Skip to content

Commit 549ae75

Browse files
codeyourwebcodeyourweb
committed
logging enhancement
1 parent 9257e7a commit 549ae75

File tree

7 files changed

+70
-75
lines changed

7 files changed

+70
-75
lines changed

‎filehelper.go

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -20,15 +20,15 @@ import (
2020
// WindowsFileSystemAnalysisRoutine analyse windows filesystem every 300 seconds
2121
func WindowsFileSystemAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
2222
for true {
23-
env := ListEnvironmentPathFiles()
24-
temp := ListTemporaryFiles()
23+
env := ListEnvironmentPathFiles(pVerbose)
24+
temp := ListTemporaryFiles(pVerbose)
2525

2626
for _, p := range env {
27-
FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules)
27+
FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "ENV")
2828
}
2929

3030
for _, p := range temp {
31-
FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules)
31+
FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "TEMP")
3232
}
3333

3434
time.Sleep(300 * time.Second)
@@ -38,19 +38,19 @@ func WindowsFileSystemAnalysisRoutine(pQuarantine string, pKill bool, pAggressiv
3838
// UserFileSystemAnalysisRoutine analyse windows filesystem every 60 seconds
3939
func UserFileSystemAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
4040
for true {
41-
files := ListUserWorkspaceFiles()
41+
files := ListUserWorkspaceFiles(pVerbose)
4242

4343
for _, p := range files {
44-
FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules)
44+
FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "USER")
4545
}
4646
time.Sleep(60 * time.Second)
4747
}
4848
}
4949

5050
// ListUserWorkspaceFiles recursively list all files in USERPROFILE directory
51-
func ListUserWorkspaceFiles() (files []string) {
52-
f, err := RetrivesFilesFromUserPath(os.Getenv("USERPROFILE"), true, defaultScannedFileExtensions, true)
53-
if err != nil {
51+
func ListUserWorkspaceFiles(verbose bool) (files []string) {
52+
f, err := RetrivesFilesFromUserPath(os.Getenv("USERPROFILE"), true, defaultScannedFileExtensions, true, verbose)
53+
if err != nil && verbose {
5454
log.Println(err)
5555
}
5656

@@ -61,20 +61,20 @@ func ListUserWorkspaceFiles() (files []string) {
6161
}
6262

6363
// FileAnalysis sub-routine for file analysis (used in registry / task scheduler / startmenu scan)
64-
func FileAnalysis(path string, pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
64+
func FileAnalysis(path string, pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules, sourceIndex string) {
6565
var err error
6666
var content []byte
6767
var result yara.MatchRules
6868

6969
content, err = ioutil.ReadFile(path)
70-
if err != nil {
70+
if err != nil && pVerbose {
7171
log.Println(path, err)
7272
}
7373

7474
fileHash := fmt.Sprintf("%x", md5.Sum(content))
7575
if !StringInSlice(fileHash, filescanHistory) {
7676
if pVerbose {
77-
log.Println("[INFO] Analyzing", path)
77+
log.Println("[INFO] ["+sourceIndex+"] Analyzing", path)
7878
}
7979

8080
result, err = YaraScan(content, rules)
@@ -86,14 +86,14 @@ func FileAnalysis(path string, pQuarantine string, pKill bool, pAggressive bool,
8686

8787
// logging
8888
for _, match := range result {
89-
log.Println("[INFO]", "YARA MATCH", path, match.Namespace, match.Rule)
89+
log.Println("[ALERT]", "YARA MATCH", path, match.Namespace, match.Rule)
9090
}
9191

9292
// dump matching process to quarantine
9393
if len(pQuarantine) > 0 {
9494
log.Println("[INFO]", "DUMPING FILE", path)
9595
err := QuarantineFile(content, filepath.Base(path), pQuarantine)
96-
if err != nil && pVerbose {
96+
if err != nil {
9797
log.Println("[ERROR]", "Cannot quarantine file", path, err)
9898
}
9999
}
@@ -105,12 +105,12 @@ func FileAnalysis(path string, pQuarantine string, pKill bool, pAggressive bool,
105105
}
106106

107107
// ListEnvironmentPathFiles list all files in PATH directories
108-
func ListEnvironmentPathFiles() (files []string) {
108+
func ListEnvironmentPathFiles(verbose bool) (files []string) {
109109
env := os.Getenv("PATH")
110110
paths := strings.Split(env, ";")
111111
for _, p := range paths {
112-
f, err := RetrivesFilesFromUserPath(p, true, defaultScannedFileExtensions, false)
113-
if err != nil {
112+
f, err := RetrivesFilesFromUserPath(p, true, defaultScannedFileExtensions, false, verbose)
113+
if err != nil && verbose {
114114
log.Println(err)
115115
continue
116116
}
@@ -124,7 +124,7 @@ func ListEnvironmentPathFiles() (files []string) {
124124
}
125125

126126
// ListTemporaryFiles list all files in TEMP / TMP / %SystemRoot%\Temp
127-
func ListTemporaryFiles() (files []string) {
127+
func ListTemporaryFiles(verbose bool) (files []string) {
128128

129129
var folders = []string{os.Getenv("TEMP")}
130130
if os.Getenv("TMP") != os.Getenv("TEMP") {
@@ -136,8 +136,8 @@ func ListTemporaryFiles() (files []string) {
136136
}
137137

138138
for _, p := range folders {
139-
f, err := RetrivesFilesFromUserPath(p, true, defaultScannedFileExtensions, true)
140-
if err != nil {
139+
f, err := RetrivesFilesFromUserPath(p, true, defaultScannedFileExtensions, true, verbose)
140+
if err != nil && verbose {
141141
log.Println(err)
142142
continue
143143
}
@@ -190,7 +190,7 @@ func FormatPathFromComplexString(command string) (paths []string) {
190190
}
191191

192192
// RetrivesFilesFromUserPath return a []string of available files from given path (includeFileExtensions is available only if listFiles is true)
193-
func RetrivesFilesFromUserPath(path string, listFiles bool, includeFileExtensions []string, recursive bool) ([]string, error) {
193+
func RetrivesFilesFromUserPath(path string, listFiles bool, includeFileExtensions []string, recursive bool, verbose bool) ([]string, error) {
194194
var p []string
195195

196196
info, err := os.Stat(path)
@@ -213,8 +213,8 @@ func RetrivesFilesFromUserPath(path string, listFiles bool, includeFileExtension
213213
}
214214
} else {
215215
err := filepath.Walk(path, func(walk string, info os.FileInfo, err error) error {
216-
if err != nil {
217-
log.Println(err)
216+
if err != nil && verbose {
217+
log.Println("[ERROR]", err)
218218
}
219219

220220
if err == nil && !(info.IsDir() == listFiles) && (len(includeFileExtensions) == 0 || StringInSlice(filepath.Ext(walk), includeFileExtensions)) {
@@ -224,8 +224,8 @@ func RetrivesFilesFromUserPath(path string, listFiles bool, includeFileExtension
224224
return nil
225225
})
226226

227-
if err != nil {
228-
log.Println(err)
227+
if err != nil && verbose {
228+
log.Println("[ERROR]", err)
229229
}
230230
}
231231
}

‎main.go

Lines changed: 11 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -51,31 +51,28 @@ func main() {
5151
}
5252

5353
// load yara signature
54-
log.Println("[INFO] Starting IRMA")
54+
log.Println("[INIT] Starting IRMA")
5555
yaraPath := *pYaraPath
56-
yaraFiles := SearchForYaraFiles(yaraPath)
57-
compiler, err := LoadYaraRules(yaraFiles)
56+
yaraFiles := SearchForYaraFiles(yaraPath, *pVerbose)
57+
compiler, err := LoadYaraRules(yaraFiles, *pVerbose)
5858
if err != nil {
5959
log.Fatal(err)
6060
}
61-
log.Println("Loading ", len(yaraFiles), "YARA files")
61+
log.Println("[INIT] Loading ", len(yaraFiles), "YARA files")
6262

6363
// compile yara rules
6464
rules, err := CompileRules(compiler)
6565
if err != nil {
6666
log.Fatal(err)
6767
}
68-
log.Println(len(rules.GetRules()), "YARA rules compiled")
69-
70-
log.Println("Scanning file in Windows temporary folders")
71-
72-
log.Println("Starting routine (Memory / Registry / StartMenu / Task Scheduler / Filesystem)")
68+
log.Println("[INIT]", len(rules.GetRules()), "YARA rules compiled")
69+
log.Println("[INFO] Start scanning Memory / Registry / StartMenu / Task Scheduler / Filesystem")
7370
go MemoryAnalysisRoutine(*pDump, *pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
74-
//go RegistryAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
75-
//go StartMenuAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
76-
//go TaskSchedulerAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
77-
//go WindowsFileSystemAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
78-
//go UserFileSystemAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
71+
go RegistryAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
72+
go StartMenuAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
73+
go TaskSchedulerAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
74+
go WindowsFileSystemAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
75+
go UserFileSystemAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
7976

8077
for true {
8178
time.Sleep(3600 * time.Second)

‎procsmemory.go

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,21 +58,23 @@ func MemoryAnalysisRoutine(pDump string, pQuarantine string, pKill bool, pAggres
5858

5959
// logging
6060
for _, match := range result {
61-
log.Println("[INFO]", "YARA MATCH", proc.ProcessName, "PID:", fmt.Sprint(proc.PID), match.Namespace, match.Rule)
61+
log.Println("[ALERT]", "YARA MATCH", proc.ProcessName, "PID:", fmt.Sprint(proc.PID), match.Namespace, match.Rule)
6262
}
6363

6464
// dump matching process to quarantine
6565
if len(pQuarantine) > 0 {
6666
log.Println("[INFO]", "DUMPING PID", proc.PID)
6767
err := QuarantineProcess(proc, pQuarantine)
68-
if err != nil && pVerbose {
68+
if err != nil {
6969
log.Println("[ERROR]", "Cannot quarantine PID", proc.PID, err)
7070
}
7171
}
7272

7373
// killing process
7474
if pKill {
75-
log.Println("[INFO]", "KILLING PID", proc.PID)
75+
if pVerbose {
76+
log.Println("[INFO]", "KILLING PID", proc.PID)
77+
}
7678
KillProcessByID(proc.PID, pVerbose)
7779
}
7880

‎windowslnkparser.go

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,29 +13,31 @@ import (
1313
// StartMenuAnalysisRoutine analyse system artefacts every 15 seconds
1414
func StartMenuAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
1515
for true {
16-
17-
lnk, errors := ListStartMenuLnkPersistence()
18-
if errors != nil {
16+
lnk, errors := ListStartMenuLnkPersistence(pVerbose)
17+
if errors != nil && pVerbose {
1918
for _, err := range errors {
2019
log.Println("[ERROR]", err)
2120
}
2221
}
2322

24-
for _, p := range lnk {
25-
FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules)
23+
for _, l := range lnk {
24+
paths := FormatPathFromComplexString(l)
25+
for _, p := range paths {
26+
FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "STARTMENU")
27+
}
2628
}
2729

2830
time.Sleep(15 * time.Second)
2931
}
3032
}
3133

3234
// ListStartMenuFolders return a []string of all available StartMenu folders
33-
func ListStartMenuFolders() (startMenu []string, err error) {
35+
func ListStartMenuFolders(verbose bool) (startMenu []string, err error) {
3436
var usersDir []string
3537

3638
startMenu = append(startMenu, os.Getenv("SystemDrive")+`\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp`)
3739

38-
usersDir, err = RetrivesFilesFromUserPath(os.Getenv("SystemDrive")+`\Users`, false, nil, false)
40+
usersDir, err = RetrivesFilesFromUserPath(os.Getenv("SystemDrive")+`\Users`, false, nil, false, verbose)
3941
if err != nil {
4042
return startMenu, err
4143
}
@@ -48,16 +50,16 @@ func ListStartMenuFolders() (startMenu []string, err error) {
4850
}
4951

5052
// ListStartMenuLnkPersistence check for every *.lnk in Windows StartMenu folders and extract every executable path in those links
51-
func ListStartMenuLnkPersistence() (exePath []string, errors []error) {
53+
func ListStartMenuLnkPersistence(verbose bool) (exePath []string, errors []error) {
5254

53-
startMenuFolders, err := ListStartMenuFolders()
55+
startMenuFolders, err := ListStartMenuFolders(verbose)
5456
if err != nil {
55-
log.Println(err)
57+
errors = append(errors, err)
5658
}
5759

5860
for _, path := range startMenuFolders {
5961

60-
files, err := RetrivesFilesFromUserPath(path, true, []string{".lnk"}, false)
62+
files, err := RetrivesFilesFromUserPath(path, true, []string{".lnk"}, false, verbose)
6163

6264
if err != nil {
6365
errors = append(errors, fmt.Errorf("%s - %s", path, err.Error()))

‎windowsregistry.go

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,17 @@ type RegistryValue struct {
2222
func RegistryAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
2323
for true {
2424
values, errors := EnumRegistryPeristence()
25-
for _, err := range errors {
26-
log.Println("[ERROR]", err)
25+
26+
if pVerbose {
27+
for _, err := range errors {
28+
log.Println("[ERROR]", err)
29+
}
2730
}
2831

2932
for _, k := range values {
3033
paths := FormatPathFromComplexString(k.value)
3134
for _, p := range paths {
32-
FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules)
35+
FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "REGISTRY")
3336
}
3437
}
3538

‎windowstaskscheduler.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,15 @@ type ExecAction struct {
3131
func TaskSchedulerAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
3232
for true {
3333
tasks, err := GetTasks()
34-
if err != nil {
34+
if err != nil && pVerbose {
3535
log.Println("[ERROR]", err)
3636
}
3737

3838
for _, t := range tasks {
3939
for _, e := range t.ActionList {
4040
paths := FormatPathFromComplexString(e.Path)
4141
for _, p := range paths {
42-
FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules)
42+
FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "TASKS")
4343
}
4444
}
4545
}

‎yaraProcessing.go

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ import (
55
"log"
66
"os"
77
"path/filepath"
8-
"strings"
98

109
"github.com/hillu/go-yara"
1110
)
@@ -21,37 +20,29 @@ func PerformYaraScan(data []byte, rules *yara.Rules, verbose bool) yara.MatchRul
2120
}
2221

2322
// SearchForYaraFiles search *.yar file by walking recursively from specified input path
24-
func SearchForYaraFiles(path string) (rules []string) {
25-
filepath.Walk(path, func(walk string, info os.FileInfo, err error) error {
26-
if err != nil {
27-
log.Println(err)
28-
}
29-
30-
if err == nil && !info.IsDir() && info.Size() > 0 && len(filepath.Ext(walk)) > 0 && strings.ToLower(filepath.Ext(walk)) == ".yar" {
31-
rules = append(rules, walk)
32-
}
33-
34-
return nil
35-
})
36-
23+
func SearchForYaraFiles(path string, verbose bool) (rules []string) {
24+
rules, err := RetrivesFilesFromUserPath(path, true, []string{".yar"}, true, verbose)
25+
if err != nil && verbose {
26+
log.Println(err)
27+
}
3728
return rules
3829
}
3930

4031
// LoadYaraRules compile yara rules from specified paths and return a pointer to the yara compiler
41-
func LoadYaraRules(path []string) (compiler *yara.Compiler, err error) {
32+
func LoadYaraRules(path []string, verbose bool) (compiler *yara.Compiler, err error) {
4233
compiler, err = yara.NewCompiler()
4334
if err != nil {
4435
return nil, errors.New("Failed to initialize YARA compiler")
4536
}
4637

4738
for _, dir := range path {
4839
f, err := os.Open(dir)
49-
if err != nil {
40+
if err != nil && verbose {
5041
log.Println("[ERROR]", "Could not open rule file ", dir, err)
5142
}
5243

5344
namespace := filepath.Base(dir)[:len(filepath.Base(dir))-4]
54-
if err = compiler.AddFile(f, namespace); err != nil {
45+
if err = compiler.AddFile(f, namespace); err != nil && verbose {
5546
log.Println("[ERROR]", "Could not load rule file ", dir, err)
5647
}
5748
f.Close()

0 commit comments

Comments
 (0)