmci": {
"description": "Check if vmci device is available on the system",
"countermeasures": "Fill",
"type": "device",
"enabled": "yes",
"arguments": {
"name": "\\\\.\\vmci"
}
},
"Driver files": {
"description": "Check if specific driver files present on the system",
"countermeasures": "Fill",
"type": "file",
"enabled": "yes",
"arguments": {
"name": ["C:\\WINDOWS\\system32\\drivers\\vmmouse.sys", "C:\\WINDOWS\\system32\\drivers\\vmhgfs.sys", "C:\\Windows\\system32\\prleth.sys", "C:\\Windows\\system32\\hgfs.sys", "C:\\Windows\\system32\\vmhgfs.sys"]
}
},
"VMware processes": {
"description": "Check if specific processes are running",
"countermeasures": "Fill",
"type": "process",
"enabled": "yes",
"arguments": {
"name": ["vmtoolsd.exe", "vmacthlp.exe"]
}
},
"Forbidden MACs": {
"description": "Check if mac is forbidden one",
"countermeasures": "Fill",
"type": "mac",
"enabled": "yes",
"arguments": {
"vendor": ["000569", "000C29", "001C14", "005056"]
}
},
"Adapter": {
"description": "Check if one of adapters has forbidden name",
"countermeasures": "Fill",
"type": "adapter",
"enabled": "yes",
"arguments": {
"name": "VMWare"
}
},
"Firmware Raw": {
"description": "Check raw firmware table content",
"countermeasures": "Fill",
"type": "firmware",
"enabled": "yes",
"arguments": {
"check": "firm",
"name": "VMware"
}
},
"Firmware SMBIOS": {
"description": "Check rsmb firmware table content",
"countermeasures": "Fill",
"type": "firmware",
"enabled": "yes",
"arguments": {
"check": "rsmb",
"name": "VMware"
}
},
"Device Object": {
"description": "Check if specific device object is present",
"countermeasures": "Fill",
"type": "object",
"enabled": "yes",
"arguments": {
"directory" : "\\Device",
"name": "vmmemctl"
}
},
"Vendor ID": {
"description": "Check if vendor id is not a forbidden one",
"countermeasures": "Fill",
"type": "cpuid",
"enabled": "yes",
"arguments": {
"vendor": "VMwareVMware"
}
},
"Disk names": {
"description": "Check if disk names are not forbidden ones",
"countermeasures": "Fill",
"type": "disk",
"enabled": "yes",
"arguments": {
"name": "VMware"
}
},
"HypervisorPort": {
"description": "Check if hypervisor port returns specific value",
"countermeasures": "Fill",
"type": "custom",
"enabled": "yes"
},
"DeviceNPF_NDIS": {
"description": "Check if access to NPF_NdisWanIP device returns specific error code",
"countermeasures": "Fill",
"type": "custom",
"enabled": "yes"
},
"HypervisorBit": {
"description": "Check if hypervisor bit is enabled",
"countermeasures": "Fill",
"enabled": "yes"
}
}
Reference in New Issue View Git Blame Copy Permalink