I highlighted my question below. Here is some background. 

It's easy to find data showing the most commonly trojaned/modified Linux binaries and config files. ps, ls, find, kill, lsof, passwd, shadow, syslog.conf, etc. are all frequently changed after a system has been compromised. It's also easy to monitor utmp and wtmp to be alerted when a user logs onto a Linux system or when someone reboots the system.

Windows seems to be much more of a black box and more difficult in general to monitor. Part of this is due to the registry and lack of plain-text configuration files while part of it seems due to the closed-source, undocumented nature of Windows. And when I say, 'monitor' I mean know in real time that a file has changed through alerting (not logging). Send me an alert via sms, email, etc when X executable changes or when the local SAM file changes or when a virus reboots the system to install an infected MBR. And really, integrity monitoring is easy, the difficult part is *knowing what files on Windows should be monitored*. We can't monitor and alert on all files.

**Is there an official list of commonly trojaned/modified Windows files that should be monitored by a HIDS?**