remove aggressive mode from short term roadmap

codeyourweb · codeyourweb · commit 2ccf41cbdcdc · 2021-03-13T22:25:30.000+01:00
diff --git a/README.md b/README.md
@@ -31,27 +31,32 @@ _go-yara_ and CGO compilation. You'll find a detailed documentation [here](READM
 
 ### Usage 
 ```
-usage: irma [-h|--help] [-y|--yara-rules "<value>"] [-d|--dump "<value>"]
+usage: irma [-h|--help] [-c|--network-capture "<value>"] [-b|--bpffilter
+            "<value>"] [-y|--yara-rules "<value>"] [-d|--dump "<value>"]
             [-q|--quarantine "<value>"] [-k|--kill] [-f|--faker]
-            [-n|--notifications] [-v|--verbose]
+            [-n|--notifications] [-v|--verbose] 
 
             Incident Response - Minimal Analysis
 
 Arguments:
 
-  -h  --help           Print help information
-  -y  --yara-rules     Yara rules path (the program will look for *.yar files
-                       recursively). Default: ./yara-signatures
-  -d  --dump           Dump all running process to the specified directory
-  -q  --quarantine     Specify path to store matching artefacts in quarantine
-                       (Base64/RC4 with key: irma
-  -k  --kill           Kill suspicious process ID (without removing process
-                       binary)
-  -f  --faker          Spawn fake processes such as wireshark / procmon /
-                       procdump / x64dbg
-  -n  --notifications  Use Windows notifications when a file or memory stream
-                       match your YARA rules
-  -v  --verbose        Display every error and information messages
+  -h  --help             Print help information
+  -c  --network-capture  Capture network interface to PCAP file. Default:
+  -b  --bpffilter        Use Berkeley Packet Filter to capture only selected
+                         parts of network traffic. Default:
+  -y  --yara-rules       Yara rules path (the program will look for *.yar files
+                         recursively). Default: ./yara-signatures
+  -d  --dump             Dump all running process to the specified directory
+  -q  --quarantine       Specify path to store matching artefacts in quarantine
+                         (Base64/RC4 with key: irma)
+  -k  --kill             Kill suspicious process ID (without removing process
+                         binary)
+  -f  --faker            Spawn fake processes such as wireshark / procmon /
+                         procdump / x64dbg
+  -n  --notifications    Use Windows notifications when a file or memory stream
+                         match your YARA rules
+  -v  --verbose          Display every error and information messages
+
 ``` 
 
 ## About this project and future versions
diff --git a/analysis.go b/analysis.go
@@ -22,7 +22,7 @@ type FileDescriptor struct {
 }
 
 // FileAnalysis sub-routine for file analysis (used in registry / task scheduler / startmenu scan)
-func FileAnalysis(path string, pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules, sourceIndex string) {
+func FileAnalysis(path string, pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules, sourceIndex string) {
 	var f os.FileInfo
 	var err error
 	var content []byte
@@ -91,7 +91,7 @@ func FileAnalysis(path string, pQuarantine string, pKill bool, pAggressive bool,
 }
 
 // MemoryAnalysis sub-routine for running processes analysis
-func MemoryAnalysis(proc *ProcessInformation, pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
+func MemoryAnalysis(proc *ProcessInformation, pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
 	if pVerbose {
 		log.Println("[INFO] [MEMORY] Analyzing", proc.ProcessName, "PID:", proc.PID)
 	}
diff --git a/filehelper.go b/filehelper.go
@@ -13,30 +13,30 @@ import (
 )
 
 // WindowsFileSystemAnalysisRoutine analyse windows filesystem every 300 seconds
-func WindowsFileSystemAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
+func WindowsFileSystemAnalysisRoutine(pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
 	for {
 		env := ListEnvironmentPathFiles(pVerbose)
 		temp := ListTemporaryFiles(pVerbose)
 
 		for _, p := range env {
-			FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "ENV")
+			FileAnalysis(p, pQuarantine, pKill, pNotifications, pVerbose, rules, "ENV")
 		}
 
 		for _, p := range temp {
-			FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "TEMP")
+			FileAnalysis(p, pQuarantine, pKill, pNotifications, pVerbose, rules, "TEMP")
 		}
 
 		time.Sleep(300 * time.Second)
 	}
 }
 
 // UserFileSystemAnalysisRoutine analyse windows filesystem every 60 seconds
-func UserFileSystemAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
+func UserFileSystemAnalysisRoutine(pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
 	for {
 		files := ListUserWorkspaceFiles(pVerbose)
 
 		for _, p := range files {
-			FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "USER")
+			FileAnalysis(p, pQuarantine, pKill, pNotifications, pVerbose, rules, "USER")
 		}
 		time.Sleep(60 * time.Second)
 	}
diff --git a/main.go b/main.go
@@ -53,12 +53,11 @@ func main() {
 	pBpfFilter := parser.String("b", "bpffilter", &argparse.Options{Required: false, Default: "", Help: "Use Berkeley Packet Filter to capture only selected parts of network traffic"})
 	pYaraPath := parser.String("y", "yara-rules", &argparse.Options{Required: false, Default: "./yara-signatures", Help: "Yara rules path (the program will look for *.yar files recursively)"})
 	pDump := parser.String("d", "dump", &argparse.Options{Required: false, Help: "Dump all running process to the specified directory"})
-	pQuarantine := parser.String("q", "quarantine", &argparse.Options{Required: false, Help: "Specify path to store matching artefacts in quarantine (Base64/RC4 with key: irma"})
+	pQuarantine := parser.String("q", "quarantine", &argparse.Options{Required: false, Help: "Specify path to store matching artefacts in quarantine (Base64/RC4 with key: irma)"})
 	pKill := parser.Flag("k", "kill", &argparse.Options{Required: false, Help: "Kill suspicious process ID (without removing process binary)"})
 	pFaker := parser.Flag("f", "faker", &argparse.Options{Required: false, Help: "Spawn fake processes such as wireshark / procmon / procdump / x64dbg"})
 	pNotifications := parser.Flag("n", "notifications", &argparse.Options{Required: false, Help: "Use Windows notifications when a file or memory stream match your YARA rules"})
 	pVerbose := parser.Flag("v", "verbose", &argparse.Options{Required: false, Help: "Display every error and information messages"})
-	pAggressive := parser.Flag("a", "aggressive", &argparse.Options{Required: false, Help: "Aggressive mode - remove suscpicious process executable / track and kill suspicious PPID / remove schedule task & regkey persistence"})
 
 	err = parser.Parse(os.Args)
 	if err != nil {
@@ -102,12 +101,12 @@ func main() {
 	if len(*pNetworkCapturePath) > 0 {
 		go NetworkAnalysisRoutine(*pBpfFilter, *pNetworkCapturePath, *pVerbose)
 	}
-	go MemoryAnalysisRoutine(*pDump, *pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
-	go RegistryAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
-	go StartMenuAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
-	go TaskSchedulerAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
-	go WindowsFileSystemAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
-	go UserFileSystemAnalysisRoutine(*pQuarantine, *pKill, *pAggressive, *pNotifications, *pVerbose, rules)
+	go MemoryAnalysisRoutine(*pDump, *pQuarantine, *pKill, *pNotifications, *pVerbose, rules)
+	go RegistryAnalysisRoutine(*pQuarantine, *pKill, *pNotifications, *pVerbose, rules)
+	go StartMenuAnalysisRoutine(*pQuarantine, *pKill, *pNotifications, *pVerbose, rules)
+	go TaskSchedulerAnalysisRoutine(*pQuarantine, *pKill, *pNotifications, *pVerbose, rules)
+	go WindowsFileSystemAnalysisRoutine(*pQuarantine, *pKill, *pNotifications, *pVerbose, rules)
+	go UserFileSystemAnalysisRoutine(*pQuarantine, *pKill, *pNotifications, *pVerbose, rules)
 	<-exit
 
 }
diff --git a/procsmemory.go b/procsmemory.go
@@ -23,7 +23,7 @@ type ProcessInformation struct {
 }
 
 // MemoryAnalysisRoutine analyse processes memory every 5 seconds
-func MemoryAnalysisRoutine(pDump string, pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
+func MemoryAnalysisRoutine(pDump string, pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
 	for {
 		// list process information and memory
 		procs := ListProcess(pVerbose)
@@ -43,11 +43,11 @@ func MemoryAnalysisRoutine(pDump string, pQuarantine string, pKill bool, pAggres
 				KillProcessByID(proc.PID, pVerbose)
 			} else {
 				// analyzing process memory and cleaning memory buffer
-				MemoryAnalysis(&proc, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules)
+				MemoryAnalysis(&proc, pQuarantine, pKill, pNotifications, pVerbose, rules)
 				proc.MemoryDump = nil
 
 				// analyzing process executable
-				FileAnalysis(proc.ProcessPath, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "MEMORY")
+				FileAnalysis(proc.ProcessPath, pQuarantine, pKill, pNotifications, pVerbose, rules, "MEMORY")
 			}
 		}
 
diff --git a/windowslnkparser.go b/windowslnkparser.go
@@ -11,7 +11,7 @@ import (
 )
 
 // StartMenuAnalysisRoutine analyse system artefacts every 15 seconds
-func StartMenuAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
+func StartMenuAnalysisRoutine(pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
 	for {
 		lnk, errors := ListStartMenuLnkPersistence(pVerbose)
 		if errors != nil && pVerbose {
@@ -23,7 +23,7 @@ func StartMenuAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool,
 		for _, l := range lnk {
 			paths := FormatPathFromComplexString(l)
 			for _, p := range paths {
-				FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "STARTMENU")
+				FileAnalysis(p, pQuarantine, pKill, pNotifications, pVerbose, rules, "STARTMENU")
 			}
 		}
 
diff --git a/windowsregistry.go b/windowsregistry.go
@@ -19,7 +19,7 @@ type RegistryValue struct {
 }
 
 // RegistryAnalysisRoutine analyse registry persistence keys every 15 seconds
-func RegistryAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
+func RegistryAnalysisRoutine(pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
 	for {
 		values, errors := EnumRegistryPeristence()
 
@@ -32,7 +32,7 @@ func RegistryAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, p
 		for _, k := range values {
 			paths := FormatPathFromComplexString(k.value)
 			for _, p := range paths {
-				FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "REGISTRY")
+				FileAnalysis(p, pQuarantine, pKill, pNotifications, pVerbose, rules, "REGISTRY")
 			}
 		}
 
diff --git a/windowstaskscheduler.go b/windowstaskscheduler.go
@@ -36,7 +36,7 @@ var (
 var taskSchedulerInitialized bool = false
 
 // TaskSchedulerAnalysisRoutine analyse Windows Task Scheduler executable every 15 seconds
-func TaskSchedulerAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
+func TaskSchedulerAnalysisRoutine(pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {
 	for {
 		defer UninitializeTaskScheduler()
 		tasks, err := GetTasks()
@@ -48,7 +48,7 @@ func TaskSchedulerAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bo
 			for _, e := range t.ActionList {
 				paths := FormatPathFromComplexString(e.Path)
 				for _, p := range paths {
-					FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "TASKS")
+					FileAnalysis(p, pQuarantine, pKill, pNotifications, pVerbose, rules, "TASKS")
 				}
 			}
 		}

Original file line number	Diff line number	Diff line change
`@@ -22,7 +22,7 @@ type FileDescriptor struct {`
`22`	`22`	`}`
`23`	`23`
`24`	`24`	`// FileAnalysis sub-routine for file analysis (used in registry / task scheduler / startmenu scan)`
`25`		`-func FileAnalysis(path string, pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules, sourceIndex string) {`
	`25`	`+func FileAnalysis(path string, pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules, sourceIndex string) {`
`26`	`26`	`var f os.FileInfo`
`27`	`27`	`var err error`
`28`	`28`	`var content []byte`
`@@ -91,7 +91,7 @@ func FileAnalysis(path string, pQuarantine string, pKill bool, pAggressive bool,`
`91`	`91`	`}`
`92`	`92`
`93`	`93`	`// MemoryAnalysis sub-routine for running processes analysis`
`94`		`-func MemoryAnalysis(proc ProcessInformation, pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules yara.Rules) {`
	`94`	`+func MemoryAnalysis(proc ProcessInformation, pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules yara.Rules) {`
`95`	`95`	`if pVerbose {`
`96`	`96`	`log.Println("[INFO] [MEMORY] Analyzing", proc.ProcessName, "PID:", proc.PID)`
`97`	`97`	`}`
Original file line number	Diff line number	Diff line change
`@@ -13,30 +13,30 @@ import (`
`13`	`13`	`)`
`14`	`14`
`15`	`15`	`// WindowsFileSystemAnalysisRoutine analyse windows filesystem every 300 seconds`
`16`		`-func WindowsFileSystemAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {`
	`16`	`+func WindowsFileSystemAnalysisRoutine(pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {`
`17`	`17`	`for {`
`18`	`18`	`env := ListEnvironmentPathFiles(pVerbose)`
`19`	`19`	`temp := ListTemporaryFiles(pVerbose)`
`20`	`20`
`21`	`21`	`for _, p := range env {`
`22`		`- FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "ENV")`
	`22`	`+ FileAnalysis(p, pQuarantine, pKill, pNotifications, pVerbose, rules, "ENV")`
`23`	`23`	`}`
`24`	`24`
`25`	`25`	`for _, p := range temp {`
`26`		`- FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "TEMP")`
	`26`	`+ FileAnalysis(p, pQuarantine, pKill, pNotifications, pVerbose, rules, "TEMP")`
`27`	`27`	`}`
`28`	`28`
`29`	`29`	`time.Sleep(300 * time.Second)`
`30`	`30`	`}`
`31`	`31`	`}`
`32`	`32`
`33`	`33`	`// UserFileSystemAnalysisRoutine analyse windows filesystem every 60 seconds`
`34`		`-func UserFileSystemAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {`
	`34`	`+func UserFileSystemAnalysisRoutine(pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {`
`35`	`35`	`for {`
`36`	`36`	`files := ListUserWorkspaceFiles(pVerbose)`
`37`	`37`
`38`	`38`	`for _, p := range files {`
`39`		`- FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "USER")`
	`39`	`+ FileAnalysis(p, pQuarantine, pKill, pNotifications, pVerbose, rules, "USER")`
`40`	`40`	`}`
`41`	`41`	`time.Sleep(60 * time.Second)`
`42`	`42`	`}`
Original file line number	Diff line number	Diff line change
`@@ -23,7 +23,7 @@ type ProcessInformation struct {`
`23`	`23`	`}`
`24`	`24`
`25`	`25`	`// MemoryAnalysisRoutine analyse processes memory every 5 seconds`
`26`		`-func MemoryAnalysisRoutine(pDump string, pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {`
	`26`	`+func MemoryAnalysisRoutine(pDump string, pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {`
`27`	`27`	`for {`
`28`	`28`	`// list process information and memory`
`29`	`29`	`procs := ListProcess(pVerbose)`
`@@ -43,11 +43,11 @@ func MemoryAnalysisRoutine(pDump string, pQuarantine string, pKill bool, pAggres`
`43`	`43`	`KillProcessByID(proc.PID, pVerbose)`
`44`	`44`	`} else {`
`45`	`45`	`// analyzing process memory and cleaning memory buffer`
`46`		`- MemoryAnalysis(&proc, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules)`
	`46`	`+ MemoryAnalysis(&proc, pQuarantine, pKill, pNotifications, pVerbose, rules)`
`47`	`47`	`proc.MemoryDump = nil`
`48`	`48`
`49`	`49`	`// analyzing process executable`
`50`		`- FileAnalysis(proc.ProcessPath, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "MEMORY")`
	`50`	`+ FileAnalysis(proc.ProcessPath, pQuarantine, pKill, pNotifications, pVerbose, rules, "MEMORY")`
`51`	`51`	`}`
`52`	`52`	`}`
`53`	`53`
Original file line number	Diff line number	Diff line change
`@@ -11,7 +11,7 @@ import (`
`11`	`11`	`)`
`12`	`12`
`13`	`13`	`// StartMenuAnalysisRoutine analyse system artefacts every 15 seconds`
`14`		`-func StartMenuAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {`
	`14`	`+func StartMenuAnalysisRoutine(pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {`
`15`	`15`	`for {`
`16`	`16`	`lnk, errors := ListStartMenuLnkPersistence(pVerbose)`
`17`	`17`	`if errors != nil && pVerbose {`
`@@ -23,7 +23,7 @@ func StartMenuAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool,`
`23`	`23`	`for _, l := range lnk {`
`24`	`24`	`paths := FormatPathFromComplexString(l)`
`25`	`25`	`for _, p := range paths {`
`26`		`- FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "STARTMENU")`
	`26`	`+ FileAnalysis(p, pQuarantine, pKill, pNotifications, pVerbose, rules, "STARTMENU")`
`27`	`27`	`}`
`28`	`28`	`}`
`29`	`29`
Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ type RegistryValue struct {`
`19`	`19`	`}`
`20`	`20`
`21`	`21`	`// RegistryAnalysisRoutine analyse registry persistence keys every 15 seconds`
`22`		`-func RegistryAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {`
	`22`	`+func RegistryAnalysisRoutine(pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {`
`23`	`23`	`for {`
`24`	`24`	`values, errors := EnumRegistryPeristence()`
`25`	`25`
`@@ -32,7 +32,7 @@ func RegistryAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, p`
`32`	`32`	`for _, k := range values {`
`33`	`33`	`paths := FormatPathFromComplexString(k.value)`
`34`	`34`	`for _, p := range paths {`
`35`		`- FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "REGISTRY")`
	`35`	`+ FileAnalysis(p, pQuarantine, pKill, pNotifications, pVerbose, rules, "REGISTRY")`
`36`	`36`	`}`
`37`	`37`	`}`
`38`	`38`
Original file line number	Diff line number	Diff line change
`@@ -36,7 +36,7 @@ var (`
`36`	`36`	`var taskSchedulerInitialized bool = false`
`37`	`37`
`38`	`38`	`// TaskSchedulerAnalysisRoutine analyse Windows Task Scheduler executable every 15 seconds`
`39`		`-func TaskSchedulerAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {`
	`39`	`+func TaskSchedulerAnalysisRoutine(pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules) {`
`40`	`40`	`for {`
`41`	`41`	`defer UninitializeTaskScheduler()`
`42`	`42`	`tasks, err := GetTasks()`
`@@ -48,7 +48,7 @@ func TaskSchedulerAnalysisRoutine(pQuarantine string, pKill bool, pAggressive bo`
`48`	`48`	`for _, e := range t.ActionList {`
`49`	`49`	`paths := FormatPathFromComplexString(e.Path)`
`50`	`50`	`for _, p := range paths {`
`51`		`- FileAnalysis(p, pQuarantine, pKill, pAggressive, pNotifications, pVerbose, rules, "TASKS")`
	`51`	`+ FileAnalysis(p, pQuarantine, pKill, pNotifications, pVerbose, rules, "TASKS")`
`52`	`52`	`}`
`53`	`53`	`}`
`54`	`54`	`}`