3 Replies Latest reply on Mar 5, 2014 7:58 AM by omar_tx

    Accessing other users home directory  (HIPS Signature 6053)

    omar_tx

      Before applying the signature explained below, i need to do some testing.  I've enabled this rule on a couple workstations and set it to prevent.  So far i have not experienced any problems but i want to make sure that i do not overlook something.  First what can I do to trigger this signature and ensure this is working?  I did research on what a user's home directory is by default and per Microsoft it is c:\users\default\.  I have successfully accessed this directory on the couple of systems that have this signature set to prevent.  Am I missing something or is there somewhere else that i need to check?

       

       

      Signature 6053: Accessing other users home directory

      Description:

      -This event indicates an attempt by a user to access another user's home directory.

      -This signature is disabled by default.

      -The signature is supported on HIPS 8 Patch 2 and above only.