Check your ossec.conf for alert_new_files options (
http://www.ossec.net/main/manual/manual-syscheck)
Also check this rule in ossec_rules.xml
<rule id="554" level="0">
<category>ossec</category>
<decoded_as>syscheck_new_entry</decoded_as>
<description>File added to the system.</description>
<group>syscheck,</group>
</rule>
I bump up the level to 7 to make sure it fires off.
I'm not sure about the registry stuff ... only using on Linux atm
On Fri, Dec 9, 2011 at 12:46 PM, alsdks <[email protected]> wrote:
> Hello all,
>
> I am testing syscheck default configuration on Windows platfroms. I
> change a registry key by putting new entries under it
> (HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run) and
> also an executable located under System32 (say ftp.exe by changing its
> permissions).
>
> For the registry change I got one alert out of three at least I should
> be getting (after each change I restart syscheck to check again ) and
> for the executable I did not receive anything at anytime .I also
> checked logall archives.log for finding if any message for them
> arrived but nothing.
>
>
> The above have been tested at two different Ossec servers and
> environments both with the default out of box ossec.conf for Windows.
>
> Is there another setting I need to tweak for this ?
>
> Has anyone tested this ?
>
> Thank you
> BR
>
