def _ProcessRegistryKeySource(self, source):
"""Glob for paths in the registry."""
keys = source.base_source.attributes.get("keys", [])
if not keys:
return
interpolated_paths = artifact_utils.InterpolateListKbAttributes(
input_list=keys,
knowledge_base=self.knowledge_base,
ignore_errors=self.ignore_interpolation_errors)
glob_expressions = map(rdf_paths.GlobExpression, interpolated_paths)
patterns = []
for pattern in glob_expressions:
patterns.extend(
pattern.Interpolate(knowledge_base=self.knowledge_base))
patterns.sort(key=len, reverse=True)
file_finder_action = rdf_file_finder.FileFinderAction.Stat()
request = rdf_file_finder.FileFinderArgs(
paths=patterns,
action=file_finder_action,
follow_links=True,
pathtype=rdf_paths.PathSpec.PathType.REGISTRY)
action = file_finder.RegistryKeyFromClient
yield action, request
def _ProcessGrepSource(self, source):
"""Find files fulfilling regex conditions."""
attributes = source.base_source.attributes
paths = artifact_utils.InterpolateListKbAttributes(
attributes["paths"], self.knowledge_base,
self.ignore_interpolation_errors)
regex_list = artifact_utils.InterpolateListKbAttributes(
attributes["content_regex_list"], self.knowledge_base,
self.ignore_interpolation_errors)
regex = utils.RegexListDisjunction(regex_list)
condition = rdf_file_finder.FileFinderCondition.ContentsRegexMatch(
regex=regex, mode="ALL_HITS")
file_finder_action = rdf_file_finder.FileFinderAction.Stat()
request = rdf_file_finder.FileFinderArgs(paths=paths,
action=file_finder_action,
conditions=[condition],
follow_links=True)
action = file_finder.FileFinderOSFromClient
yield action, request
def _ProcessFileSource(self, source):
"""Glob paths and return StatEntry objects."""
if source.path_type != rdf_paths.PathSpec.PathType.OS:
raise ValueError("Only supported path type is OS.")
paths = artifact_utils.InterpolateListKbAttributes(
source.base_source.attributes["paths"], self.knowledge_base,
self.ignore_interpolation_errors)
file_finder_action = rdf_file_finder.FileFinderAction.Stat()
request = rdf_file_finder.FileFinderArgs(
paths=paths, pathtype=source.path_type, action=file_finder_action)
action = file_finder.FileFinderOSFromClient
yield action, request