Re: Registry and File Monitoring Programs for Windows Honeypots

[Chris Brenton <cbrenton () chrisbrenton org>]

Mark E. Donaldson wrote:
> Although it was made for cloning Windows systems, the W2K Resource Kit
> Utility "Sysdiff" is excellent for detecting "any" change that occurs in a
> Windows machine. 

There has been some cool tool ideas suggested, but I guess it really 
comes down to what you are using the honeypot for. If its to see what a 
specific worm or rootkit does to a system, the tools mentioned are cool 
as you can easily do a before and after snapshot (one caveat, the tool 
should always do an MD5 and/or SHA-1 check of the file).

If its for a honeypot that will be hanging on the wire however, you 
typically want to see these things live as they happen. Some criteria I 
look for:

Monitor file system changes
Monitor new processes that get launched in memory
Little to no extra software on the system to suggest its a honeypot
Some way to record all this data off to a remote (secured) system

There are plenty of tools to do all this on the UNIX side. I'm not 
exactly sure how you would pull it off on the Windows side, but maybe 
Lance and others more savvy can chime in here.

Cheers all,
Chris