Does anyone else out there currently do any additional checks in the
Windows agent for the syscheck?
I'm thinking of adding....
<!-- Default files to be monitored - system32 only. -->
<directories check_all="yes">%WINDIR%/system32</directories>
<directories check_all="yes">%SYSTEMROOT%\Tasks</directories>
<directories check_all="yes">%SYSTEMROOT%\WINSTART.BAT</directories>
<directories check_all="yes">%SYSTEMROOT%\WIN.INI</directories>
<directories check_all="yes">%HOMEDRIVE%\AUTOEXEC.BAT</directories>
<directories check_all="yes">%HOMEDRIVE%\boot.ini</directories>
<directories check_all="yes">%HOMEDRIVE%\Documents and
Settings\*\Start Menu\Programs\Startup</directories>
I don't think any of those locations will generate crazy errors, but you
never know. I'm guessing there is a few other auto start locations I'm
missing. The registry ones seem to all be covered by the defaults.
Also by default does OSSEC check itself? (C:\Program Files\ossec-agent)
I didn't see the directory listed in the ossec.conf file but was given
an alert on it anyways after changing the file.
Thanks,
Rob Skoog
