WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 03:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

remove notes

Browse Source
This commit is contained in:
SolitudePy
2025-09-17 02:02:14 +03:00
parent 4adc3305a3
commit 32def71eb5
1 changed files with 16 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/malware/pebmasquerade.py
+16 -70
View File
@@ -225,14 +225,14 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
"Unable to access PEB for PID %d, skipping process", proc_id
)
notes = []
peb_imagefilepath_length_check = False
peb_cmdline_length_check = False
(
eprocess_imagefilename,
eprocess_seaudit_imagefilename,
peb_imagefilepath,
peb_cmdline,
) = self.get_process_names(proc)
proc_name_for_row = eprocess_imagefilename
# Extract command line executable path for rendering
peb_cmdline_path_render = renderers.NotAvailableValue()
@@ -248,63 +248,6 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
str(e),
)
# Populate notes for enrichment
if isinstance(eprocess_imagefilename, str) and isinstance(
peb_imagefilepath, str
):
try:
peb_imagefilepath_basename = PureWindowsPath(peb_imagefilepath).name
peb_imagefilepath_truncated = peb_imagefilepath_basename[:14]
# Compare EPROCESS.ImageFileName with PEB.ImageFilePath truncated to 15 characters
if (
eprocess_imagefilename.lower()
!= peb_imagefilepath_truncated.lower()
):
notes.append(
f"'Potential PEB.ImageFilePath Spoofing: EPROCESS={eprocess_imagefilename};PEB={peb_imagefilepath_truncated}'"
)
except Exception as e:
notes.append(f"ImageFilePath Comparison error: {str(e)[:30]}")
if isinstance(eprocess_imagefilename, str) and isinstance(peb_cmdline, str):
try:
# Compare EPROCESS.ImageFileName with PEB.CommandLine executable path truncated to 15 characters
peb_cmdline_path = PebMasquerade._get_cmdline_image(peb_cmdline)
if isinstance(peb_cmdline_path, PureWindowsPath):
peb_cmdline_path = peb_cmdline_path.name
peb_cmdline_basename_truncated = peb_cmdline_path[:14]
if (
eprocess_imagefilename.lower()
!= peb_cmdline_basename_truncated.lower()
):
notes.append(
f"'Potential PEB.CommandLine Spoofing: EPROCESS={eprocess_imagefilename};PEB={peb_cmdline_basename_truncated}'"
)
except Exception as e:
notes.append(f"CommandLine comparison error: {str(e)}")
if isinstance(eprocess_seaudit_imagefilename, str) and isinstance(
peb_imagefilepath, str
):
try:
(
are_equal,
eprocess_seaudit_normalized,
peb_imagefilepath_normalized,
) = PebMasquerade._are_paths_equal(
device_path=eprocess_seaudit_imagefilename,
drive_path=peb_imagefilepath,
)
if not are_equal:
notes.append(
f"'Potential PEB.ImageFilePath Spoofing (via _EPROCESS.SeAuditProcessCreationInfo): EPROCESS={eprocess_seaudit_normalized};PEB={peb_imagefilepath_normalized}'"
)
except Exception as e:
notes.append(
f"SeAuditProcessCreationInfo comparison error: {str(e)[:30]}"
)
if isinstance(peb_imagefilepath, str) and peb:
try:
@@ -319,12 +262,12 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
if (peb_imagefilepath_length != len(peb_imagefilepath)) or (
peb_imagefilepath_maxlength != len(peb_imagefilepath)
):
notes.append(
f"'PEB.ImageFilePath Length Mismatch: Length={peb_imagefilepath_length}, MaximumLength={peb_imagefilepath_maxlength}, Actual={len(peb_imagefilepath)}'"
)
peb_imagefilepath_length_check = True
except Exception as e:
notes.append(
f"PEB.ImageFilePath Length comparison error: {str(e)[:30]}"
vollog.warning(
"PEB.ImagePathName Length comparison error for PID %d: %s",
proc_id,
str(e),
)
if isinstance(peb_cmdline, str) and peb:
@@ -338,23 +281,26 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
if (peb_cmdline_length != len(peb_cmdline)) or (
peb_cmdline_maxlength != len(peb_cmdline)
):
peb_cmdline_length_check = True
notes.append(
f"'PEB.CommandLine Length Mismatch: Commandline={peb_cmdline}, Length={peb_cmdline_length}, MaximumLength={peb_cmdline_maxlength}, Actual={len(peb_cmdline)}'"
)
except Exception as e:
notes.append(
f"PEB.CommandLine Length comparison error: {str(e)[:30]}"
vollog.warning(
"PEB.CommandLine Length comparison error for PID %d: %s",
proc_id,
str(e),
)
yield (
0,
(
proc_id,
proc_name_for_row,
eprocess_imagefilename,
eprocess_seaudit_imagefilename,
peb_imagefilepath,
peb_cmdline_path_render,
"[" + ", ".join(notes) + "]" if notes else "OK",
peb_cmdline_length_check,
peb_imagefilepath_length_check,
),
)
@@ -365,12 +311,12 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
return renderers.TreeGrid(
[
("PID", int),
("ProcessName", str),
("EPROCESS_ImageFileName", str),
("EPROCESS_SeAudit_ImageFileName", str),
("PEB_ImageFilePath", str),
("PEB_CommandLine_Path", str),
("Notes", str),
("PEB_ImageFilePath_Spoofed", bool),
("PEB_CommandLine_Spoofed", bool),
],
self._generator(pids, context, kernel_module_name),
)