Re: What files to watch??

["Chris Berry" <compjma () hotmail com>]

> From: H Carvey <keydet89 () yahoo com>
> >Lacking funds and a GPL alternative, I went ahead a
> wrote a
> >scanner using perl and the Digest::Md5 module.
> I'd like to applaud your initiative.  I've done the
> same, and have written some pretty cool monitoring and
> analysis tools, in Perl for the Win32 systems.

I'd be happy to trade, I've also written a software inventory system that 
queries the registry of all the machines listed in DNS and returns a report 
of all the programs we have installed network wide.

> > Anyone have a good idea on how to get it to produce
> >more useable detections?
> Well, that really sort of depends on your
> infrastructure, policies, etc., doesn't it?

We're small enough that I'm the one who makes those decisions and I'm still 
in the process of creating them, any suggestions?

> However, here are some things you might consider:
>
> 1.  Malware tends to target files in %WINDIR%, as well
> as the system32 directory.

That's what tripwire does, I was thinking of maybe creating some sort of 
statistical analysis/database combo instead.

> 2.  Something to add to the monitoring program might be
> checking of the contents of the Run key, as well as others.

Not up to checking registry keys yet, trying to get useful file monitoring 
first.

> 3.  You might consider explicitly looking at
> application files, such as those located in the Program
> Files directory.

Right now it checks everything, then filters out stuff I don't want to look 
at.

Chris Berry
compjma () hotmail com
Systems Administrator
JM Associates

"All I want is a few minutes alone with the source code for the universe and 
a quick recompile."

_________________________________________________________________
Add photos to your e-mail with MSN 8. Get 2 months FREE*.  
http://join.msn.com/?page=features/featuredemail


---------------------------------------------------------------------------
Thinking About Security Training? You Can't Afford Not To!

Vigilar's industry leading curriculum includes:  Security +, Check Point, 
Hacking & Assessment, Cisco Security, Wireless Security & more! Register Now!
--UP TO 30% off classes in select cities-- 
http://www.securityfocus.com/Vigilar-security-basics
----------------------------------------------------------------------------