diff options
author | mboelen <michael@cisofy.com> | 2015-09-28 12:00:34 +0300 |
---|---|---|
committer | mboelen <michael@cisofy.com> | 2015-09-28 12:00:34 +0300 |
commit | cf11b95c3f62ec36b87ee194f31cf0b43e53b39b (patch) | |
tree | 494b157a32807239e7c438d4436fbbe9928c6393 /include/tests_malware | |
parent | c127b9beb3db64b8a59cf838e23b0d3e61047f0a (diff) |
Added detection of ESET products and logging of malware scanner to report
Diffstat (limited to 'include/tests_malware')
-rw-r--r-- | include/tests_malware | 40 |
1 files changed, 37 insertions, 3 deletions
diff --git a/include/tests_malware b/include/tests_malware index 5903826b..b9d4c0e8 100644 --- a/include/tests_malware +++ b/include/tests_malware @@ -23,6 +23,9 @@ ################################################################################# # CLAMD_RUNNING=0 + CLAMSCAN_INSTALLED=0 + ESET_DAEMON_RUNNING=0 + FRESHCLAM_DAEMON_RUNNING=0 MCAFEE_SCANNER_RUNNING=0 MALWARE_SCANNER_INSTALLED=0 SOPHOS_SCANNER_RUNNING=0 @@ -39,6 +42,7 @@ logtext "Result: Found ${CHKROOTKITBINARY}" MALWARE_SCANNER_INSTALLED=1 AddHP 2 2 + report "malware_scanner[]=chkrootkit" else logtext "Result: chkrootkit not found" fi @@ -56,6 +60,7 @@ logtext "Result: Found ${RKHUNTERBINARY}" MALWARE_SCANNER_INSTALLED=1 AddHP 2 2 + report "malware_scanner[]=rkhunter" else logtext "Result: Rootkit Hunter not found" fi @@ -73,6 +78,7 @@ logtext "Result: Found ${LMDBINARY}" MALWARE_SCANNER_INSTALLED=1 AddHP 2 2 + report "malware_scanner[]=lmd" else logtext "Result: LMD not found" fi @@ -85,6 +91,21 @@ Register --test-no MALW-3280 --weight L --network NO --description "Check if anti-virus tool is installed" if [ ${SKIPTEST} -eq 0 ]; then FOUND=0 + + # ESET security products + logtext "Test: checking process esets_daemon" + IsRunning esets_daemon + if [ ${RUNNING} -eq 1 ]; then + FOUND=1 + Display --indent 2 --text "- Checking ESET daemon" --result "FOUND" --color GREEN + logtext "Result: found ESET security product" + ESET_DAEMON_RUNNING=1 + MALWARE_SCANNER_INSTALLED=1 + AddHP 2 2 + report "malware_scanner[]=eset" + fi + + # McAfee products logtext "Test: checking process cma or cmdagent (McAfee)" # cma is too generic to match on, so we want to ensure that it is related to McAfee first if [ -x /opt/McAfee/cma/bin/cma ]; then @@ -100,28 +121,31 @@ logtext "Result: Found McAfee" MALWARE_SCANNER_INSTALLED=1 AddHP 2 2 + report "malware_scanner[]=mcafee" + fi # Sophos savscand/SophosScanD logtext "Test: checking process savscand" IsRunning savscand if [ ${RUNNING} -eq 1 ]; then FOUND=1 - SOPHOS_SCANNER_RUNNING=1; + SOPHOS_SCANNER_RUNNING=1 fi logtext "Test: checking process SophosScanD" IsRunning SophosScanD if [ ${RUNNING} -eq 1 ]; then FOUND=1 - SOPHOS_SCANNER_RUNNING=1; + SOPHOS_SCANNER_RUNNING=1 fi if [ ${SOPHOS_SCANNER_RUNNING} -eq 1 ]; then Display --indent 2 --text "- Checking Sophos" --result "FOUND" --color GREEN logtext "Result: Found Sophos" MALWARE_SCANNER_INSTALLED=1 AddHP 2 2 + report "malware_scanner[]=sophos" fi if [ ${FOUND} -eq 0 ]; then - logtext "Result: no commercial anti-virus tool found" + logtext "Result: no commercial anti-virus tools found" AddHP 0 3 fi fi @@ -137,6 +161,7 @@ Display --indent 2 --text "- Checking ClamAV scanner" --result "FOUND" --color GREEN logtext "Result: Found ${CLAMSCANBINARY}" MALWARE_SCANNER_INSTALLED=1 + CLAMSCAN_INSTALLED=1 AddHP 2 2 else logtext "Result: clamscan couldn't be found" @@ -171,6 +196,7 @@ logtext "Test: checking running freshclam daemon" IsRunning freshclam if [ ${RUNNING} -eq 1 ]; then + FRESHCLAM_DAEMON_RUNNING=1 Display --indent 4 --text "- Checking freshclam" --result "FOUND" --color GREEN logtext "Result: found running freshclam process" AddHP 2 2 @@ -193,6 +219,7 @@ logtext "Result: Found ClamXav clamscan installed" Display --indent 2 --text "- Checking presence of ClamXav AV scanner" --result "FOUND" --color GREEN MALWARE_SCANNER_INSTALLED=1 + CLAMSCAN_INSTALLED=1 AddHP 3 3 else logtext "Result: ClamXav malware scanner not found" @@ -202,6 +229,13 @@ # ################################################################################# # + # Check if we found any of the ClamAV components + if [ ${CLAMSCAN_INSTALLED} -eq 1 -o ${CLAMD_RUNNING} -eq 1 -o ${FRESHCLAM_DAEMON_RUNNING} -eq 1 ]; then + report "malware_scanner[]=clamav" + fi +# +################################################################################# +# report "malware_scanner_installed=${MALWARE_SCANNER_INSTALLED}" |