eG Monitoring
 

Measures reported by ScrtyRtFlChecksTest

Windows OS has its set of individual folders in the System driver that it uses to store crucial data. The root directory is the top-level directory of a folder structure. The directory includes all other directories and files on a system. The Root Directory includes different folders, each specifically designed to store particular files and applications. Hence, if the attackers access the root directory, then they can have access to all other files and folders stored in the root folder. Then, they may be able to read and write arbitrary files on the system, thus enabling them to manipulate applications and associated data. In addition, they may be able to read sensitive information such as passwords, or even take control of the whole system. This is why, it is highly imperative to monitor the root/system folders on the Windows host.

The ScrtyRtFlChecksTest test continuously monitors the root/system folders on the target host and reports the number of new files added to the root folder. This enables the administrators to proactively track and eliminate any chance of malicious attacks or other security threats. They can use the detailed diagnosis offered by this test to avail further details on the file addition such as the File object and time of creation.

Note:

  1. The folders that are considered as root/system folders by the target system are:

    • %HOMEDRIVE%

    • %SYSTEMROOT%\\System32\\

    • % SYSTEMROOT %\\SysWOW64\\

  2. By default, this test excludes eGurkha install directory from the scope of monitoring.

Outputs of the test : One set of results for the Windows host being monitored.

The measures made by this test are as follows:

Measurement Description Measurement Unit Interpretation
newFiles Indicates the number of new files added to root/system folders during the last measurement period. Number The detailed diagnosis of this measure provide details of the file object added, and created time.