Installing/Uninstalling Questionable Software

Installing/Uninstalling Questionable Software (Windows/Mac)

The following out-of-the-box alert rules are assigned to the (Windows/Mac) Category: INSTALLING/UNINSTALLING QUESTIONABLE SOFTWARE.

ALERT RULE	Description
Accessing Programs and Features screen on Windows	An alert is triggered upon opening Windows Programs and Features screen, potentially in order to uninstall a program.
Installing advanced monitoring tools	An alert is triggered upon running the installation file of a predefined advanced monitoring tool to reveal information that could be sensitive.
Installing Dynamic-DNS tools	An alert is triggered upon running the installation file of a predefined Dynamic-DNS tool to hide an identity.
Installing file transfer applications	An alert is triggered upon running the installation file of an FTP/SFTP desktop application that can be used to transfer files/folders.
Installing hacking or spoofing tools	An alert is triggered upon running the installation file of a predefined hacking or spoofing tool that can be used to gain access to a restricted area or cause damage to an organization’s assets.
Installing non-standard software	An alert is triggered upon running an installation file which is not included in the permitted software for installation.
Installing P2P file sharing tools	An alert is triggered upon running the installation file of a peer-to-peer (P2P) application that can be used to share/use content that might be copyrighted, insert malicious content, or steal sensitive information.
Installing password cracking tools	An alert is triggered upon running an installation file of a predefined password cracking tool, to try and break a password-protected file with potentially sensitive information.
Installing Remote Access and Sharing Desktop tools	An alert is triggered upon running an installation file of a remote PC access or other desktop sharing application that could be used to take control of a machine remotely or take control of another remote machine.
Installing secured or encrypted email client	An alert is triggered upon running an installation file of a secured or encrypted email client which could be used to transfer information that cannot be monitored. This action could indicate that the user has something to hide.
Installing TOR (The Onion Router) tools	An alert is triggered upon running an installation file of a predefined TOR tool such as TOR browser in order access the Dark Web. This action could indicate that a user wants to hide his identity while performing illegal activity.
Installing unauthorized cloud backup applications	An alert is triggered upon running an installation file of a not allowed cloud backup application that could be used to insert malicious software or steal sensitive information.
Installing unauthorized cloud transfer applications	An alert is triggered upon running an installation file of a blacklisted cloud transfer application that could be used to insert malicious software or steal sensitive information.
Installing unauthorized email client or Instant Messenger	An alert is triggered upon running an installation file of an email client or Instant Messaging application that is not authorized.
Installing virtualization solution	An alert is triggered upon running an installation file of various predefined virtualization solutions. This action could indicate that the user is trying to perform activity on a virtual machine that will be destroyed later leaving no traces.
Installing VPN, Proxy or Tunneling tools	An alert is triggered upon running an installation file of a predefined VPN/Proxy/Tunneling tool that can be used to gain access to a restricted area or hide the real identity of a user.
Uninstalling a program on Windows Desktop	An alert is triggered upon running the uninstallation of any software on a machine that functions as a desktop.
Uninstalling a program on Windows Server	An alert is triggered upon running the uninstallation of any software on a machine that functions as a server.