Difference between revisions of "HIDS 553"

From Atomicorp Wiki
Jump to: navigation, search
(Created page with "'''Rule ID''' 553 '''Status''' Active rule currently published. '''Description''' This rule is detects when a monitored file changes. '''False Positives''' There is n...")
 
m
 
(4 intermediate revisions by one user not shown)
Line 9: Line 9:
 
'''Description'''   
 
'''Description'''   
  
This rule is detects when a monitored file changes.   
+
This rule is detects when a monitored file has been deleted, and the system can not longer monitor itThis may be non-malicious, or may indicate that unauthorized changes have occurred on your system.
  
 
'''False Positives'''
 
'''False Positives'''
  
There is no known false positive for this rule.  This rule detects when files change, therefore, it is not recommended that you disable this rule.   
+
There is no known false positive for this rule.  This rule detects when a file has been deleted, and therefore the system can no longer monitor it.   
  
 
If you believe that this is a false positive, please report this to our security team can determine if this is a legitimate case, or if its clever attack on your system.  Instructions to report false positives are detailed on the [[Reporting False Positives]] wiki page.
 
If you believe that this is a false positive, please report this to our security team can determine if this is a legitimate case, or if its clever attack on your system.  Instructions to report false positives are detailed on the [[Reporting False Positives]] wiki page.
Line 24: Line 24:
 
'''Similar Rules'''
 
'''Similar Rules'''
  
None.
+
[[HIDS 550]]
 +
 
 +
[[HIDS 551]]
  
 
'''Knowledge Base Articles'''
 
'''Knowledge Base Articles'''

Latest revision as of 18:30, 26 July 2011

Rule ID

553

Status

Active rule currently published.

Description

This rule is detects when a monitored file has been deleted, and the system can not longer monitor it. This may be non-malicious, or may indicate that unauthorized changes have occurred on your system.

False Positives

There is no known false positive for this rule. This rule detects when a file has been deleted, and therefore the system can no longer monitor it.

If you believe that this is a false positive, please report this to our security team can determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page.


Tuning Recommendations

None.

Similar Rules

HIDS 550

HIDS 551

Knowledge Base Articles

None.

Outside References

Personal tools