This SCAP resource is meant to be a starting point for documenting malicious artifacts typically identified via computer forensic analysis and/or malware analysis. This set of rules consists of suspicious file names and suspicious location of files. These artifacts are typically associated with malware or intruder activity. Item 1 looks for ntshrui.dll located in a suspicious location. Item 2 recursively looks for the existence of svch0st.exe in a specific location, this file is typically malicious. Item 3 recursively looks for the existence of svchost.dll in a specific location, this file is typically malicious. Item 4 recursively looks for svchosts.exe in a specific location, this file is typically malicious. Item 5 recursively looks for the existence of winsvr.exe in a specific location, this file is typically malicious. Item 6 looks for mspk.sys and item 7 looks for Trojan.noise0, these artifacts are considered suspicious. These rules are only meant to point out the presence of these artifacts, and do not guarantee that the identified files are actually malicious.
This checklist has been created for IT professionals, particularly Windows 7 and XP system administrators and information security personnel. The document assumes that the reader has experience installing and administering Windows-based systems in domain or standalone configurations.
- Sector-Specific Environment
Windows 7 and XP workstations.
Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. CyberESI assumes no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic. CyberESI would appreciate acknowledgement if the document and template are used.
CyberESI will provide best efforts support in line with the customer's support contract.
Pursuant to title 17 Section 105 of the United States Code this document and template are not subject to copyright protection and are in the public domain.
Updated status to "Final" - 07 January 2015
Content Revision - 04/04/2017
Updated to FINAL - 05/05/2017
NIST checklist record last modified on 05/06/2017