System files will be monitored for unauthorized changes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2907	1.024	SV-32262r1_rule		Medium

Description
Comparing system files against a baseline on a regular basis will detect the possibility of introduction of malicious code on the system.

STIG	Date
Windows Server 2008 R2 Member Server Security Technical Implementation Guide	2019-06-18

Details

Check Text ( C-7891r1_chk )
Interview the SA to determine if the site uses a tool to compare system files (*.exe, *.bat, *.com, *.cmd and *.dll) on servers against a baseline, on a weekly basis. Note: A properly configured HBSS Policy Auditor 5.2 or later, File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.

Fix Text (F-42r1_fix)
The site should use a tool to compare system files (*.exe, *.bat, *.com, *.cmd and *.dll) on servers against a baseline, on a weekly basis.