From 5c3fca35447247c0d59c814682ae95952fc1067a Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 4 Jun 2025 21:10:11 +0300 Subject: [PATCH] added mechanism for deleted exe --- .../framework/plugins/linux/process_spoofing.py | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/process_spoofing.py b/volatility3/framework/plugins/linux/process_spoofing.py index 9d2e55acb..451889029 100644 --- a/volatility3/framework/plugins/linux/process_spoofing.py +++ b/volatility3/framework/plugins/linux/process_spoofing.py @@ -21,7 +21,8 @@ class ProcessSpoofing(plugins.PluginInterface): """Detects process spoofing by comparing executable path to cmdline & comm fields""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 1, 0) + deleted = " (deleted)" @classmethod def get_requirements(cls): @@ -64,10 +65,17 @@ class ProcessSpoofing(plugins.PluginInterface): return None exe_file = mm.exe_file + if not exe_file or not exe_file.is_readable(): return None + + exe_inode = exe_file.dereference().f_path.dentry.d_inode exe_path = linux.LinuxUtilities.path_for_file(self.context, task, exe_file) + # If the inode link count is 0, the process image has been deleted + if exe_inode.i_nlink == 0: + exe_path += self.deleted + return exe_path if exe_path else None except (exceptions.InvalidAddressException, AttributeError): @@ -176,6 +184,11 @@ class ProcessSpoofing(plugins.PluginInterface): 1 for name in [exe_basename, cmdline_basename, comm] if name ) + is_deleted = exe_basename.endswith(self.deleted) + if is_deleted: + notes.append(f"'Potential Process image deletion: exe_file={exe_basename}'") + exe_basename = exe_basename[: len(self.deleted) * -1] + if available_sources < 2: return None