[ossec-list] Windows Ossec - Detect possible rootkit NTFS Metadata files

[Anthony Ciabattoni]

How would you modify the ossec.conf detect any changes in $Boot, $MFT,
$Secure NTFS metadata files