Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed deleted.yaml #241

Merged
merged 2 commits into from
Jul 3, 2024
Merged

Fixed deleted.yaml #241

merged 2 commits into from
Jul 3, 2024

Conversation

mnrkbys
Copy link

@mnrkbys mnrkbys commented Jun 25, 2024

Fixed "Find open files of (malicious) processes." in deleted.yaml
The default deleted.yaml will be recorded the following log entry in uac.log.

2024-06-25 14:30:17 +0900 COMMAND find /.list_open_file_descriptors.txt  \( -path "/sys" -o -path "/proc/sys/fs/binfmt_misc" -o -path "/home/john/Downloads/src/uac" -o -path "/tmp/uac-data.tmp" \) -prune -o   -type f     -print

However, "/.list_open_file_descriptors.txt" never exists.
As a result, "Collecting open files of (malicious) processes" never succeeds and the following log entry will be recorded in uac.log.stderr

file_collector: file list does not exist: '/tmp/uac-data.tmp/live_response/process/.open_file_descriptors.txt'

What do you think of the following modification to "Find open files of (malicious) processes."?
However, the paths to be excluded have not been implemented.

    description: Find open files of (malicious) processes.
    supported_os: [linux]
    collector: command
    foreach: cat "%destination_directory%/.list_open_file_descriptors.txt"
    command: find %line% -type f -print
    output_file: .open_file_descriptors.txt

tclahr and others added 2 commits June 13, 2024 08:08
Fixed "Find open files of (malicious) processes." in deleted.yaml
@tclahr tclahr changed the base branch from main to develop June 29, 2024 11:22
@tclahr
Copy link
Owner

tclahr commented Jul 3, 2024

I will merge it into develop branch. Also, I will push a new code today (uac v3) that will also have the fix.
Can you download the develop branch and test it again, please? Thanks!

@tclahr tclahr merged commit 72bfa92 into tclahr:develop Jul 3, 2024
1 check passed
@mnrkbys
Copy link
Author

mnrkbys commented Jul 4, 2024

Thanks!
I have confirmed the develop branch works well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants