Skip to content

Fix martian sig #439

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jdval wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Fix martian sig #439

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8d7cba3
avoid errors with non-existant keys
jdval May 23, 2018
0550e4a
removed conditional for setting class variable
jdval May 23, 2018
31b7f3a
some small bugs in the martian sig
jdval Nov 20, 2018
0a111c1
Merge branch 'master' of github.com:cuckoosandbox/community
jdval Nov 20, 2018
316335b
some small bugs in the martian sig
jdval Nov 20, 2018
3f4c77d
Merge branch 'fix_martian_sig' of github.com:jdval/community into fix…
jdval Nov 20, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions modules/signatures/windows/martians.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ class ProcessMartian(Signature):
"\\\"C:\\\\\Program\\ Files(\\ \\(x86\\))?\\\\Internet\\ Explorer\\\\iexplore\\.exe\\\"\\ SCODEF:\\d+ CREDAT:\\d+",
"^[A-Z]\:\\Program Files(?:\s\(x86\))?\\Microsoft Office\\(?:Office1[1-5]\\)?(?:WINWORD|OUTLOOK|POWERPNT|EXCEL|WORDVIEW)\.EXE",
"C\\:\\\\Windows\\\\System32\\\\wscript\\.exe",
"C\\:\\\\Program Files(?:\s\\(x86\\))?\\\\Adobe\\\\Reader\\ \\d+\\.\\d+\\\\Reader\\\\AcroRd64\\.exe",
"C\\:\\\\Program Files(?:\s\\(x86\\))?\\\\Adobe\\\\Reader\\ \\d+\\.\\d+\\\\Reader\\\\AcroRd32\\.exe",
"C\\:\\\\Program Files(?:\s\\(x86\\))?\\\\Adobe\\\\Reader\\ \\d+\\.\\d+\\\\Reader\\\\AcroRd64\\.exe",
"C\\:\\\\Program Files(?:\s\\(x86\\))?\\\\Java\\\\jre\\d+\\\\bin\\\\j(?:avaw?|p2launcher)\\.exe",
"C\\:\\\\Program Files(?:\s\\(x86\\))?\\\\Microsoft SilverLight\\\\(?:\\d+\\.)+\\d\\\\agcp\\.exe",
Expand All @@ -58,7 +58,8 @@ class ProcessMartian(Signature):

def on_complete(self):
for process in self.get_results("behavior", {}).get("generic", []):
if process["process_name"].lower() not in self.whitelist_procs:
# Don't keep processing if the process_name is in the list of processes to whitelist
if process["process_name"].lower() in self.whitelist_procs:
continue

for cmdline in process.get("summary", {}).get("command_line", []):
Expand Down