From 64e18870b325024cec084bd2694b8dd1850e08a6 Mon Sep 17 00:00:00 2001
From: Filip Olszak <filip.olszak@acronis.com>
Date: Fri, 17 Jul 2026 20:22:32 +0800
Subject: [PATCH] Add Acronis Cyber Protect detection

Adds Acronis identifiers to the master EdrList (needed for the
process/service/driver scan to flag Acronis binaries as suspicious
at all), plus a dedicated scanner following the existing per-vendor
pattern so a hit gets attributed to "Acronis Cyber Protect" by name
in scan output, same as the other vendors here.

Identifiers are from Acronis's own KB docs on Cyber Protect's
processes/services, and Microsoft's filter-altitude doc for the
driver names.
---
 pkg/edrRecon/edrdata.go      | 10 ++++++++++
 pkg/resources/scan_edr.go    |  1 +
 pkg/scanners/scan_acronis.go | 30 ++++++++++++++++++++++++++++++
 pkg/scanners/scanner.go      |  1 +
 4 files changed, 42 insertions(+)
 create mode 100644 pkg/scanners/scan_acronis.go

diff --git a/pkg/edrRecon/edrdata.go b/pkg/edrRecon/edrdata.go
index c15fd0e..9db7468 100644
--- a/pkg/edrRecon/edrdata.go
+++ b/pkg/edrRecon/edrdata.go
@@ -888,6 +888,16 @@ var EdrList = []string{
 	"hlprotect.sys",
 	"cyserver.exe",
 	"Cortex XDR",
+	"Acronis",
+	"cyber-protect-service.exe",
+	"aakore.exe",
+	"anti_ransomware_service.exe",
+	"AcronisCyberProtectionService",
+	"AcronisActiveProtectionService",
+	"C:\\Program Files\\Acronis",
+	"fltsrv.sys",
+	"snapman.sys",
+	"tdrpman.sys",
 }
 
 var ReconList = []string{
diff --git a/pkg/resources/scan_edr.go b/pkg/resources/scan_edr.go
index 0eb8fd6..fe1802f 100644
--- a/pkg/resources/scan_edr.go
+++ b/pkg/resources/scan_edr.go
@@ -33,4 +33,5 @@ var (
 	LimacharlieEDR  EDRType = "limacharlie"
 	HarfangLabEDR   EDRType = "harfanglab"
 	CortexXDREDR    EDRType = "cortex_xdr"
+	AcronisEDR      EDRType = "acronis"
 )
diff --git a/pkg/scanners/scan_acronis.go b/pkg/scanners/scan_acronis.go
new file mode 100644
index 0000000..1627a9e
--- /dev/null
+++ b/pkg/scanners/scan_acronis.go
@@ -0,0 +1,30 @@
+package scanners
+
+import "github.com/fourcorelabs/edrhunt/pkg/resources"
+
+type AcronisDetection struct{}
+
+func (w *AcronisDetection) Name() string {
+	return "Acronis Cyber Protect"
+}
+
+func (w *AcronisDetection) Type() resources.EDRType {
+	return resources.AcronisEDR
+}
+
+var AcronisHeuristic = []string{
+	"cyber-protect-service.exe",
+	"aakore.exe",
+	"AcronisCyberProtectionService",
+	"AcronisActiveProtectionService",
+	"C:\\Program Files\\Acronis",
+}
+
+func (w *AcronisDetection) Detect(data resources.SystemData) (resources.EDRType, bool) {
+	_, ok := data.CountMatchesAll(AcronisHeuristic)
+	if !ok {
+		return "", false
+	}
+
+	return resources.AcronisEDR, true
+}
diff --git a/pkg/scanners/scanner.go b/pkg/scanners/scanner.go
index f34ae8d..72e31fb 100644
--- a/pkg/scanners/scanner.go
+++ b/pkg/scanners/scanner.go
@@ -28,5 +28,6 @@ var (
 		&MalwareBytesDetection{},
 		&LimacharlieDetection{},
 		&CortexXDRDetection{},
+		&AcronisDetection{},
 	}
 )