From 47219aad67283653b482eccb69d18b6aa8300748 Mon Sep 17 00:00:00 2001 From: blitztide Date: Fri, 29 Aug 2025 03:06:23 +0100 Subject: [PATCH] Feature: vadyarascan enrichment This add contextual data to each hit with vadyarascan, saves running pslist after processing. Original didn't have imagename or PPID --- .../framework/plugins/windows/vadyarascan.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 04b9aadd9..452a2f774 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -4,6 +4,7 @@ import logging from typing import Iterable, List, Tuple +import datetime from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements @@ -102,6 +103,15 @@ class VadYaraScan(interfaces.plugins.PluginInterface): yield 0, ( format_hints.Hex(offset), task.UniqueProcessId, + task.get_create_time(), + task.InheritedFromUniqueProcessId, + task.ImageFileName.cast( + "string", + max_length=task.ImageFileName.vol.count, + errors="replace", + ), + task.get_session_id(), + task.ActiveThreads, rule_name, name, layer_data, @@ -130,6 +140,11 @@ class VadYaraScan(interfaces.plugins.PluginInterface): [ ("Offset", format_hints.Hex), ("PID", int), + ("CreateTime", datetime.datetime), + ("PPID", int), + ("ImageFileName", str), + ("SessionId", int), + ("Threads", int), ("Rule", str), ("Component", str), ("Value", renderers.LayerData),