Viewing File: /opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/__pycache__/model.cpython-311.pyc
sjr d Z ddlmZ ddlZddlZddlZddlZddlZddlm Z ddl
m Z ddlm Z ddl
mZ ddlmZ dd lmZmZmZmZmZmZmZ dd
lmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z% dd l&m'Z' dd l(m)Z) dd
l*m+Z+m,Z, ddl-m.Z.m/Z/m0Z0 ddl1m2Z2m3Z3m4Z4m5Z5 ddl6m7Z7 ddl8m9Z9m:Z:m;Z;m<Z<m=Z= ddl>m?Z? ddl@mAZA ddlBmCZC G d de+ ZD G d de+ ZE e d G d d ZF G d d e+ ZG G d d e+ ZH G d! d"e+ ZI G d# d$e+ ZJd%ZKd&ZLd'ZMeKeLfZN G d( d)e+ ZO G d* d+e+ ZPdS ),u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see <https://www.imunify360.com/legal/eula>
) annotationsN) dataclass)reduce)
attrgetter)Path)time)AnyDictIterableListSetTuplecast)
SQL BooleanFieldCase CharFieldCheck
Expression
FloatFieldForeignKeyField IntegerField ModelSelectPrimaryKeyField TextFieldfn
model_to_dict)UserType)Modelinstance)
FilenameField
ScanPathFieldapply_order_by)execute_iterable_expressionget_abspath_from_user_dir get_results_iterable_expressionsplit_for_chunk)RemoteRevertHitInfo)FAILED_TO_CLEANUPMalwareHitStatusMalwareScanResourceTypeMalwareScanTypeVulnerabilityHitStatus) get_crontab)MalwareDatabaseHitInfo)sqlite_max_variable_numberc ~ e Zd ZdZ G d d Z ed Z ed Z ed Z ed e
d e j
e j e j e j e j e j e j f g Z edd
Z edd Z edd
Z edd
Z ed e
d ej j ej j f g Z ed Z edd Z!e" de j
e j e j fd
dd Z#d
S ) MalwareScanzRepresents a batch of files scanned for malware
Usually a single AI-BOLIT execution.
See :class:`.MalwareScanType` for possible kinds of scans.
c e Zd Zej ZdZdS )MalwareScan.Meta
malware_scansN__name__
__module__ __qualname__r! dbdatabasedb_table J/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/model.pyMetar5 V s ;"r? rA T primary_keyFnullz
type in {}rE constraintsr rE default Nresource_type in {}c 8 t t S Nintr r> r? r@ <lambda>zMalwareScan.<lambda> s TVV r? )typespathsc v | | j | j | j | j | j | j | j | j d | j
| j | | j |k | j |k }|r-| | j | }|
| j | j | j | j t j | | }|t' || | }| d t+ | fS )N scan_typeT clear_limit)selecttotal_resourcespathscanidstarted completederrortotal_malicioustypealias
resource_typewherein_group_byorder_byr3 desclimitoffsetr$ countlistdicts) clssincetorg rh re rQ rR querys r@
ondemand_listzMalwareScan.ondemand_list sd "
JJ#
#{++!
U38<<&&
'
'
U3;%'
(
(
U3;"$
%
% " 5KK U 3 344E
NN#SXsz3;
Xk)..00
1
1
U5\\
VF^^
"8S%88E{{t{,,d5;;==.A.AAAr? rM )$r8 r9 r: __doc__rA r rZ r r[ r\ r formatr- ON_DEMANDREALTIMEMALWARE_RESPONSE
BACKGROUNDRESCANUSERRESCAN_OUTDATEDr_ rX r# rY r r] r^ r, DBvalueFILEra initiator timestamp classmethodrp r> r? r@ r3 r3 O s # # # # # # # #
Y4
(
(
(Fl&&&G $'''I 9
E ##'1'0'8'2'.','7
D& #lq999O =dB / / /D
I4 . . .E"lq999O I
E%,,/28/4:
M t$$$I %1D1DEEEI
/B
% &
/B /B /B /B [/B /B /Br? r3 c " e Zd ZdZ G d d Z e Z eeddd Z e
d Z e
d Z e
d Z e
d Z edd Z e
d
Z e
d
Z ed
Z e
ej Z ed
Z e
d ed e j j e j j f g
Z e
d
Z! e
d
Z" e
d
Z# e
d
Z$ e
d
Z%e&dDd Z'e&d Z( G d d Z)e* dEdFd Z+e* dGd Z,e*dHd Z-e*ddd Z.e*dId Z/e*dHd Z0e*dJd Z1e*dKd" Z2e*dLd$ Z3e*d% Z4e* dMd& Z5e*dd'd( Z6e*dNd+ Z7e*dOd- Z8e*d. Z9d/ Z:e*dPdQd1 Z;e*dRd4 Z<e*dSd6 Z=e*dSd7 Z>e*dSd8 Z?e*dSd9 Z@e*d: ZAe*d; ZBe*d< ZCeDdTdA ZEdB ZFdC ZGdS )U
MalwareHitz*Represents a malicious or suspicious file.c e Zd Zej ZdZdS )MalwareHit.Meta malware_hitsNr7 r> r? r@ rA r s ;!r? rA FhitsCASCADErE related_name on_deleterD rH TrI rK rF returnstrc 6 t t | j S rM )r r r_ selfs r@ signature_idzMalwareHit.signature_id s C###r? c T t t | j }t | S rM r r orig_filer r r s r@ orig_file_pathzMalwareHit.orig_file_path dn-- I r? c $ e Zd Zed ZdS )MalwareHit.OrderByc t t j t j dft j dft j dft j dft j dffd fS )Nr d ) r r statusr+ CLEANUP_PENDINGCLEANUP_STARTEDFOUND CLEANUP_DONECLEANUP_REMOVEDr> r? r@ r zMalwareHit.OrderBy.status
sb %)91=)91=)/3)6:)91=
r? N)r8 r9 r: staticmethodr r> r? r@ OrderByr s-
r? r r N Tuple[int, List[dict[str, Any]]]c , | | t t }|p
t }|t j |k t j |k z g}|5d| d}| t
d|f | j |z z |#| t j |k |#| t j |k |
"| t j
|
z |
rω r| | j dk | | j
fd|
D }|rrg }g }|D ]/}| d | | d 0d | }| t
d| d| t t j | }|}| "|t j | z }| | | | }| t- | t | }| | }d |D }||fS )
N% CAST(orig_file AS TEXT) LIKE ?filec ~ g | ]9}t | t k "| 7|:S r> )len
startswith).0p site_searchs r@
<listcomp>z)MalwareHit._hits_list.<locals>.<listcomp>M sM q66C , ,,, k1J1J, ,,,r? zorig_file NOT LIKE ?z AND ()c 6 g | ]}| S r> as_dictr rows r@ r z)MalwareHit._hits_list.<locals>.<listcomp>t 333C#++--333r? )rW r3 joinr r[ appendr userr rZ r ra r r r operatorand_idrc rb rg rh r$ _hits_num) rl clausesrm rn rg rh search
by_scan_idr re by_statusidsr
user_siteskwargsr where_conditionspattern longer_paths
sql_chunks
sql_paramsrY combined_sql_string full_clausesmax_count_clausesordered max_countresults ` r@
_hits_listzMalwareHit._hits_list s $ zz#{++00==
\466
E
)k.AR.G H
#&mmmG # #4wjAA8W$&
# #JOt$; < < < ! # #K$6*$D E E E # #J$5$B C C C + # #C$5$? @ @ @ # #CM$<$<[$I$I J J J # L
( 2 2D %%&<=== %%jjj1111&-ll:&>&># ''2 /222J?? hm-=>> ) ? JM - -c 2 2 2L**\**0077>>vFF $Xz7CCGMM"344 337333& r? c x |r&|r$|t j |k t j |k z z }||| j |k z }| t j | j t | }|t |t | }| S rM ) r3 r[ r rW r COUNTr r rb r$ r scalar)rl r rm rn r re qs r@ r zMalwareHit._hits_numx s R +u4#r)
G sx4' 'G JJrx'' ( ( - -k : : @ @ I I xQ77Axxzzr? c | | j t j | j z ||| S rM )r r not_inr+ CLEANUP malicious)rl rm rn r s r@
malicious_numzMalwareHit.malicious_num s? }}
Z
/ 7
8
83=
H
r? )ignore_cleanedc | j }|r'|| j t j z } | j |g|R i |S rM )r r r r+ r r )rl r argsr r s r@ malicious_listzMalwareHit.malicious_list sR - C sz(()9)ABB BG s~g7777777r? c Z |t n|}| j t j |k z t j |k z }||| j |k z }| | j t j | j
d t |
| j }d |D }t t j t j }||dS )Nri c ( i | ]}|j |j S r> )r ri r s r@
<dictcomp>z0MalwareHit.malicious_summary.<locals>.<dictcomp> s 888C#*ci888r? )counts last_scan)r r r3 r[ r rW r r r r r` r rb rd MAXr ) rl rm rn r r r rowsr r s r@ malicious_summaryz MalwareHit.malicious_summary s zTVVVr M"e+
-"b(
*
sx4' 'G JJsz28CF#3#3#9#9'#B#B C C
T+
U7^^
Xcj
!
!
984888 &&rvk.A'B'BCCJJLL y999r? c F d |D }d }t ||| || S )Nc g | ] }|j
S r> r r s r@ r z)MalwareHit.set_status.<locals>.<listcomp> '''3'''r? c d|i}|||d< |j di | |j | S )Nr
cleaned_atr> updaterb r rc )r rl r r fields_to_updates r@
expressionz)MalwareHit.set_status.<locals>.expression U & %1; . 3:11 01177
3HH Hr? r% )rl r r r r s r@
set_statuszMalwareHit.set_status F ''$''' I I I + c6:
r? to_deleterj c F d |D } fd}t || S )Nc g | ] }|j
S r> r r s r@ r z/MalwareHit.delete_instances.<locals>.<listcomp> s 111SV111r? c j | S rM )deleterb r rc )r rl s r@ r z/MalwareHit.delete_instances.<locals>.expression s+ ::<<%%cfjjoo66 6r? r )rl r r s ` r@ delete_instanceszMalwareHit.delete_instances sA 11y111 7 7 7 7 7 +:yAAAr? to_updatec |D ][}| D ]D\ }}| D ]\ }}t ||| | E\d S rM )itemssetattrsave)rl r data _instancenew_fields_datafieldr{ s r@ update_instanceszMalwareHit.update_instances s ! !D.2jjll
!
!* ?$3$9$9$;$; 5 5LE5Iue4444
! ! !r? r c ` | j t j g | j z }|S rM )r rc r+ r r )rl r s r@ is_infectedzMalwareHit.is_infected s:
JNN$*
m
r? c | j S rM )r rl s r@
is_suspiciouszMalwareHit.is_suspicious s
~ r? c T fd}t t ||| |d S )Nc |j }| ||j | z }nSr(||j t
j z }n)r'||j t
j z }|5t |t r|g}||j
| z }| | S rM )
r r rc r r r+ r
RESTORABLE
isinstancer r rW rb ) chunk_of_idsrl r r cleanuprestores r@ r z/MalwareHit.malicious_select.<locals>.expression s mG'36::l333
G3:,,-=-EFFF
G3:>>*:*EFFF dC(( " 6D38<<---::<<%%g.. .r? T)exec_expr_with_empty_iterrj r' )rl r r r r r r s `` r@ malicious_selectzMalwareHit.malicious_select sS / / / / / / +Cdd
r? statusesc 2 fd}t || S )Nc j | }r |j z } | S rM r rc r rW rb filesr rl r s r@ r z'MalwareHit.get_hits.<locals>.expression T m''..G
43:>>(333::<<%%g.. .r? r' rl r r r s ` ` r@ get_hitszMalwareHit.get_hits 4 / / / / / / /z5AAAr? hits_infoSet[MalwareDatabaseHitInfo]c x d |D }d |D }d |D t t t j | t j | }fd|D }|S )Nc g | ] }|j
S r> rY r entrys r@ r z*MalwareHit.get_db_hits.<locals>.<listcomp> s 333333r? c g | ] }|j
S r> app_namer( s r@ r z*MalwareHit.get_db_hits.<locals>.<listcomp> 6665666r? c * g | ]}|j |j fS r> rY r, r( s r@ r z*MalwareHit.get_db_hits.<locals>.<listcomp> s! JJJuuz5>2JJJr? c 4 g | ]}|j |j fv |S r> r r, r hit
paths_appss r@ r z*MalwareHit.get_db_hits.<locals>.<listcomp> s3
CM3<#@J#N#NC#N#N#Nr? )rj r rW rb r rc r, )rl r# rR appsr r4 s @r@ get_db_hitszMalwareHit.get_db_hits s 3333366I666JJ JJJ
U:'++E22
3
3
U:&**400
1
1
r? list[RemoteRevertHitInfo]c d d |D }d |D }d |D }d |D t t t j | t j | t j | t j t j
}fd|D }|S )Nc g | ] }|j
S r> )
app_root_pathr( s r@ r z<MalwareHit.get_db_hits_for_remote_revert.<locals>.<listcomp> s <<<$<<<r? c g | ] }|j
S r> r+ r( s r@ r z<MalwareHit.get_db_hits_for_remote_revert.<locals>.<listcomp> r- r? c g | ] }|j
S r> )sig_idr( s r@ r z<MalwareHit.get_db_hits_for_remote_revert.<locals>.<listcomp> s :::uel:::r? c 6 g | ]}|j |j |j fS r> )r: r, r= r( s r@ r z<MalwareHit.get_db_hits_for_remote_revert.<locals>.<listcomp> s6
%.%, ?
r? c @ g | ]}|j |j |j fv |S r> )r r, r r2 s r@ r z<MalwareHit.get_db_hits_for_remote_revert.<locals>.<listcomp> s<
s|S-=>*LL
LLLr? ) rj r db_hitsrb r rc r, r_ r r+ r )rl r# rR r5
signaturesr r4 s @r@ get_db_hits_for_remote_revertz(MalwareHit.get_db_hits_for_remote_revert s& =<)<<<66I666:: :::
"
"&
U:'++E22
3
3
U:&**400
1
1
U:?&&z22
3
3
U:$(()9)DEE
F
F "
"
r? c . fd}t || S )Nc j | S rM r rb r rc r rl s r@ r z*MalwareHit.delete_hits.<locals>.expression) / ::<<%%cm&7&7&>&>?? ?r? r rl r r s ` r@ delete_hitszMalwareHit.delete_hits' 3 @ @ @ @ @ +:u===r? c j t | | S rM )r_ get_pk_exprr s r@ refreshzMalwareHit.refresh. s" Dzz~~dmmoo...r? Iterable[MalwareHit]c L fd}t t || S )Nc }r3 t t }| j d | D S )Nc g | ] }|j
S r> r r r3 s r@ r z?MalwareHit.refresh_hits.<locals>.expression.<locals>.<listcomp>7 s *B*B*Bc36*B*B*Br? )rW r3 r rb r rc )r ro rl include_scan_infos r@ r z+MalwareHit.refresh_hits.<locals>.expression3 si JJLLE
G
3 4499+FF;;svzz*B*BT*B*B*B C CDD Dr? r )rl r rT r s ` ` r@ refresh_hitszMalwareHit.refresh_hits1 sC E E E E E E 3JEEFFFr? r~ rO c | | j |k | j t
j z | j d z S )NF)rW rb r r rc r+ CLEANEDis_null)rl r~ s r@
cleaned_sincezMalwareHit.cleaned_since; s^ zz||!!
^y
(z~~ . 677
9~%%e,,
.
r? r c | | j t j j k S rM )rW rb ra r, rz r{ r s r@ r@ zMalwareHit.db_hitsC s4 zz||!! !8!;!A A
r? c v | | j t j k S )z,Return db hits that are in queue for cleanup)r@ rb r r+ r r s r@ db_hits_pending_cleanupz"MalwareHit.db_hits_pending_cleanupI 2 {{}}"" J*: :
r? c v | | j t j k S )z3Return db hits for which the cleanup is in progress)r@ rb r r+ r r s r@ db_hits_under_cleanupz MalwareHit.db_hits_under_cleanupP r] r? c v | | j t j k S )z3Return db hits for which the restore is in progressr@ rb r r+ CLEANUP_RESTORE_STARTEDr s r@ db_hits_under_restorationz$MalwareHit.db_hits_under_restorationW s2 {{}}"" J*B B
r? c < d |D }d |D }d |D | | j | | j | }fd|D S )z
Return db hits for which the cleanup is in progress
specified by the provided set of MalwareDatabaseHitInfo
c h | ] }|j
S r> r' r hit_infos r@ <setcomp>z6MalwareHit.db_hits_under_cleanup_in.<locals>.<setcomp>f s ???hHM???r? c h | ] }|j
S r> r+ rf s r@ rh z6MalwareHit.db_hits_under_cleanup_in.<locals>.<setcomp>g s GGGh)GGGr? c * h | ]}|j |j fS r> r/ rf s r@ rh z6MalwareHit.db_hits_under_cleanup_in.<locals>.<setcomp>h s/
3;X]H - .
r? c 4 g | ]}|j |j fv |S r> r1 )r r3 path_app_name_sets r@ r z7MalwareHit.db_hits_under_cleanup_in.<locals>.<listcomp>p s8
s|,0AAA
AAAr? )r_ rb r rc r, )rl hit_info_setpath_set app_name_setro rl s @r@ db_hits_under_cleanup_inz#MalwareHit.db_hits_under_cleanup_in^ s @?,???GG,GGG
?K
% % ' '
U3=$$X..
/
/
U3<##L11
2
2
r? c | | j t j t j g S rM )r@ rb r rc r+ CLEANUP_RESTORE_PENDING CLEANUP_REMOTE_RESTORE_PENDINGr s r@ db_hits_pending_cleanup_restorez*MalwareHit.db_hits_pending_cleanup_restorev sF {{}}"" JNN$<$C
r? c v | | j t j k S rM ra r s r@ db_hits_under_cleanup_restorez(MalwareHit.db_hits_under_cleanup_restore s0 {{}}"" J*B B
r?
hit_list_listList['MalwareHit'] attribute Dict[str, List['MalwareHit']]c t d t j | D t | }d t j |t | D S )Nc 3 K | ]}|V d S rM r> rS s r@ <genexpr>z0MalwareHit.group_by_attribute.<locals>.<genexpr> " I ISS I I I I I Ir? keyc 4 i | ]\ }}|t | S r> rj r
attr_valuer s r@ r z1MalwareHit.group_by_attribute.<locals>.<dictcomp> 4
D
T
r? sorted itertoolschain
from_iterabler groupbyry rw hit_lists r@ group_by_attributez MalwareHit.group_by_attribute I IIO 9 9- H H I I I9%%
$-$5 y))% % %
r? c @ i d| j d| j d| j d| j j d| j d| j j d| j d| j d | j d
| j d | j
d | j d
| j di d| j
d| j d| j | j | j | j t$ j j k ret+ t, t, j t, j t, j t, j | j k t, j | j k t, j | j k t, j
| j
k t, j | j k t, j | j k t, j | j k t, j | j k t, j d t, j d t, j d ng dS )Nr usernamer createdscan_idrT ra r_ hashsizer r r
extra_datadb_namer, db_hostF)db_portsnippet table_fields)!r r r rZ r[ scanid_idr_ ra r r r r r r r, r r r r, rz r{ rj MalwareHistoryrW
table_name table_field
table_row_infrb rY r r rX rk r s r@ r zMalwareHit.as_dict s- -
$'-
-
DN-
t{* -
t~ -
)
-
T /-
DI-
DI-
DI-
-
dk-
$/-
" -
t| -
!-
"
t|#-
$ ||. %)@)C)III+ "))&1&2&4
U&/4=@&.$,>&.$,>&.$,>&+t~=&48JJ&.$+=&3ty@&199%@@&2::5AA&4<<UCC UWW' , W-
-
-
-
r? c | | j r | j j d| j d| j dS | j j d| j dS )Nz (orig_file=z , app_name=r )r, __class__r8 r r s r@ __repr__zMalwareHit.__repr__ sT = '''
&*^%<%<%<dnnnMMr? )r r ) r NNNNNNNNNNN)r r )NNNNNrM )r NN)r rj )r rj )r r )NNFF)r# r$ )r# r7 )F)r rO )r~ rO )r r )rw rx ry r r rz )Hr8 r9 r: rq rA r r r r3 rZ r ownerr r" r r_ r r r r r r~ r+ r r r r rr r, rz r{ r| ra r, r r r r propertyr r r r r r r r r r r r r r r r! r6 rB rI rN rU rY r@ r\ r_ rc rp rt rv r r r r r> r? r@ r r s 44" " " " " " " "
B
_%f F
I5 ! ! !E 9% D
5)))I 9% D
%777I 9$ D 9$ D
%%%I Y / 5
6
6
6F&&&J I
E%,,/28/4:
M yd###HiT"""GiT"""GiT"""GiT"""G
$ $ $ X$ X "
X! X! X! X! [X!t DH [
[
27 8 8 8 8 [8 : : : [:&
[
B B B [B ! ! ! [! [ [ 9>
[
. )- B B B B [B [ [0 > > [> / / / G G G G [G
[
[
[
[
[
[
.
[
[
\
.
.
.
`N N N N Nr? r T)frozenc e Zd ZU dZded< ded< ded< ded< ded< d ed
< ded < ded < d ed
< ded< ed Zed ZdS )MalwareHitAlternatezA
Used as a replacement for MalwareHit for file hits only
r rZ r Noner, r r rO r r r_ r~ boolr c
| ||d |d |d |d |d |d d d |d d d |d d d
S ) Nr r r r r r matchesr~
suspicious)
rZ r r, r r r r r_ r~ r r> )rl rZ filenamer s r@ createzMalwareHitAlternate.create ss s w-f f f f a +6l1ok2 v,q/,77
r? c N t t j | j S rM )r osfsdecoder r s r@ r z"MalwareHitAlternate.orig_file_path s BK//000r? N) r8 r9 r: rq __annotations__r r r r r> r? r@ r r s KKKNNNNNNJJJ
III
III
III
IIINNNOOO
[
1 1 X1 1 1r? r c J e Zd ZdZ G d d ZdZ e Z e Z ed e
d g Z e dd Z
ed
Ze fd Ze fd Ze ddd Zedd Zed Z xZS )MalwareIgnorePathz+A path that must be excluded from all scansc $ e Zd Zej ZdZdZdS )MalwareIgnorePath.Metamalware_ignore_path)))rY ra TNr8 r9 r: r! r; r< r= indexesr> r? r@ rA r s ;(6r? rA NFz resource_type in ('file','db')rF c 8 t t S rM rN r> r? r@ rP zMalwareIgnorePath.<lambda> s #dff++ r? rH c t | | j }|| _ d S rM )rj rW re rY rk CACHE)rl r s r@
_update_cachez MalwareIgnorePath._update_cache
s> SZZ\\**3844::<<== r? c R d | _ t t | j di |S )Nr> )r superr r )rl r r s r@ r zMalwareIgnorePath.create s. 3u&,,3==f===r? c ` d | _ t t | S rM )r r r r )rl r s r@ r zMalwareIgnorePath.delete s' &,,33555r? ra
str | Nonec \ | | j } | | | j |k } | | | j |k } |-| | j | } | | | j |k } || | } || | } |t || | } |t | }
| | j t |
dz | j t |
k z | j t t | k z } | d } | d | D fS )N/TrU c , g | ]}t | S r> r r s r@ r z:MalwareIgnorePath.paths_count_and_list.<locals>.<listcomp>? s - - -C]3
- - -r? )rW re rY rb
added_datecontainsra rh rg r$ r& r r r/ ri ) rl rg rh r ra r rm rn re r user_homer s r@ paths_count_and_listz&MalwareIgnorePath.paths_count_and_list s
JJLL ! !#( + + %/00A
>",--A ))&1122A $)]:;;A A A xa00A 1$77I$$S^^c%9::8s9~~-/8s;t#4#4 5 557 A GGG-- - -1 - - -
r? r List[str]c : | j |i |\ }}d |D S )Nc g | ]
}|d S r' r> r s r@ r z/MalwareIgnorePath.path_list.<locals>.<listcomp>E s 111F 111r? )r )rl r r _ path_lists r@ r zMalwareIgnorePath.path_listB s1 /s/@@@ 911y1111r? c K | j | t | }| j rK| j D ]C}t j d d{V t |d }||k s ||j v r dS DdS )zChecks whether path stored in MalwareIgnorePath cache or
if it's belongs to path from cache or if it matches patters from cache
:param str check_path: path to check
:return: bool: is ignored according MalwareIgnorePath
Nr rY TF)r r r asynciosleepparents)rl
check_pathrY r ignored_paths r@ is_path_ignoredz!MalwareIgnorePath.is_path_ignoredG s 9 J 9 Y
mA&&&&&&&&& #AfI L((ldl.J.J 44 /Kur? )NNNNNNNN)ra r )r r )r8 r9 r: rq rA r r r r rY r ra r r r r r r r r r
__classcell__)r s @r@ r r s 557 7 7 7 7 7 7 7
E B 9;;D I
'G!H!H I M 52E2EFFFJ [ > > > > [> 6 6 6 6 [6 $(
&
&
&
&
[&
P 2 2 2 [2 [ r? r c e Zd ZdZ G d d Z ed Z ed Z ed e d
e j j
e j j
f ge j j
Z ed Z ed Z ed Z ed Z ed Z edd
Z ed Z ed Z ed Z ed Z ed Z ed Z ed Z ed Z e dd Z e d
Z!e dd Z"e dd Z#d S )r z:Records every event related to :class:`MalwareHit` recordsc e Zd Zej ZdZdS )MalwareHistory.Metamalware_historyNr7 r> r? r@ rA r ^ s ;$r? rA FrD TrK )rE rG rI c 8 t t S rM rN r> r? r@ rP zMalwareHistory.<lambda> s S[[ r? rH Nc | j |k | j |k z }|r/|| j | t d|f z z }|r|| j |k z }| | | | } |t |t | } t | }
|
d |
fS )Nz(INSTR(path, ?))TrU )ctimeeventr r file_userrW rb rg rh rk r$ r rj ri ) rl rm rn rg rh r r re r ro list_results r@ get_historyzMalwareHistory.get_history s 9%#)r/: **622& 22
G - s}, ,G
""7++11%88??GGMMOO "8^UCCE5kk {{t{,,k99r? c | j d| dd p t j | dd p t j | dd pt j j d| d S )Nr} causera )r} r ra r> )
insertpopr ROOTr- MANUALr, r| r{ execute)rl r s r@
save_eventzMalwareHistory.save_event s
jjd33Dx}**Wd++E/E **_d;; 2&+1
')))))r? r
List[dict]c n t j 5 t dt | j j t | j j z }t || D ])}|
| * d d d d S # 1 swxY w Y d S )Nr )
chunk_size) r! r; atomicmaxr1 _metar< r columnsr( insert_manyr )rl r r
hits_chunks r@ save_eventszMalwareHistory.save_events s
[
!
! 6 6 *39+=>>sy())* J
.dz J J J
6
6
++335555
6
6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6s A=B**B.1B.rR rj rm rO c > | | j t j | j | | j t k z | j |k z | j
S rM ) rW rY r r rb rc r r* r rd tuples)rl rR rm s r@ get_failed_cleanup_events_countz.MalwareHistory.get_failed_cleanup_events_count s{
JJsx , ,
U U##9 1139%'
Xch
VXX
r? )NNN)r r )rR rj rm rO )$r8 r9 r: rq rA r" rY r r, r rr r, rz r{ r| ra r r r}
file_ownerr r r r r r r r r r r r r r r r r> r? r@ r r [ sL DD% % % % % % % %
=e $ $ $Dyd###H I
E%,,/28/4:
(,2
M
I5 ! ! !E
I5 ! ! !E u%%%I&&&J u%%%I Le-@-@ A A AEiT"""GiT"""GiT"""G%%%J)&&&K Ld+++MiT"""G 9$'''LHL: : : [:& [ 6 6 6 [6
[
r? r c H e Zd ZdZ G d d Z e Z eeddd Z e
d Z e
d Z e
d Z e
d Z e
d Z e
d Z ed Z e
ej
Z ed Zed Zed$d Zed%d Z eddd Z ed Z e d&d Z ed Z e!d'd Z"ed(d! Z#ed)d" Z$d# Z%dS )*VulnerabilityHitz Represents a vulnerable file.c e Zd Zej ZdZdS )VulnerabilityHit.Metavulnerability_hitsNr7 r> r? r@ rA r ;'r? rA Fvulnerabilitiesr r rD Tr c T t t | j }t | S rM r r s r@ r z VulnerabilityHit.orig_file_path r r? signaturer r r c , | d S )Nz
VULN-ESUS-)r )rl r s r@ matchzVulnerabilityHit.match s ##L111r? rj c t j d| x}r-| d d S g S )NzVULN-ESUS-([\d,]+)r ,)rer groupssplit)rl r r s r@ get_vulnerability_idsz&VulnerabilityHit.get_vulnerability_ids sB I 3Y?? ?5 0<<>>!$**3// / r? Nr c 2 fd}t || S )Nc j | }r |j z } | S rM r r s r@ r z-VulnerabilityHit.get_hits.<locals>.expression r r? r r s ` ` r@ r! zVulnerabilityHit.get_hits r" r? c . fd}t || S )Nc j | S rM rE rF s r@ r z0VulnerabilityHit.delete_hits.<locals>.expression rG r? r rH s ` r@ rI z VulnerabilityHit.delete_hits rJ r? r c d | | t t } |p
t }d | }
t j |k t j |k z }| |t
d|
f | j |
z z z }||| j |k z }||| j |k z }|
|| j | z z }|}|
|| j
|
z }| |
| | }|t || | }| t! j | j
t | }d |D }||fS )Nz%{}%r c 6 g | ]}| S r> r r s r@ r z/VulnerabilityHit._hits_list.<locals>.<listcomp>< r r? )rW r3 r r rr r[ r r rZ r r rc rb rg rh r$ r r r )rl rm rn rg rh r r r re r r r r r r r r r r s r@ r zVulnerabilityHit._hits_list s zz#{++00==
\466--''#+u4 2 %
C07* 7" $
$L CH , ,L ! CJ* 4 4L CJ) 3 3L ( ? CFJJsOO +L**\**0077>>vFF $XsG<<G
JJrx'' ( (
T+
U$
%
%
VXX 437333& r? c | j |i |S rM )r )rl r r s r@ rj zVulnerabilityHit.list@ s s~t.v...r? rw List['VulnerabilityHit']ry #Dict[str, List['VulnerabilityHit']]c t d t j | D t | }d t j |t | D S )Nc 3 K | ]}|V d S rM r> rS s r@ r} z6VulnerabilityHit.group_by_attribute.<locals>.<genexpr>I r~ r? r c 4 i | ]\ }}|t | S r> r r s r@ r z7VulnerabilityHit.group_by_attribute.<locals>.<dictcomp>L r r? r r s r@ r z#VulnerabilityHit.group_by_attributeD r r? r list[int]c t }|D ]2}|t t |d z }3t | S )Nr_ )setr r rj )rl r vuln_idsr3 s r@ get_vulnerabilities_idsz(VulnerabilityHit.get_vulnerabilities_idsT sU 55 C 66s6{CC
HH H~~ r? c F d |D }d }t ||| || S )Nc g | ] }|j
S r> r r s r@ r z/VulnerabilityHit.set_status.<locals>.<listcomp>_ r r? c d|i}|||d< |j di | |j | S )Nr
patched_atr> r )r rl r r r s r@ r z/VulnerabilityHit.set_status.<locals>.expressiona r r? r )rl r r r r s r@ r zVulnerabilityHit.set_status] r r? c | j | j | j | j j | j | j j | j | j | j | j | j
d S )N) r r file_pathr r rT r_ r r r r ) r r r rZ r[ r r_ r r r r r s r@ r zVulnerabilityHit.as_dictn sN ' {*~ )IIIk /
r? )r r r r )r r r rj )
r NNNNNNNNN)rw r ry r r r )r rj r r rM )&r8 r9 r: rq rA r r r r3 rZ r r r r" r r_ r r r r~ r.
VULNERABLEr r r r r r r r! rI r rj r r r r r r> r? r@ r r s ''( ( ( ( ( ( ( (
B
_
& F
I5 ! ! !E 9% D
5)))I 9% D 9$ D 9$ D
%%%I Y 5 @
A
A
AF&&&J
X 2 2 2 [2 [
)- B B B B [B > > [>
1! 1! 1! [1!f / / [/
\
[
[
r? r c D e Zd ZdZ G d d Z ed ZdS )ImunifyPatchSubscriptionz(Stores Imunify Patch user subscriptions.c e Zd Zej ZdZdS ) ImunifyPatchSubscription.Metaimunify_patch_subscriptionsN)r8 r9 r: r! r; r< r r> r? r@ rA r$ s ;2
r? rA TrB N)r8 r9 r: rq rA r user_idr> r? r@ r" r" ~ sP 223 3 3 3 3 3 3 3 iD)))GGGr? r" pending
processing exhaustedc e Zd Z G d d Z e Z edd Z ed Z edd Z
e d Z edde
Z ed
Z ed Z e d Zd
S )
MRSUploadItemc $ e Zd Zej ZdZdZdS )MRSUploadItem.Metamrs_upload_queue)))r
upload_reasonT))r r/ enqueued_atF))r last_attempt_atFNr r> r? r@ rA r- s! ;%
r? rA @ F)
max_lengthrE rD )r3 rE rI r r TN)r8 r9 r: rA r r r r r r r/ r r0 PENDINGr r attempts
last_errorr1 r> r? r@ r+ r+ s
B 9 / / /D u%%%I I%888M *%(((K
Y"5'
B
B
BF|A&&&H%%%J jd+++OOOr? r+ c r e Zd Z G d d Z edd Z ed Z ed Zd S )
MRSQueueCounterc e Zd Zej ZdZdS )MRSQueueCounter.Metamrs_queue_countersNr7 r> r? r@ rA r< r r? rA r2 T)r3 rC r r rD N) r8 r9 r: rA r namer r{ last_metrics_report_timer> r? r@ r: r: ss ( ( ( ( ( ( ( ( 9 5 5 5D L # # #E +| 6 6 6 r? r: )Qrq
__future__r r r r r r dataclassesr functoolsr r pathlibr r typingr r
r r r
r r peeweer r r r r r r r r r r r r playhouse.shortcutsr defence360agent.contracts.configr defence360agent.modelr r! $defence360agent.model.simplificationr" r# r$ defence360agent.utilsr% r& r' r( imav.api.cleanup_revertr) imav.malwarelib.configr* r+ r, r- r. imav.malwarelib.scan.crontabr/ imav.malwarelib.scan.mds.reportr0 #imav.malwarelib.utils.sqlite_limitsr1 r3 r r r r r r" r6
PROCESSING EXHAUSTEDWORKING_STATUSESr+ r: r> r? r@ <module>rS s * # " " " " " ! ! ! ! ! ! > > > > > > > > > > > > > > > > > > . - - - - - 5 5 5 5 5 5 1 1 1 1 1 1 1 1
8 7 7 7 7 7 5 4 4 4 4 4 B B B B B B J J J J J JrB rB rB rB rB% rB rB rBjJN JN JN JN JN JN JN JNZ $"1 "1 "1 "1 "1 "1 "1 "1Ja a a a a a a aHj
j
j
j
j
U j
j
j
Zs
s
s
s
s
u s
s
s
l* * * * *u * * *
Z( , , , , ,E , , ,*7 7 7 7 7e 7 7 7 7 7r?
Back to Directory
File Manager