Add Acronis Cyber Protect detection

pkg/edrRecon/edrdata.go

@@ -888,6 +888,16 @@ var EdrList = []string{
 	"hlprotect.sys",
 	"cyserver.exe",
 	"Cortex XDR",
+	"Acronis",
+	"cyber-protect-service.exe",
+	"aakore.exe",
+	"anti_ransomware_service.exe",
+	"AcronisCyberProtectionService",
+	"AcronisActiveProtectionService",
+	"C:\\Program Files\\Acronis",
+	"fltsrv.sys",
+	"snapman.sys",
+	"tdrpman.sys",
 }
 
 var ReconList = []string{

pkg/resources/scan_edr.go

@@ -33,4 +33,5 @@ var (
 	LimacharlieEDR  EDRType = "limacharlie"
 	HarfangLabEDR   EDRType = "harfanglab"
 	CortexXDREDR    EDRType = "cortex_xdr"
+	AcronisEDR      EDRType = "acronis"
 )

pkg/scanners/scan_acronis.go

@@ -0,0 +1,30 @@
+package scanners
+
+import "github.com/fourcorelabs/edrhunt/pkg/resources"
+
+type AcronisDetection struct{}
+
+func (w *AcronisDetection) Name() string {
+	return "Acronis Cyber Protect"
+}
+
+func (w *AcronisDetection) Type() resources.EDRType {
+	return resources.AcronisEDR
+}
+
+var AcronisHeuristic = []string{
+	"cyber-protect-service.exe",
+	"aakore.exe",
+	"AcronisCyberProtectionService",
+	"AcronisActiveProtectionService",
+	"C:\\Program Files\\Acronis",
+}
+
+func (w *AcronisDetection) Detect(data resources.SystemData) (resources.EDRType, bool) {
+	_, ok := data.CountMatchesAll(AcronisHeuristic)
+	if !ok {
+		return "", false
+	}
+
+	return resources.AcronisEDR, true
+}

pkg/scanners/scanner.go

@@ -28,5 +28,6 @@ var (
 		&MalwareBytesDetection{},
 		&LimacharlieDetection{},
 		&CortexXDRDetection{},
+		&AcronisDetection{},
 	}
 )