diff options
author | mboelen <michael@cisofy.com> | 2014-08-26 19:33:55 +0400 |
---|---|---|
committer | mboelen <michael@cisofy.com> | 2014-08-26 19:33:55 +0400 |
commit | c0ae2e217b7f1fb0171017ce5afb8eb8898470db (patch) | |
tree | 545aa150c35c5fb74d7bb4c2d3b0ae41cfa7b4e5 /include/tests_malware |
Initial import
Diffstat (limited to 'include/tests_malware')
-rw-r--r-- | include/tests_malware | 185 |
1 files changed, 185 insertions, 0 deletions
diff --git a/include/tests_malware b/include/tests_malware new file mode 100644 index 00000000..d613829c --- /dev/null +++ b/include/tests_malware @@ -0,0 +1,185 @@ +#!/bin/sh + +################################################################################# +# +# Lynis +# ------------------ +# +# Copyright 2007-2014, Michael Boelen (michael@rootkit.nl), The Netherlands +# Web site: http://www.rootkit.nl +# +# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are +# welcome to redistribute it under the terms of the GNU General Public License. +# See LICENSE file for usage of this software. +# +################################################################################# +# +# Malware scanners +# +################################################################################# +# + InsertSection "Software: Malware scanners" +# +################################################################################# +# + CLAMD_RUNNING=0 + MALWARE_SCANNER_INSTALLED=0 +# +################################################################################# +# + # Test : MALW-3275 + # Description : Check for installed tool (chkrootkit) + Register --test-no MALW-3275 --weight L --network NO --description "Check for chkrootkit" + if [ ${SKIPTEST} -eq 0 ]; then + logtext "Test: checking presence chkrootkit" + if [ ! "${CHKROOTKITBINARY}" = "" ]; then + Display --indent 2 --text "- Checking chkrootkit..." --result "FOUND" --color GREEN + logtext "Result: Found ${CHKROOTKITBINARY}" + MALWARE_SCANNER_INSTALLED=1 + AddHP 2 2 + else + Display --indent 2 --text "- Checking chkrootkit..." --result "NOT FOUND" --color WHITE + logtext "Result: chkrootkit not found" + fi + fi +# +################################################################################# +# + # Test : MALW-3276 + # Description : Check for installed tool (Rootkit Hunter) + Register --test-no MALW-3276 --weight L --network NO --description "Check for Rootkit Hunter" + if [ ${SKIPTEST} -eq 0 ]; then + logtext "Test: checking presence Rootkit Hunter" + if [ ! "${RKHUNTERBINARY}" = "" ]; then + Display --indent 2 --text "- Checking Rootkit Hunter..." --result "FOUND" --color GREEN + logtext "Result: Found ${RKHUNTERBINARY}" + MALWARE_SCANNER_INSTALLED=1 + AddHP 2 2 + else + Display --indent 2 --text "- Checking Rootkit Hunter..." --result "NOT FOUND" --color WHITE + logtext "Result: Rootkit Hunter not found" + fi + fi +# +################################################################################# +# + # Test : MALW-3280 + # Description : Check if an anti-virus tool is installed + Register --test-no MALW-3280 --weight L --network NO --description "Check for clamscan" + if [ ${SKIPTEST} -eq 0 ]; then + FOUND=0 + logtext "Test: checking process cmdagent (McAfee)" + IsRunning cmdagent + if [ ${RUNNING} -eq 1 ]; then + FOUND=1 + Display --indent 2 --text "- Checking McAfee" --result "FOUND" --color GREEN + logtext "Result: Found McAfee" + MALWARE_SCANNER_INSTALLED=1 + AddHP 2 2 + fi + logtext "Test: checking process SophosScanD" + IsRunning SophosScanD + if [ ${RUNNING} -eq 1 ]; then + FOUND=1 + Display --indent 2 --text "- Checking Sophos" --result "FOUND" --color GREEN + logtext "Result: Found Sophos" + MALWARE_SCANNER_INSTALLED=1 + AddHP 2 2 + fi + if [ ${FOUND} -eq 0 ]; then + Display --indent 2 --text "- Checking commercial anti-virus scanners" --result "NONE FOUND" --color WHITE + logtext "Result: no commercial anti-virus tool found" + AddHP 0 3 + fi + fi +# +################################################################################# +# + # Test : MALW-3282 + # Description : Check if clamscan is installed + Register --test-no MALW-3282 --weight L --network NO --description "Check for clamscan" + if [ ${SKIPTEST} -eq 0 ]; then + logtext "Test: checking presence clamscan" + if [ ! "${CLAMSCANBINARY}" = "" ]; then + Display --indent 2 --text "- Checking ClamAV scanner..." --result "FOUND" --color GREEN + logtext "Result: Found ${CLAMSCANBINARY}" + MALWARE_SCANNER_INSTALLED=1 + AddHP 2 2 + else + Display --indent 2 --text "- Checking ClamAV scanner..." --result "NOT FOUND" --color WHITE + logtext "Result: clamscan couldn't be found" + fi + fi + +# +################################################################################# +# + # Test : MALW-3284 + # Description : Check running clamd process + Register --test-no MALW-3284 --weight L --network NO --description "Check for clamd" + if [ ${SKIPTEST} -eq 0 ]; then + logtext "Test: checking running ClamAV daemon (clamd)" + FIND=`${PSBINARY} ax | grep "/clamd" | grep -v "grep"` + if [ ! "${FIND}" = "" ]; then + Display --indent 2 --text "- Checking ClamAV daemon..." --result "FOUND" --color GREEN + logtext "Result: found running clamd process" + MALWARE_SCANNER_INSTALLED=1 + CLAMD_RUNNING=1 + else + Display --indent 2 --text "- Checking ClamAV daemon..." --result "NOT FOUND" --color WHITE + logtext "Result: clamd not running" + fi + fi +# +################################################################################# +# + # Test : MALW-3286 + # Description : Check running freshclam if clamd process is running + if [ ${CLAMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi + Register --test-no MALW-3286 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for freshclam" + if [ ${SKIPTEST} -eq 0 ]; then + logtext "Test: checking running freshclam daemon" + FIND=`${PSBINARY} ax | grep "/freshclam" | grep -v "grep"` + if [ ! "${FIND}" = "" ]; then + Display --indent 4 --text "- Checking freshclam..." --result "FOUND" --color GREEN + logtext "Result: found running freshclam process" + AddHP 2 2 + else + Display --indent 4 --text "- Checking freshclam..." --result "SUGGESTION" --color YELLOW + logtext "Result: freshclam is not running" + ReportSuggestion ${TEST_NO} "Confirm that freshclam is properly configured and keeps updating the ClamAV database" + fi + fi +# +################################################################################# +# + # Test : MALW-3292 + # Description : Check if at least one malware scanner is installed +# Register --test-no MALW-3292 --weight L --network NO --description "Check for at least one malware scanner" +# if [ ${SKIPTEST} -eq 0 ]; then +# if [ ${MALWARE_SCANNER_INSTALLED} -eq 1 ]; then +# logtext "Result: At least one malware scanner is installed" +# Display --indent 2 --text "- Checking presence malware scanner..." --result "FOUND" --color GREEN +# #AddHP 3 3 +# else +# logtext "Result: No malware scanners found" +# Display --indent 2 --text "- Checking presence malware scanner..." --result "NOT FOUND" --color YELLOW +# ReportSuggestion ${TEST_NO} "Install at least one malware scanner to perform periodic integrity tests on the system" +# #AddHP 0 3 +# fi +# fi +# +################################################################################# +# +# Other projects: maldetect (rfxn) +# +################################################################################# +# + +report "malware_scanner_installed=${MALWARE_SCANNER_INSTALLED}" + +wait_for_keypress + +# +#================================================================================ +# Lynis - Copyright 2007-2014, Michael Boelen - www.rootkit.nl - The Netherlands |