System files must be monitored for unauthorized changes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-73265	WN16-00-000240	SV-87917r1_rule		Medium

Description
Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.

STIG	Date
Windows Server 2016 Security Technical Implementation Guide	2019-01-16

Details

Check Text ( C-73369r1_chk )
Determine whether the system is monitored for unauthorized changes to system files (e.g., .exe, .bat, .com, .cmd, and *.dll) against a baseline on a weekly basis. If system files are not monitored for unauthorized changes, this is a finding. A properly configured HBSS Policy Auditor 5.2 or later File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.

Check Text ( C-73369r1_chk )

Determine whether the system is monitored for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis.

If system files are not monitored for unauthorized changes, this is a finding.

A properly configured HBSS Policy Auditor 5.2 or later File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.

Fix Text (F-79709r1_fix)
Monitor the system for unauthorized changes to system files (e.g., .exe, .bat, .com, .cmd, and *.dll) against a baseline on a weekly basis. This can be done with the use of various monitoring tools.