A root kit check tool must be run on the system at least weekly.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22575	GEN008380	SV-38398r1_rule	DCSL-1	Medium

Description
Root kits are software packages designed to conceal the compromise of a system from the SA. Root kit checking tools examine a system for evidence of an installed root kit. Dedicated root kit detection software or root kit detection capabilities included in anti-virus packages may be used to satisfy this requirement.

STIG	Date
HP-UX 11.23 Security Technical Implementation Guide	2015-12-02

Details

Check Text ( C-36785r5_chk )
Ask the SA if a root kit check tool is installed on the system and run weekly. Verify this is the case by checking software inventory and automated job-scheduling tools, such as cron. Some root kit check tools may run from read-only alternate boot media, requiring several reboots of the system. If a root kit check tool not requiring a system reboot is not run at least weekly, either via manual or automated means, this is a finding. If a root kit check tool requiring a system reboot is not run at regular intervals less frequent than weekly, but at least every 30 days, this is a finding.

Check Text ( C-36785r5_chk )

Ask the SA if a root kit check tool is installed on the system and run weekly. Verify this is the case by checking software inventory and automated job-scheduling tools, such as cron. Some root kit check tools may run from read-only alternate boot media, requiring several reboots of the system.

If a root kit check tool not requiring a system reboot is not run at least weekly, either via manual or automated means, this is a finding.

If a root kit check tool requiring a system reboot is not run at regular intervals less frequent than weekly, but at least every 30 days, this is a finding.

Fix Text (F-32165r1_fix)
Create an automated job or establish a site-defined procedure to check the system weekly with a root kit check tool.