UCF STIG Viewer Logo

System files must be monitored for unauthorized changes.


Overview

Finding ID Version Rule ID IA Controls Severity
WN12-GE-000017 WN12-GE-000017 WN12-GE-000017_rule Medium
Description
Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.
STIG Date
Microsoft Windows Server 2012 Domain Controller Security Technical Implementation Guide 2013-07-25

Details

Check Text ( C-WN12-GE-000017_chk )
Determine whether the site uses a tool to compare system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on servers against a baseline on a weekly basis.

A properly configured HBSS Policy Auditor 5.2 or later File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.
Fix Text (F-WN12-GE-000017_fix)
Implement a tool to compare system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on servers against a baseline on a weekly basis.