Exemplo n.º 1
0
    def _ProcessRegistryKeySource(self, source):
        """Glob for paths in the registry."""
        keys = source.base_source.attributes.get("keys", [])
        if not keys:
            return

        interpolated_paths = artifact_utils.InterpolateListKbAttributes(
            input_list=keys,
            knowledge_base=self.knowledge_base,
            ignore_errors=self.ignore_interpolation_errors)

        glob_expressions = map(rdf_paths.GlobExpression, interpolated_paths)

        patterns = []
        for pattern in glob_expressions:
            patterns.extend(
                pattern.Interpolate(knowledge_base=self.knowledge_base))
        patterns.sort(key=len, reverse=True)

        file_finder_action = rdf_file_finder.FileFinderAction.Stat()
        request = rdf_file_finder.FileFinderArgs(
            paths=patterns,
            action=file_finder_action,
            follow_links=True,
            pathtype=rdf_paths.PathSpec.PathType.REGISTRY)
        action = file_finder.RegistryKeyFromClient

        yield action, request
Exemplo n.º 2
0
    def _ProcessGrepSource(self, source):
        """Find files fulfilling regex conditions."""
        attributes = source.base_source.attributes
        paths = artifact_utils.InterpolateListKbAttributes(
            attributes["paths"], self.knowledge_base,
            self.ignore_interpolation_errors)
        regex_list = artifact_utils.InterpolateListKbAttributes(
            attributes["content_regex_list"], self.knowledge_base,
            self.ignore_interpolation_errors)
        regex = utils.RegexListDisjunction(regex_list)
        condition = rdf_file_finder.FileFinderCondition.ContentsRegexMatch(
            regex=regex, mode="ALL_HITS")
        file_finder_action = rdf_file_finder.FileFinderAction.Stat()
        request = rdf_file_finder.FileFinderArgs(paths=paths,
                                                 action=file_finder_action,
                                                 conditions=[condition],
                                                 follow_links=True)
        action = file_finder.FileFinderOSFromClient

        yield action, request
Exemplo n.º 3
0
  def _ProcessFileSource(self, source):
    """Glob paths and return StatEntry objects."""

    if source.path_type != rdf_paths.PathSpec.PathType.OS:
      raise ValueError("Only supported path type is OS.")

    paths = artifact_utils.InterpolateListKbAttributes(
        source.base_source.attributes["paths"], self.knowledge_base,
        self.ignore_interpolation_errors)

    file_finder_action = rdf_file_finder.FileFinderAction.Stat()
    request = rdf_file_finder.FileFinderArgs(
        paths=paths, pathtype=source.path_type, action=file_finder_action)
    action = file_finder.FileFinderOSFromClient

    yield action, request