Add Acronis Cyber Protect detection - #19
Open
xuanxuan0 wants to merge 1 commit into
Open
Conversation
Adds Acronis identifiers to the master EdrList (needed for the process/service/driver scan to flag Acronis binaries as suspicious at all), plus a dedicated scanner following the existing per-vendor pattern so a hit gets attributed to "Acronis Cyber Protect" by name in scan output, same as the other vendors here. Identifiers are from Acronis's own KB docs on Cyber Protect's processes/services, and Microsoft's filter-altitude doc for the driver names.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Acronis Cyber Protect isn't detected currently. This adds it in two places, matching how the rest of the tool works:
EdrList(edrdata.go), since the process/service/driver scan only flags something as suspicious if it hits that list first.scan_acronis.gofollowing the same pattern as the other vendor files (e.g.scan_cortexxdr.go), plus theAcronisEDRtype and registering it inScanners, so a hit gets reported as "Acronis Cyber Protect" by name inedrhunt scaninstead of showing up unattributed.Identifiers come from Acronis's own KB docs on Cyber Protect's processes/services, and Microsoft's filter-altitude doc for the driver names.
Cross-compiled for Windows (
GOOS=windows GOARCH=amd64 go build ./...) and it builds clean,go veton the touched packages is clean too, andgofmt -ldoesn't flag the new file.