9:B T d Z ddlmZ ddlZddlZddlZddlZddlZddlm Z ddl
m Z ddlm Z ddl
mZ ddlmZ dd lmZmZmZmZmZmZmZ dd
lmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z% dd l&m'Z' dd l(m)Z) dd
l*m+Z+m,Z, ddl-m.Z.m/Z/m0Z0 ddl1m2Z2m3Z3m4Z4m5Z5 ddl6m7Z7 ddl8m9Z9m:Z:m;Z;mm?Z? ddl@mAZA G d de+ ZB G d de+ ZC e d G d d ZD G d d e+ ZE G d d e+ ZF G d d!e+ ZG G d" d#e+ ZHdS )$u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
) annotationsN) dataclass)reduce)
attrgetter)Path)time)AnyDictIterableListSetTuplecast)
SQL BooleanFieldCase CharFieldCheck
Expression
FloatFieldForeignKeyField IntegerField ModelSelectPrimaryKeyField TextFieldfn
model_to_dict)UserType)Modelinstance)
FilenameField
ScanPathFieldapply_order_by)execute_iterable_expressionget_abspath_from_user_dir get_results_iterable_expressionsplit_for_chunk)RemoteRevertHitInfo)FAILED_TO_CLEANUPMalwareHitStatusMalwareScanResourceTypeMalwareScanTypeVulnerabilityHitStatus) get_crontab)MalwareDatabaseHitInfoc ~ e Zd ZdZ G d d Z ed Z ed Z ed Z ed e
d e j
e j e j e j e j e j e j f g Z edd
Z edd Z edd
Z edd
Z ed e
d ej j ej j f g Z ed Z edd Z!e" de j
e j e j fd
dd Z#d
S ) MalwareScanzRepresents a batch of files scanned for malware
Usually a single AI-BOLIT execution.
See :class:`.MalwareScanType` for possible kinds of scans.
c e Zd Zej ZdZdS )MalwareScan.Meta
malware_scansN__name__
__module__ __qualname__r! dbdatabasedb_table J/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/model.pyMetar4 U s ;"r> r@ T primary_keyFnullz
type in {}rD constraintsr rD default Nresource_type in {}c 8 t t S Nintr r= r> r? zMalwareScan. s TVV r> )typespathsc v | | j | j | j | j | j | j | j | j d | j
| j | | j |k | j |k }|r-| | j | }|
| j | j | j | j t j | | }|t' || | }| d t+ | fS )N scan_typeT clear_limit)selecttotal_resourcespathscanidstarted completederrortotal_malicioustypealias
resource_typewherein_group_byorder_byr2 desclimitoffsetr$ countlistdicts) clssincetorf rg rd rP rQ querys r?
ondemand_listzMalwareScan.ondemand_list sd "
JJ#
#{++!
U38<<&&
'
'
U3;%'
(
(
U3;"$
%
% " 5KK U 3 344E
NN#SXsz3;
Xk)..00
1
1
U5\\
VF^^
"8S%88E{{t{,,d5;;==.A.AAAr> rL )$r7 r8 r9 __doc__r@ r rY r rZ r[ r formatr- ON_DEMANDREALTIMEMALWARE_RESPONSE
BACKGROUNDRESCANUSERRESCAN_OUTDATEDr^ rW r# rX r r\ r] r, DBvalueFILEr` initiator timestamp classmethodro r= r> r? r2 r2 N s # # # # # # # #
Y4
(
(
(Fl&&&G $'''I 9
E ##'1'0'8'2'.','7
D& #lq999O =dB / / /D
I4 . . .E"lq999O I
E%,,/28/4:
M t$$$I %1D1DEEEI
/B
% &
/B /B /B /B [/B /B /Br> r2 c
e Zd ZdZ G d d Z e Z eeddd Z e
d Z e
d Z e
d Z e
d Z edd Z e
d
Z e
d
Z ed
Z e
ej Z ed
Z e
d ed e j j e j j f g
Z e
d
Z! e
d
Z" e
d
Z# e
d
Z$ e
d
Z%e&dCd Z'e&d Z( G d d Z)e* dDdEd Z+e* dFd Z,e*dGd Z-e*ddd Z.e*dGd Z/e*dHd Z0e*dId! Z1e*dJd# Z2e*d$ Z3e* dKd% Z4e*dd&d' Z5e*dLd* Z6e*dMd, Z7e*d- Z8d. Z9e*dNdOd0 Z:e*dPd3 Z;e*dQd5 Ze*dQd8 Z?e*d9 Z@e*d: ZAe*d; ZBeCdRd@ ZDdA ZEdB ZFdS )S
MalwareHitz*Represents a malicious or suspicious file.c e Zd Zej ZdZdS )MalwareHit.Meta malware_hitsNr6 r= r> r? r@ r s ;!r> r@ FhitsCASCADErD related_name on_deleterC rG TrH rJ rE returnstrc 6 t t | j S rL )r r r^ selfs r? signature_idzMalwareHit.signature_id s C###r> c T t t | j }t | S rL r r orig_filer r r s r? orig_file_pathzMalwareHit.orig_file_path dn-- I r> c $ e Zd Zed ZdS )MalwareHit.OrderByc t t j t j dft j dft j dft j dft j dffd fS )Nr d ) r r statusr+ CLEANUP_PENDINGCLEANUP_STARTEDFOUND CLEANUP_DONECLEANUP_REMOVEDr= r> r? r zMalwareHit.OrderBy.status sb %)91=)91=)/3)6:)91=
r> N)r7 r8 r9 staticmethodr r= r> r? OrderByr s-
r> r r N Tuple[int, List[dict[str, Any]]]c , | | t t }|p
t }|t j |k t j |k z g}|5d| d}| t
d|f | j |z z |#| t j |k |#| t j |k |
"| t j
|
z |
rω r| | j dk | | j
fd|
D }|rrg }g }|D ]/}| d | | d 0d | }| t
d| d| t t j | }|}| "|t j | z }| | | | }| t- | t | }| | }d |D }||fS )
N% CAST(orig_file AS TEXT) LIKE ?filec ~ g | ]9}t | t k "| 7|:S r= )len
startswith).0p site_searchs r?
z)MalwareHit._hits_list..L sM q66C , ,,, k1J1J, ,,,r> zorig_file NOT LIKE ?z AND ()c 6 g | ]}| S r= as_dictr rows r? r z)MalwareHit._hits_list..s 333C#++--333r> )rV r2 joinr rZ appendr userr rY r r` r r r operatorand_idrb ra rf rg r$ _hits_num) rk clausesrl rm rf rg search
by_scan_idr rd by_statusidsr
user_siteskwargsr where_conditionspattern longer_paths
sql_chunks
sql_paramsrX combined_sql_string full_clausesmax_count_clausesordered max_countresults ` r?
_hits_listzMalwareHit._hits_list s $ zz#{++00==
\466
E
)k.AR.G H
#&mmmG # #4wjAA8W$&
# #JOt$; < < < ! # #K$6*$D E E E # #J$5$B C C C + # #C$5$? @ @ @ # #CM$<$<[$I$I J J J # L
( 2 2D %%&<=== %%jjj1111&-ll:&>&># ''2 /222J?? hm-=>> ) ? JM - -c 2 2 2L**\**0077>>vFF $Xz7CCGMM"344 337333& r> c x |r&|r$|t j |k t j |k z z }||| j |k z }| t j | j t | }|t |t | }| S rL ) r2 rZ r rV r COUNTr r ra r$ r scalar)rk r rl rm r rd qs r? r zMalwareHit._hits_numw s R +u4#r)
G sx4' 'G JJrx'' ( ( - -k : : @ @ I I xQ77Axxzzr> c | | j t j | j z ||| S rL )r r not_inr+ CLEANUP malicious)rk rl rm r s r?
malicious_numzMalwareHit.malicious_num s? }}
Z
/ 7
8
83=
H
r> )ignore_cleanedc | j }|r'|| j t j z } | j |g|R i |S rL )r r r r+ r r )rk r argsr r s r? malicious_listzMalwareHit.malicious_list sR - C sz(()9)ABB BG s~g7777777r> c F d |D }d }t ||| || S )Nc g | ] }|j
S r= r r s r? r z)MalwareHit.set_status.. '''3'''r> c d|i}|||d< |j di | |j | S )Nr
cleaned_atr= updatera r rb )r rk r r fields_to_updates r?
expressionz)MalwareHit.set_status..expression U & %1; . 3:11 01177
3HH Hr> r% )rk r r r r s r?
set_statuszMalwareHit.set_status F ''$''' I I I + c6:
r> to_deleteri c F d |D } fd}t || S )Nc g | ] }|j
S r= r r s r? r z/MalwareHit.delete_instances.. s 111SV111r> c j | S rL )deletera r rb )r rk s r? r z/MalwareHit.delete_instances..expression s+ ::<<%%cfjjoo66 6r> r )rk r r s ` r? delete_instanceszMalwareHit.delete_instances sA 11y111 7 7 7 7 7 +:yAAAr> to_updatec |D ][}| D ]D\ }}| D ]\ }}t ||| | E\d S rL )itemssetattrsave)rk r data _instancenew_fields_datafieldrz s r? update_instanceszMalwareHit.update_instances s ! !D.2jjll
!
!* ?$3$9$9$;$; 5 5LE5Iue4444
! ! !r> r c ` | j t j g | j z }|S rL )r rb r+ r r )rk r s r? is_infectedzMalwareHit.is_infected s:
JNN$*
m
r> c | j S rL )r rk s r?
is_suspiciouszMalwareHit.is_suspicious s
~ r> c T fd}t t ||| |d S )Nc |j }| ||j | z }nSr(||j t
j z }n)r'||j t
j z }|5t |t r|g}||j
| z }| | S rL )
r r rb r r r+ r
RESTORABLE
isinstancer r rV ra ) chunk_of_idsrk r r cleanuprestores r? r z/MalwareHit.malicious_select..expression s mG'36::l333
G3:,,-=-EFFF
G3:>>*:*EFFF dC(( " 6D38<<---::<<%%g.. .r> T)exec_expr_with_empty_iterri r' )rk r r r r
r r s `` r? malicious_selectzMalwareHit.malicious_select sS / / / / / / +Cdd
r> statusesc 2 fd}t || S )Nc j | }r |j z } | S rL r rb r rV ra filesr rk r s r? r z'MalwareHit.get_hits..expression T m''..G
43:>>(333::<<%%g.. .r> r' rk r r r s ` ` r? get_hitszMalwareHit.get_hits 4 / / / / / / /z5AAAr> hits_infoSet[MalwareDatabaseHitInfo]c x d |D }d |D }d |D t t t j | t j | }fd|D }|S )Nc g | ] }|j
S r= rX r entrys r? r z*MalwareHit.get_db_hits.. s 333333r> c g | ] }|j
S r= app_namer s r? r z*MalwareHit.get_db_hits.. 6665666r> c * g | ]}|j |j fS r= rX r# r s r? r z*MalwareHit.get_db_hits.. s! JJJuuz5>2JJJr> c 4 g | ]}|j |j fv |S r= r r# r hit
paths_appss r? r z*MalwareHit.get_db_hits.. s3
CM3<#@J#N#NC#N#N#Nr> )ri r rV ra r rb r# )rk r rQ appsr r+ s @r? get_db_hitszMalwareHit.get_db_hits s 3333366I666JJ JJJ
U:'++E22
3
3
U:&**400
1
1
r> list[RemoteRevertHitInfo]c d d |D }d |D }d |D }d |D t t t j | t j | t j | t j t j
}fd|D }|S )Nc g | ] }|j
S r= )
app_root_pathr s r? r z. s <<<$<< c g | ] }|j
S r= r" r s r? r z. r$ r> c g | ] }|j
S r= )sig_idr s r? r z. s :::uel:::r> c 6 g | ]}|j |j |j fS r= )r1 r# r4 r s r? r z. s6
%.%, ?
r> c @ g | ]}|j |j |j fv |S r= )r r# r r) s r? r z. s<
s|S-=>*LL
LLLr> ) ri r db_hitsra r rb r# r^ r r+ r )rk r rQ r,
signaturesr r+ s @r? get_db_hits_for_remote_revertz(MalwareHit.get_db_hits_for_remote_revert s& =<)<<<66I666:: :::
"
"&
U:'++E22
3
3
U:&**400
1
1
U:?&&z22
3
3
U:$(()9)DEE
F
F "
"
r> c . fd}t || S )Nc j | S rL r ra r rb r rk s r? r z*MalwareHit.delete_hits..expression / ::<<%%cm&7&7&>&>?? ?r> r rk r r s ` r? delete_hitszMalwareHit.delete_hits 3 @ @ @ @ @ +:u===r> c j t | | S rL )r^ get_pk_exprr s r? refreshzMalwareHit.refresh s" Dzz~~dmmoo...r> Iterable[MalwareHit]c L fd}t t || S )Nc }r3 t t }| j d | D S )Nc g | ] }|j
S r= r r r* s r? r z?MalwareHit.refresh_hits..expression.." s *B*B*Bc36*B*B*Br> )rV r2 r ra r rb )r rn rk include_scan_infos r? r z+MalwareHit.refresh_hits..expression si JJLLE
G
3 4499+FF;;svzz*B*BT*B*B*B C CDD Dr> r )rk r rK r s ` ` r? refresh_hitszMalwareHit.refresh_hits sC E E E E E E 3JEEFFFr> r} rN c | | j |k | j t
j z | j d z S )NF)rV ra r r rb r+ CLEANEDis_null)rk r} s r?
cleaned_sincezMalwareHit.cleaned_since& s^ zz||!!
^y
(z~~ . 677
9~%%e,,
.
r> r c | | j t j j k S rL )rV ra r` r, ry rz r s r? r7 zMalwareHit.db_hits. s4 zz||!! !8!;!A A
r> c v | | j t j k S )z,Return db hits that are in queue for cleanup)r7 ra r r+ r r s r? db_hits_pending_cleanupz"MalwareHit.db_hits_pending_cleanup4 2 {{}}"" J*: :
r> c v | | j t j k S )z3Return db hits for which the cleanup is in progress)r7 ra r r+ r r s r? db_hits_under_cleanupz MalwareHit.db_hits_under_cleanup; rT r> c v | | j t j k S )z3Return db hits for which the restore is in progressr7 ra r r+ CLEANUP_RESTORE_STARTEDr s r? db_hits_under_restorationz$MalwareHit.db_hits_under_restorationB s2 {{}}"" J*B B
r> c < d |D }d |D }d |D | | j | | j | }fd|D S )z
Return db hits for which the cleanup is in progress
specified by the provided set of MalwareDatabaseHitInfo
c h | ] }|j
S r= r r hit_infos r? z6MalwareHit.db_hits_under_cleanup_in..Q s ???hHM???r> c h | ] }|j
S r= r" r] s r? r_ z6MalwareHit.db_hits_under_cleanup_in..R s GGGh)GGGr> c * h | ]}|j |j fS r= r& r] s r? r_ z6MalwareHit.db_hits_under_cleanup_in..S s/
3;X]H - .
r> c 4 g | ]}|j |j fv |S r= r( )r r* path_app_name_sets r? r z7MalwareHit.db_hits_under_cleanup_in..[ s8
s|,0AAA
AAAr> )rV ra r rb r# )rk hit_info_setpath_set app_name_setrn rc s @r? db_hits_under_cleanup_inz#MalwareHit.db_hits_under_cleanup_inI s @?,???GG,GGG
?K
% % ' '
U3=$$X..
/
/
U3<##L11
2
2
r> c | | j t j t j g S rL )r7 ra r rb r+ CLEANUP_RESTORE_PENDING CLEANUP_REMOTE_RESTORE_PENDINGr s r? db_hits_pending_cleanup_restorez*MalwareHit.db_hits_pending_cleanup_restorea sF {{}}"" JNN$<$C
r> c v | | j t j k S rL rX r s r? db_hits_under_cleanup_restorez(MalwareHit.db_hits_under_cleanup_restorel s0 {{}}"" J*B B
r>
hit_list_listList['MalwareHit'] attribute Dict[str, List['MalwareHit']]c t d t j | D t | }d t j |t | D S )Nc 3 K | ]}|V d S rL r= rJ s r? z0MalwareHit.group_by_attribute..w " I ISS I I I I I Ir> keyc 4 i | ]\ }}|t | S r= ri r
attr_valuer s r?
z1MalwareHit.group_by_attribute..z 4
D
T
r> sorted itertoolschain
from_iterabler groupbyrp rn hit_lists r? group_by_attributez MalwareHit.group_by_attributer I IIO 9 9- H H I I I9%%
$-$5 y))% % %
r> c @ i d| j d| j d| j d| j j d| j d| j j d| j d| j d | j d
| j d | j
d | j d
| j di d| j
d| j d| j | j | j | j t$ j j k ret+ t, t, j t, j t, j t, j | j k t, j | j k t, j | j k t, j
| j
k t, j | j k t, j | j k t, j | j k t, j | j k t, j d t, j d t, j d ng dS )Nr usernamer createdscan_idrS r` r^ hashsizer r r
extra_datadb_namer# db_hostF)db_portsnippet table_fields)!r r r rY rZ scanid_idr^ r` r r r r r r r# r r r r, ry rz ri MalwareHistoryrV
table_name table_field
table_row_infra rX r r rO rj r s r? r zMalwareHit.as_dict s- -
$'-
-
DN-
t{* -
t~ -
)
-
T /-
DI-
DI-
DI-
-
dk-
$/-
" -
t| -
!-
"
t|#-
$ ||. %)@)C)III+ "))&1&2&4
U&/4=@&.$,>&.$,>&.$,>&+t~=&48JJ&.$+=&3ty@&199%@@&2::5AA&4< c | | j r | j j d| j d| j dS | j j d| j dS )Nz (orig_file=z , app_name=r )r# __class__r7 r r s r? __repr__zMalwareHit.__repr__ sT = '''
&*^%<%<% )r r ) r NNNNNNNNNNN)r r )NNNNNrL )r ri )r ri )r r )NNFF)r r )r r. )F)r rF )r} rN )r r )rn ro rp r r rq )Gr7 r8 r9 rp r@ r r r r2 rY r ownerr r" r r^ r r r r r r} r+ r r r r rq r, ry rz r{ r` r# r r r r propertyr r r r~ r r r r r r r r r r
r r- r9 r@ rE rL rP r7 rS rV rZ rg rk rm r r r r r= r> r? r r s 44" " " " " " " "
B
_%f F
I5 ! ! !E 9% D
5)))I 9% D
%777I 9$ D 9$ D
%%%I Y / 5
6
6
6F&&&J I
E%,,/28/4:
M yd###HiT"""GiT"""GiT"""GiT"""G
$ $ $ X$ X "
X! X! X! X! [X!t DH [
[
27 8 8 8 8 [8
[
B B B [B ! ! ! [! [ [ 9>
[
. )- B B B B [B [ [0 > > [> / / / G G G G [G
[
[
[
[
[
[
.
[
[
\
.
.
.
`N N N N Nr> r T)frozenc e Zd ZU dZded< ded< ded< ded< ded< d ed
< ded < ded < d ed
< ded< ed Zed ZdS )MalwareHitAlternatezA
Used as a replacement for MalwareHit for file hits only
r rY r Noner# r r rN r r r^ r} boolr c
| ||d |d |d |d |d |d d d |d d d |d d d
S ) Nr r r r r r matchesr}
suspicious)
rY r r# r r r r r^ r} r r= )rk rY filenamer s r? createzMalwareHitAlternate.create ss s w-f f f f a +6l1ok2 v,q/,77
r> c N t t j | j S rL )r osfsdecoder r s r? r z"MalwareHitAlternate.orig_file_path s BK//000r> N) r7 r8 r9 rp __annotations__r~ r r r r= r> r? r r s KKKNNNNNNJJJ
III
III
III
IIINNNOOO
[
1 1 X1 1 1r> r c J e Zd ZdZ G d d ZdZ e Z e Z ed e
d g Z e dd Z
ed
Ze fd Ze fd Ze ddd Zedd Zed Z xZS )MalwareIgnorePathz+A path that must be excluded from all scansc $ e Zd Zej ZdZdZdS )MalwareIgnorePath.Metamalware_ignore_path)))rX r` TN)r7 r8 r9 r! r: r; r< indexesr= r> r? r@ r s ;(6r> r@ NFz resource_type in ('file','db')rE c 8 t t S rL rM r= r> r? rO zMalwareIgnorePath. s #dff++ r> rG c t | | j }|| _ d S rL )ri rV rd rX rj CACHE)rk r s r?
_update_cachez MalwareIgnorePath._update_cache s> SZZ\\**3844::<<== r> c R d | _ t t | j di |S )Nr= )r superr r )rk r r s r? r zMalwareIgnorePath.create s. 3u&,,3==f===r> c ` d | _ t t | S rL )r r r r )rk r s r? r zMalwareIgnorePath.delete s' &,,33555r> r`
str | Nonec \ | | j } | | | j |k } | | | j |k } |-| | j | } | | | j |k } || | } || | } |t || | } |t | }
| | j t |
dz | j t |
k z | j t t | k z } | d } | d | D fS )N/TrT c , g | ]}t | S r= r r s r? r z:MalwareIgnorePath.paths_count_and_list..* s - - -C]3
- - -r> )rV rd rX ra
added_datecontainsr` rg rf r$ r& r r r/ rh ) rk rf rg r r` r rl rm rd r user_homer s r? paths_count_and_listz&MalwareIgnorePath.paths_count_and_list s
JJLL ! !#( + + %/00A
>",--A ))&1122A $)]:;;A A A xa00A 1$77I$$S^^c%9::8s9~~-/8s;t#4#4 5 557 A GGG-- - -1 - - -
r> r List[str]c : | j |i |\ }}d |D S )Nc g | ]
}|d S r r= r s r? r z/MalwareIgnorePath.path_list..0 s 111F 111r> )r )rk r r _ path_lists r? r zMalwareIgnorePath.path_list- s1 /s/@@@ 911y1111r> c K | j | t | }| j rK| j D ]C}t j d d{V t |d }||k s ||j v r dS DdS )zChecks whether path stored in MalwareIgnorePath cache or
if it's belongs to path from cache or if it matches patters from cache
:param str check_path: path to check
:return: bool: is ignored according MalwareIgnorePath
Nr rX TF)r r r asynciosleepparents)rk
check_pathrX r ignored_paths r? is_path_ignoredz!MalwareIgnorePath.is_path_ignored2 s 9 J 9 Y
mA&&&&&&&&& #AfI L((ldl.J.J 44 /Kur> )NNNNNNNN)r` r )r r )r7 r8 r9 rp r@ r r r r rX r r` r r r~ r r r r r r
__classcell__)r s @r? r r s 557 7 7 7 7 7 7 7
E B 9;;D I
'G!H!H I M 52E2EFFFJ [ > > > > [> 6 6 6 6 [6 $(
&
&
&
&
[&
P 2 2 2 [2 [ r> r c e Zd ZdZ G d d Z ed Z ed Z ed e d
e j j
e j j
f ge j j
Z ed Z ed Z ed Z ed Z ed Z edd
Z ed Z ed Z ed Z ed Z ed Z ed Z ed Z ed Z e dd Z e d
Z!e dd Z"e dd Z#d S )r z:Records every event related to :class:`MalwareHit` recordsc e Zd Zej ZdZdS )MalwareHistory.Metamalware_historyNr6 r= r> r? r@ r I s ;$r> r@ FrC TrJ )rD rF rH c 8 t t S rL rM r= r> r? rO zMalwareHistory.j s S[[ r> rG Nc | j |k | j |k z }|r/|| j | t d|f z z }|r|| j |k z }| | | | } |t |t | } t | }
|
d |
fS )Nz(INSTR(path, ?))TrT )ctimeeventr r file_userrV ra rf rg rj r$ r ri rh ) rk rl rm rf rg r r rd r rn list_results r? get_historyzMalwareHistory.get_history| s 9%#)r/: **622& 22
G - s}, ,G
""7++11%88??GGMMOO "8^UCCE5kk {{t{,,k99r> c | j d| dd p t j | dd p t j | dd pt j j d| d S )Nr| causer` )r| r r` r= )
insertpopr ROOTr- MANUALr, r{ rz execute)rk r s r?
save_eventzMalwareHistory.save_event s
jjd33Dx}**Wd++E/E **_d;; 2&+1
')))))r> r
List[dict]c t j 5 t |dt | j j z D ])}| | * d d d d S # 1 swxY w Y d S )Ni )
chunk_size) r! r: atomicr( r _metacolumns insert_manyr )rk r
hits_chunks r? save_eventszMalwareHistory.save_events s
[
!
! 6 6
.CI,=(>(>!>
6
6
++335555
6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6s ABB
BrQ ri rl rN c > | | j t j | j | | j t k z | j |k z | j
S rL ) rV rX r r ra rb r r* r rc tuples)rk rQ rl s r? get_failed_cleanup_events_countz.MalwareHistory.get_failed_cleanup_events_count s{
JJsx , ,
U U##9 1139%'
Xch
VXX
r> )NNN)r r )rQ ri rl rN )$r7 r8 r9 rp r@ r" rX r r# r rq r, ry rz r{ r` r r r|
file_ownerr r r r r r r r r r r r~ r r r r r= r> r? r r F sL DD% % % % % % % %
=e $ $ $Dyd###H I
E%,,/28/4:
(,2
M
I5 ! ! !E
I5 ! ! !E u%%%I&&&J u%%%I Le-@-@ A A AEiT"""GiT"""GiT"""G%%%J)&&&K Ld+++MiT"""G 9$'''LHL: : : [:& [ 6 6 6 [ 6
[
r> r c H e Zd ZdZ G d d Z e Z eeddd Z e
d Z e
d Z e
d Z e
d Z e
d Z e
d Z ed Z e
ej
Z ed Zed Zed$d Zed%d Z eddd Z ed Z e d&d Z ed Z e!d'd Z"ed(d! Z#ed)d" Z$d# Z%dS )*VulnerabilityHitz Represents a vulnerable file.c e Zd Zej ZdZdS )VulnerabilityHit.Metavulnerability_hitsNr6 r= r> r? r@ r s ;'r> r@ Fvulnerabilitiesr r rC Tr c T t t | j }t | S rL r r s r? r z VulnerabilityHit.orig_file_path r r> signaturer r r c , | d S )Nz
VULN-ESUS-)r )rk r s r? matchzVulnerabilityHit.match s ##L111r> ri c t j d| x}r-| d d S g S )NzVULN-ESUS-([\d,]+)r ,)rer groupssplit)rk r r s r? get_vulnerability_idsz&VulnerabilityHit.get_vulnerability_ids sB I 3Y?? ?5 0<<>>!$**3// / r> Nr c 2 fd}t || S )Nc j | }r |j z } | S rL r r s r? r z-VulnerabilityHit.get_hits..expression r r> r r s ` ` r? r zVulnerabilityHit.get_hits r r> c . fd}t || S )Nc j | S rL r< r= s r? r z0VulnerabilityHit.delete_hits..expression r> r> r r? s ` r? r@ z VulnerabilityHit.delete_hits rA r> r c d | | t t } |p
t }d | }
t j |k t j |k z }| |t
d|
f | j |
z z z }||| j |k z }||| j |k z }|
|| j | z z }|}|
|| j
|
z }| |
| | }|t || | }| t! j | j
t | }d |D }||fS )Nz%{}%r c 6 g | ]}| S r= r r s r? r z/VulnerabilityHit._hits_list..( r r> )rV r2 r r rq rZ r r rY r r rb ra rf rg r$ r r r )rk rl rm rf rg r r r rd r r r r r r r r r r s r? r zVulnerabilityHit._hits_list s zz#{++00==
\466--''#+u4 2 %
C07* 7" $
$L CH , ,L ! CJ* 4 4L CJ) 3 3L ( ? CFJJsOO +L**\**0077>>vFF $XsG< c | j |i |S rL )r )rk r r s r? ri zVulnerabilityHit.list, s s~t.v...r> rn List['VulnerabilityHit']rp #Dict[str, List['VulnerabilityHit']]c t d t j | D t | }d t j |t | D S )Nc 3 K | ]}|V d S rL r= rJ s r? rt z6VulnerabilityHit.group_by_attribute..5 ru r> rv c 4 i | ]\ }}|t | S r= ry rz s r? r| z7VulnerabilityHit.group_by_attribute..8 r} r> r~ r s r? r z#VulnerabilityHit.group_by_attribute0 r r> r list[int]c t }|D ]2}|t t |d z }3t | S )Nr^ )setr r ri )rk r vuln_idsr* s r? get_vulnerabilities_idsz(VulnerabilityHit.get_vulnerabilities_ids@ sU 55 C 66s6{CC
HH H~~ r> c F d |D }d }t ||| || S )Nc g | ] }|j
S r= r r s r? r z/VulnerabilityHit.set_status..K r r> c d|i}|||d< |j di | |j | S )Nr
patched_atr= r )r rk r r r s r? r z/VulnerabilityHit.set_status..expressionM r r> r )rk r r r r s r? r zVulnerabilityHit.set_statusI r r> c | j | j | j | j j | j | j j | j | j | j | j | j
d S )N) r r file_pathr r rS r^ r r r r ) r r r rY rZ r r^ r r r r r s r? r zVulnerabilityHit.as_dictZ sN ' {*~ )IIIk /
r> )r r r r )r r r ri )
r NNNNNNNNN)rn r rp r r r )r ri r r
rL )&r7 r8 r9 rp r@ r r r r2 rY r r r r" r r^ r r r r} r.
VULNERABLEr r r r r~ r r r r@ r ri r r r r r r= r> r? r r s ''( ( ( ( ( ( ( (
B
_
& F
I5 ! ! !E 9% D
5)))I 9% D 9$ D 9$ D
%%%I Y 5 @
A
A
AF&&&J
X 2 2 2 [2 [
)- B B B B [B > > [>
1! 1! 1! [1!f / / [/
\
[
[
r> r c D e Zd ZdZ G d d Z ed ZdS )ImunifyPatchSubscriptionz(Stores Imunify Patch user subscriptions.c e Zd Zej ZdZdS ) ImunifyPatchSubscription.Metaimunify_patch_subscriptionsN)r7 r8 r9 r! r: r; r r= r> r? r@ r m s ;2
r> r@ TrA N)r7 r8 r9 rp r@ r user_idr= r> r? r r j sP 223 3 3 3 3 3 3 3 iD)))GGGr> r )Irp
__future__r r r r r r dataclassesr functoolsr r pathlibr r typingr r
r r r
r r peeweer r r r r r r r r r r r r playhouse.shortcutsr defence360agent.contracts.configr defence360agent.modelr r! $defence360agent.model.simplificationr" r# r$ defence360agent.utilsr% r& r' r( imav.api.cleanup_revertr) imav.malwarelib.configr* r+ r, r- r. imav.malwarelib.scan.crontabr/ imav.malwarelib.scan.mds.reportr0 r2 r r r r r r r= r> r? r+ s+ * # " " " " " ! ! ! ! ! ! > > > > > > > > > > > > > > > > > > . - - - - - 5 5 5 5 5 5 1 1 1 1 1 1 1 1
8 7 7 7 7 7 5 4 4 4 4 4 B B B B B BrB rB rB rB rB% rB rB rBjvN vN vN vN vN vN vN vNr $"1 "1 "1 "1 "1 "1 "1 "1Ja a a a a a a aHk
k
k
k
k
U k
k
k
\s
s
s
s
s
u s
s
s
l* * * * *u * * * * *r>