Patriot NG: New HostBased Intrusion Detection System

[Renk]

Patriot is a 'Host IDS' tool which allows real time monitoring of changes in Windows systems or Network attacks.

Patriot monitors:

* Changes in Registry keys: Indicating whether any sensitive key (autorun, internet explorer settings...) is altered.
* New files in 'Startup' directories
* New Users in the System
* New Services installed
* Changes in the hosts file
* New scheduled jobs
* Alteration of the integrity of Internet Explorer: (New BHOs, configuration changes, new toolbars)
* Changes in ARP table (Prevention of MITM attacks)
* Installation of new Drivers
* New Netbios shares
* TCP/IP Defense (New open ports, new connections made by processes, PortScan detection...)
* Files in critical directories (New executables, new DLLs...)
* New hidden windows (cmd.exe / Internet Explorer using OLE objects)
* Netbios connections to the System
* ARP Watch (New hosts in your network)
* NIDS (Detect anomalous network traffic based on editable rules)

It needs winpcap.
You can view the security logs made by Patriot NG through Windows Event viewer in ‘Application’.
Changes are not persistent so when you restart, all apps / ports / hosts blocked are unblocked.

Security Projects - Patriot NG