Open MiguelCasaresRobles opened 3 years ago
This issue applies for rootkit and malware detections.
Impact:
scanall
option user can scan the entire system to avoid missing alerts.scanall
option doesn't apply for this scan. Probability:
Cost to fix it:
Estimated time:
Hello team,
I'm opening this issue to consider increasing Rootcheck malware detection capabilities. At this moment, those are the directories monitored by default: https://github.com/wazuh/wazuh/blob/master/src/rootcheck/check_rc_trojans.c#L26
It is not possible to configure Windows directories or more paths in Linux. Although it is possible to scan the whole system: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/rootcheck.html#scanall it is not giving enough flexibility to the user to configure its system.
It happens for the
rootkits
too: https://github.com/wazuh/wazuh/blob/master/src/rootcheck/check_rc_sys.c#L154Reported by Johannes Segitz of SUSE
Regards,
Miguel Casares