BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

WN25-00-000220 Windows Server 2025 system files must be monitored for unauthorized changes.

DISA STIG library V1R4
All changes in this version
first version loaded CAT II

Maps to CM-3(5) via CCI-001744

Title

Windows Server 2025 system files must be monitored for unauthorized changes.

Control

Determine whether the system is monitored for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. If system files are not monitored for unauthorized changes, this is a finding. An approved and properly configured solution will contain both a list of baselines that includes all system file locations and a file comparison task that is scheduled to run at least weekly.

Discussion

Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.

Related controls

CCI-001744

Fix

Monitor the system for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. This can be done with the use of various monitoring tools.