← Back to Windows Server 2019 Security Technical Implementation Guide

V-93203

CAT II (Medium)

Windows Server 2019 system files must be monitored for unauthorized changes.

Rule ID

SV-103291r1_rule

STIG

Windows Server 2019 Security Technical Implementation Guide

Version

V1R3

CCIs

CCI-001744

Discussion

Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.

Check Content

Determine whether the system is monitored for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis.

If system files are not monitored for unauthorized changes, this is a finding.

A properly configured HBSS Policy Auditor 5.2 or later File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.

Fix Text

Monitor the system for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. This can be done with the use of various monitoring tools.