Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed deleted.yaml #241

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fixed deleted.yaml #241

wants to merge 1 commit into from

Conversation

mnrkbys
Copy link

@mnrkbys mnrkbys commented Jun 25, 2024

Fixed "Find open files of (malicious) processes." in deleted.yaml
The default deleted.yaml will be recorded the following log entry in uac.log.

2024-06-25 14:30:17 +0900 COMMAND find /.list_open_file_descriptors.txt  \( -path "/sys" -o -path "/proc/sys/fs/binfmt_misc" -o -path "/home/john/Downloads/src/uac" -o -path "/tmp/uac-data.tmp" \) -prune -o   -type f     -print

However, "/.list_open_file_descriptors.txt" never exists.
As a result, "Collecting open files of (malicious) processes" never succeeds and the following log entry will be recorded in uac.log.stderr

file_collector: file list does not exist: '/tmp/uac-data.tmp/live_response/process/.open_file_descriptors.txt'

What do you think of the following modification to "Find open files of (malicious) processes."?
However, the paths to be excluded have not been implemented.

    description: Find open files of (malicious) processes.
    supported_os: [linux]
    collector: command
    foreach: cat "%destination_directory%/.list_open_file_descriptors.txt"
    command: find %line% -type f -print
    output_file: .open_file_descriptors.txt

Fixed "Find open files of (malicious) processes." in deleted.yaml
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant