SV-225235r960891: Event tracing for Windows (ETW) for Common Language Runtime events must be enabled. | Microsoft DotNet Framework 4.0 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Event tracing for Windows (ETW) for Common Language Runtime events must be enabled.

Description

Discussion Text

Event tracing captures information about applications utilizing the .NET CLR and the .NET CLR itself. This includes security oriented information, such as Strong Name and Authenticode verification. Beginning with Windows Vista, ETW is enabled by default however, the .Net CLR and .Net applications can be configured to not utilize Event Tracing. If ETW event tracing is disabled, critical events that occurred within the runtime will not be captured in event logs.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000130SV-41075V-31026

References

DPMS Target Microsoft DotNet Framework 4-0 DISA DPMS Target Microsoft DotNet Framework 4-0 4213

Checks

DISA STIG (Manual Reference)

Open Windows explorer and search for all .NET config files including application config files (*.exe.config)

NOTE:
Beginning with Windows Vista and Windows Server 2008, ETW Tracing is enabled by default and the "etwEnable" setting is not required in order for Event Tracing to be enabled.  An etwEnable setting of "true" IS required in earlier versions of Windows as ETW is disabled by default. 

Examine the configuration settings for 
<etwEnable enabled="false" />.

If the "etwEnable" element is set to "true", this is not a finding.

If the "etwEnable" element is set to "false" and documented approvals by the IAO are not provided, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# oval:mil.disa.fso.dotnet:def:12 Event tracing for Windows (ETW) for Common Language Runtime events must be enabled
export LC_ALL=C
files=$(find / -type f -name "*.exe.config" 2>/dev/null)
if [ -z "$files" ]; then echo "PASS"; exit 0; fi
for file in $files; do
  grep -q '<etwEnable enabled="true" />' "$file" && continue || echo "FAIL" && exit 1
done
echo "PASS"
exit 0

Remediation

Open Windows explorer and search for all .NET config files including application config files (*.exe.config).

Examine the configuration settings for 
<etwEnable enabled="false" />.

Enable ETW Tracing by setting the etwEnable flag to "true" or obtain documented IAO approvals.