tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[MALW-3280] added additional BitDefender process

This commit is contained in:
Michael Boelen 2020-06-24 08:09:12 +02:00
parent d61d7f5ab7
commit c707b7d100
No known key found for this signature in database
GPG Key ID: 26141F77A09D7F04
1 changed files with 22 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
include/tests_malware
View File

@ -102,28 +102,6 @@
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
# ESET security products
LogText "Test: checking process esets_daemon"
if IsRunning "esets_daemon"; then
FOUND=1
ESET_DAEMON_RUNNING=1
MALWARE_SCANNER_INSTALLED=1
if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} ESET daemon" --result "${STATUS_FOUND}" --color GREEN; fi
LogText "Result: found ESET security product"
Report "malware_scanner[]=eset"
fi
# Bitdefender (macOS)
LogText "Test: checking process epagd"
if IsRunning "epagd"; then
FOUND=1
BITDEFENDER_DAEMON_RUNNING=1
MALWARE_SCANNER_INSTALLED=1
if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} Bitdefender agent" --result "${STATUS_FOUND}" --color GREEN; fi
LogText "Result: found Bitdefender security product"
Report "malware_scanner[]=bitdefender"
fi
# Avast (macOS)
LogText "Test: checking process com.avast.daemon"
if IsRunning "com.avast.daemon"; then
@ -146,6 +124,17 @@
Report "malware_scanner[]=avira"
fi
# Bitdefender (macOS)
LogText "Test: checking process epagd"
if IsRunning "bdagentd" || IsRunning "epagd"; then
FOUND=1
BITDEFENDER_DAEMON_RUNNING=1
MALWARE_SCANNER_INSTALLED=1
if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} Bitdefender agent" --result "${STATUS_FOUND}" --color GREEN; fi
LogText "Result: found Bitdefender security product"
Report "malware_scanner[]=bitdefender"
fi
# CrowdStrike falcon-sensor
LogText "Test: checking process falcon-sensor (CrowdStrike)"
if IsRunning "falcon-sensor"; then
@ -168,6 +157,17 @@
Report "malware_scanner[]=cylance-protect"
fi
# ESET security products
LogText "Test: checking process esets_daemon"
if IsRunning "esets_daemon"; then
FOUND=1
ESET_DAEMON_RUNNING=1
MALWARE_SCANNER_INSTALLED=1
if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} ESET daemon" --result "${STATUS_FOUND}" --color GREEN; fi
LogText "Result: found ESET security product"
Report "malware_scanner[]=eset"
fi
# Kaspersky products
LogText "Test: checking process wdserver or klnagent (Kaspersky)"
# wdserver is too generic to match on, so we want to ensure that it is related to Kaspersky first