/usr/share/doc/samhain/manual.html/winreg.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Checking the Windows registry</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="UP"
TITLE="Configuring samhain, the host integrity monitor"
HREF="file-monitor.html"><LINK
REL="PREVIOUS"
TITLE="Logfile monitoring/analysis"
HREF="logmon.html"><LINK
REL="NEXT"
TITLE="Modules"
HREF="modules.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="logmon.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 5. Configuring <SPAN
CLASS="APPLICATION"
>samhain</SPAN
>, the host integrity monitor</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="modules.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="WINREG"
>5.17. Checking the Windows registry</A
></H1
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>32bit vs. 64bit views</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>      On 64bit Windows, the same key name may get mapped to different 
      keys, depending on whether the lookup is done by a 32bit or 64bit
      application. Currently <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> does not
      check the alternate view.
    </P
></TD
></TR
></TABLE
></DIV
><P
>    This option is available with <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> version
    2.8.0 and higher, when compiled on Cygwin/Windows.
    It enables <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> to verify the integrity
    of individual keys, or complete trees/hierarchies of keys, in the
    Windows registry.
  </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Be careful what you ask for</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>    The Windows registry is huge, i.e. it may contain a huge amount of
    keys, for which baseline data will get stored in the 
    <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> baseline database if you desire
    to monitor all of them. There is the potential to blow up the size of the
    baseline database in a quite spectacular way.
  </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN3067"
>5.17.1. Options</A
></H2
><P
>    All options for this module go into the section <B
CLASS="COMMAND"
>[Registry]</B
>.
  </P
><P
>  <B
CLASS="COMMAND"
>RegistryCheckActive=<TT
CLASS="REPLACEABLE"
><I
>boolean</I
></TT
></B
> 
  switches this module on or off (default: off).
  </P
><P
>  <B
CLASS="COMMAND"
>RegistryCheckInterval=<TT
CLASS="REPLACEABLE"
><I
>seconds</I
></TT
></B
> 
  defines the interval (in seconds) between consecutive checks. The default
  is 300 seconds.
  </P
><P
>  <B
CLASS="COMMAND"
>SeverityChange=<TT
CLASS="REPLACEABLE"
><I
>severity</I
></TT
></B
> 
  defines the severity for reports on modifications to the registry.
  </P
><P
>  <B
CLASS="COMMAND"
>IgnoreTimestampOnly=<TT
CLASS="REPLACEABLE"
><I
>boolean</I
></TT
></B
> 
  to ignore changes where only the (write) timestamp has changed (default: off).
  </P
><P
>  <B
CLASS="COMMAND"
>SingleKey=<TT
CLASS="REPLACEABLE"
><I
>key</I
></TT
></B
> 
  defines a key to be monitored (of course it is possible to
  use this command multiple times). Valid key names must start with
  one of: HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE,
  or HKEY_USERS. The Windows path separator ('\') must be used.
  </P
><P
>  <B
CLASS="COMMAND"
>Hierarchy=<TT
CLASS="REPLACEABLE"
><I
>key</I
></TT
></B
> 
  defines a key hierarchy in the registry, beginning at the specified key,
  to be monitored (of course it is possible to
  use this command multiple times). Valid key names must start with
  one of: HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE,
  or HKEY_USERS. The Windows path separator ('\') must be used.
  </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Escaping the path separator</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>    The following two directives (StopAtKey, IgnoreKey) take
    a (POSIX) regular expression as argument. This implies
    that the path separator must be escaped by doubling it, i.e.
    you need to write '\\' instead of '\', because the '\' is
    a metacharacter in regular expressions (see example below).
  </P
></TD
></TR
></TABLE
></DIV
><P
>  <B
CLASS="COMMAND"
>StopAtKey=<TT
CLASS="REPLACEABLE"
><I
>regex</I
></TT
></B
> 
  means that the check of a hierarchy will stop at the specified key,
  i.e. nothing below this key will be checked or monitored (but the
  key itself where the check stops will). 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>It is allowed to use a regular
  expression for the key.</I
></SPAN
>
  Valid key names must start with
  one of: HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE,
  or HKEY_USERS. The Windows path separator ('\') must be used.
  </P
><P
>  <B
CLASS="COMMAND"
>IgnoreKey=<TT
CLASS="REPLACEABLE"
><I
>regex</I
></TT
></B
> 
  differs from the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>StopAtKey</I
></SPAN
> option only insofar
  as the key where the check stops is <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>not</I
></SPAN
>
  itself checked.
  </P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN3101"
>5.17.2. Example configuration</A
></H2
><PRE
CLASS="PROGRAMLISTING"
>  [Registry]

  #
  # Switch on the module
  #
  RegistryCheckActive = yes

  # Check every 60 second
  #
  RegistryCheckInterval = 1

  # Check this and everything below
  #
  Hierarchy = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft

  # Exclude this and anything below
  # IgnoreKey and StopAtKey have a regex as argument, hence
  # the path separator '\' must be escaped by doubling it.
  #
  IgnoreKey = HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion

  # Check this key
  #
  SingleKey = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters

  </PRE
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="logmon.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="modules.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Logfile monitoring/analysis</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="file-monitor.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Modules</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / winreg.html
