Title

A root kit check tool must be run on the system at least weekly. (Cat II impact)

Discussion

Root kits are software packages designed to conceal the compromise of a system from the SA. Root kit checking tools examine a system for evidence that a root kit is installed. Dedicated root kit detection software or root kit detection capabilities included in anti-virus packages may be used to satisfy this requirement.

Check Content

Ask the SA if a root kit check tool is run on the system weekly. If this is not performed, this is a finding.

Fix Text

Create an automated job or establish a site-defined procedure to check the system weekly with a root kit check tool.

Additional Identifiers

Rule ID: SV-26250r1_rule

Vulnerability ID: V-22575

Group Title: GEN008380

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.