HIDS detection system and registry changes

Question

I use OSSEC HIDS to monitor XP and Windows 7 Operating Systems.

When OSSEC flags changes in the Windows registry, I have no idea where to go for to look for information and identify if the changes are rather legitimate or if there is an actual intrusion. So, I have two questions:

1) Can someone see anything concerning about the following changes that were flagged in one day's integrity checks?

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ialm\Device0
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\lanmanserver\parameters
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Epoch
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings

2) Can someone point me to resources or websites to help me better understand the Windows registry and how to identify intrusions based on its changes?

Answer 1

Provided Registry Keys

These are just the registry keys, to add analysis these further you really need the names of the values too. The first key is relating to Intel video driver. The second is a network related to LAN Manager. The third is related to the Windows Firewall/Internet Connection Sharing. The forth is indeed a Windows Genuine Advantage hook.

None of these registry keys indicate an intrusion by themselves. However I would investigate if a user has changed these areas or if the changes correlate with Group Policy or Microsoft updates being deployed.

I would suggest that changes to your environment (such as patches, software and group policy) should be tested on a control PC so you can quickly weed out false positives. This will help you to understand the Windows registry more in depth.

Typically high risk registry keys are:

• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\*
• HKEY_LOCAL_MACHINE \SYSTEM\CurrentControlSet\Control\Session Manager\* particularly PendingFileRenameOperations
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*

Resources

The suggestions made by Mark are good. Sans.org has plenty of great resources. Personally I would just use a search engine like Google or Bing to search for the registry key/value. Most standard Microsoft registry keys are fairly well documented with explanations.

I would also watch malware reports from all the major vendors. There are generally common patterns on where malware drop registry keys e.g. http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Torpig-A.aspx

Hope this helps.

Answer 2

I'd recommend having a look at the SANS Forensics blog (http://computer-forensics.sans.org), they've a few articles on Windows Registry analysis such as http://computer-forensics.sans.org/blog/2010/10/20/digital-forensics-autorun-registry-keys/.

Here's the link to all their blog posts on Registry Analysis - http://computer-forensics.sans.org/blog/category/registry-analysis.

It might be worth installing the Sysinternals tools for complementary analysis - http://technet.microsoft.com/en-us/sysinternals/default.aspx

Regarding OSSEC, have you changed the configuration or is it the default install? I suspect it could be a false-positive but I'm not an expert on the Windows registry. I think the first three keys are driver-related and the last one has something to do with Windows Genuine Advantage, which I've no idea why that'd be modified.

Answer 3

i am no pro at this but i will give you advice based on my experience and knowledge which isnt a lot but still valuable. This tool is extremely useful because using it you can basically detect malwares of ALL different types and ALL different levels of complexity. Given this, you will need to do some work on your end. What I would do is download a virtual machine such as VMware and then download a remote keylogger or a keylogger that allows you to attach remote installations to a file and then on your Virtual machine open this keylogger and using OSSEC observe what the changes are or what OSSEC's reaction is to this keylogger. Similarly expose your virtual machine and OSSEC to other malware and observe the behaviour of various malwares when exposed to OSSEC. Using this you only need to test for a few different types of malware until you see a general pattern of how viruses or worms work since they all have similar impacts on a machine. Once done delete the virtual machine and gather all your data. Other than that i doubt anyone will know what is exactly going on in those checks that you mention unless they have had experience with malware's before.