Re: Operative System Updates

[Andrew Cummings <acummings.dfw () gmail com>]

haZ,

If you don't *have* to use a script, then you could also try OSSEC (www.ossec.net) - from the blurb:

"OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection System (HIDS). It has a powerful 
correlation and analysis engine, integrating log analysis, file integrity checking, Windows registry monitoring, 
centralized policy enforcement, rootkit detection, real-time alerting and active response."

It's free :)

Andy Cummings


On Jun 14, 2012, at 1:41 PM, Dave Kleiman wrote:

> haZ,
>
> For the files changed portion of your question, you could use something like Log Parser to gather lists of MD5s of 
> files and compare them after.
> Like if you wanted EXEs in the sys32.
>
> logparser "SELECT Path, HASHMD5_FILE(Path) INTO EXE_MD5s.csv FROM C:\Windows\System32\*.exe" -i:FS -recurse:0 -o:csv
>
>
> Respectfully,
>
> Dave Kleiman - http://www.ComputerForensicsLLC.com - http://www.DaveKleiman.com
>
> 4371 Northlake Blvd #314
> Palm Beach Gardens, FL 33410
> 561.310.8801 
>
>
>
>
> -----Original Message-----
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of haZard0us
> Sent: Thursday, June 14, 2012 13:45
> To: security-basics () securityfocus com
> Subject: Operative System Updates
>
> Hi all,
>
> I need to create a script that gathers information of the OS before and after the updates in order to detect changes 
> and which updates/service packs were used.
>
> To be honest, I really don't know where to start. So, my question is which information should i gather in order to 
> detect correctly which files were changed and which updates were used.
>
> Thanks in advance.
>
> --haZ
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and 
> who needs an SSL certificate.  We look at how SSL works, how it benefits your company and how your customers can tell 
> if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your 
> Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing 
> management of your encryption keys and digital certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> ------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------