gj d Z ddlmZ ddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl m Z ddl
mZmZmZmZmZ dd lmZmZmZmZmZmZmZmZm Z m Z m Z m Z dd
l m!Z! dd l"m#Z# dd l$m%Z%m&Z& dd
l'm(Z(m)Z)m*Z* ddl+m,Z,m-Z-m.Z.m/Z/ ddl0m1Z1m2Z2m3Z3m4Z4 ddl5m6Z6 G d de% Z7 G d de% Z8 ed G d d Z9 G d de% Z: G d d e% Z;dS ) u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
) annotationsN) dataclass)
attrgetter)Path)time)DictIterableListSetcast) BooleanFieldCase CharFieldCheck
Expression
FloatFieldForeignKeyField IntegerFieldPrimaryKeyFieldSQL TextFieldfn
model_to_dict)UserType)Modelinstance)
FilenameField
ScanPathFieldapply_order_by)execute_iterable_expressionget_abspath_from_user_dir get_results_iterable_expressionsplit_for_chunk)FAILED_TO_CLEANUPMalwareHitStatusMalwareScanResourceTypeMalwareScanType) get_crontabc b e Zd ZdZ G d d Z ed Z ed Z ed Z ed e
d e j
e j e j e j e j e j e j f g Z edd
Z edd Z edd
Z edd
Z ed e
d ej j ej j f g Z ed Z e! de j
e j e j fd
dd Z"d
S ) MalwareScanzRepresents a batch of files scanned for malware
Usually a single AI-BOLIT execution.
See :class:`.MalwareScanType` for possible kinds of scans.
c e Zd Zej ZdZdS )MalwareScan.Meta
malware_scansN__name__
__module__ __qualname__r dbdatabasedb_table J/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/model.pyMetar- N s ;"r7 r9 T) primary_keyFnullz
type in {}r< constraintsr r< default Nresource_type in {})typespathsc v | | j | j | j | j | j | j | j | j d | j
| j | | j |k | j |k }|r-| | j | }|
| j | j | j | j t j | | }|t' || | }| d t+ | fS )N scan_typeT clear_limit)selecttotal_resourcespathscanidstarted completederrortotal_malicioustypealias
resource_typewherein_group_byorder_byr+ desclimitoffsetr countlistdicts) clssincetorY rZ rW rC rD querys r8
ondemand_listzMalwareScan.ondemand_list sd "
JJ#
#{++!
U38<<&&
'
'
U3;%'
(
(
U3;"$
%
% " 5KK U 3 344E
NN#SXsz3;
Xk)..00
1
1
U5\\
VF^^
"8S%88E{{t{,,d5;;==.A.AAAr7 N)#r0 r1 r2 __doc__r9 r rL r rM rN r formatr( ON_DEMANDREALTIMEMALWARE_RESPONSE
BACKGROUNDRESCANUSERRESCAN_OUTDATEDrQ rJ r rK r rO rP r' DBvalueFILErS initiator classmethodrb r6 r7 r8 r+ r+ G s # # # # # # # #
Y4
(
(
(Fl&&&G $'''I 9
E ##'1'0'8'2'.','7
D& #lq999O =dB / / /D
I4 . . .E"lq999O I
E%,,/28/4:
M t$$$I
/B
% &
/B /B /B /B [/B /B /Br7 r+ c e Zd ZdZ G d d Z e Z eeddd Z e
d Z e
d Z e
d Z e
d Z edd Z e
d
Z e
d
Z ed
Z e
ej Z ed
Z e
d ed e j j e j j f g
Z e
d
Z! e
d
Z" e
d
Z# e
d
Z$ e
d
Z%e&d Z' G d d Z(e) dd Z-e)ddd Z.e)d>d Z/e)d?d Z0e)d@d Z1e)dAd! Z2e)d" Z3e) dBd# Z4e)dd$d% Z5e)dCd( Z6e)d) Z7d* Z8e)dDdEd, Z9e)d- Z:e)dAd. Z;e)dAd/ Ze)d2 Z?e)d3 Z@eAdFd9 ZBd: ZCd; ZDdS )G
MalwareHitz*Represents a malicious or suspicious file.c e Zd Zej ZdZdS )MalwareHit.Meta malware_hitsNr/ r6 r7 r8 r9 ru s ;!r7 r9 FhitsCASCADE)r< related_name on_deleter; r? T)r@ rB r= c T t t | j }t | S rc )r str orig_filer )selfr} s r8 orig_file_pathzMalwareHit.orig_file_path s dn-- I r7 c $ e Zd Zed ZdS )MalwareHit.OrderByc t t j t j dft j dft j dft j dft j dffd fS )Nr d ) r rs statusr& CLEANUP_PENDINGCLEANUP_STARTEDFOUND CLEANUP_DONECLEANUP_REMOVEDr6 r7 r8 r zMalwareHit.OrderBy.status sb %)91=)91=)/3)6:)91=
r7 N)r0 r1 r2 staticmethodr r6 r7 r8 OrderByr s-
r7 r r Nc | | t t }
|p
t }d | }t j |k t j |k z }||z }| |t
d|f | j |z z z }||t j |k z }||t j |k z }|
|t j
|
z z }|}| "|t j | z }|
| | | }| t! | t | }| | }d |D }||fS )Nz%{}%z CAST(orig_file AS TEXT) LIKE ?c 6 g | ]}| S r6 )as_dict.0rows r8
z)MalwareHit._hits_list..7 s 333C#++--333r7 )rI r+ joinr re rM r userrs rL r idrU rT rY rZ r _hits_num)r^ clausesr_ r` rY rZ search
by_scan_idr rW by_statusidskwargsrw patternrM full_clausesmax_count_clausesordered max_countresults r8
_hits_listzMalwareHit._hits_list s{ zz#{++00==
\466--'' &%/K4G24MN ( C07* 7" $
$L JOt 3 3L ! K .* < >vFF $Xz7CCGMM"344 337333& r7 c H | j | g|R i |S rc )r
is_suspicious)r^ argsr s r8 suspicious_listzMalwareHit.suspicious_list; s0 s~c / / 1 1CDCCCFCCCr7 c x |r&|r$|t j |k t j |k z z }||| j |k z }| t j | j t | }|t |t | }| S rc ) r+ rM r rI r COUNTr r rT r rs scalar)r^ r r_ r` r rW qs r8 r zMalwareHit._hits_num? s R +u4#r)
G sx4' 'G JJrx'' ( ( - -k : : @ @ I I xQ77Axxzzr7 c | | j t j | j z ||| S rc )r r not_inr& CLEANUP malicious)r^ r_ r` r s r8
malicious_numzMalwareHit.malicious_numN s? }}
Z
/ 7
8
83=
H
r7 )ignore_cleanedc | j }|r'|| j t j z } | j |g|R i |S rc )r r r r& r r )r^ r r r r s r8 malicious_listzMalwareHit.malicious_listW sR - C sz(()9)ABB BG s~g7777777r7 c F d |D }d }t ||| || S )Nc g | ] }|j
S r6 r r s r8 r z)MalwareHit.set_status..` s '''3'''r7 c d|i}|||d< |j di | |j | S )Nr
cleaned_atr6 )updaterT r rU )r r^ r r fields_to_updates r8
expressionz)MalwareHit.set_status..expressionb sU & %1; . 3:11 01177
3HH Hr7 r! )r^ rw r r r s r8
set_statuszMalwareHit.set_status^ sF ''$''' I I I + c6:
r7 to_deleter\ c F d |D } fd}t || S )Nc g | ] }|j
S r6 r r s r8 r z/MalwareHit.delete_instances..q s 111SV111r7 c j | S rc )deleterT r rU )r r^ s r8 r z/MalwareHit.delete_instances..expressions s+ ::<<%%cfjjoo66 6r7 r )r^ r r s ` r8 delete_instanceszMalwareHit.delete_instanceso sA 11y111 7 7 7 7 7 +:yAAAr7 to_updatec |D ]V}| D ]?\ }}| D ]\ }}t ||| |j @Wd S rc )itemssetattrsave)r^ r datar new_fields_datafieldrn s r8 update_instanceszMalwareHit.update_instancesx s D-1ZZ\\
)/$3$9$9$;$; 4 4LE5HeU3333
r7 returnr c ` | j t j g | j z }|S rc )r rU r& r r )r^ r s r8 is_infectedzMalwareHit.is_infected s:
JNN$*
m
r7 c | j S rc )r r^ s r8 r zMalwareHit.is_suspicious s
~ r7 c T fd}t t ||| |d S )Nc |j }| ||j | z }nSr(||j t
j z }n)r'||j t
j z }|5t |t r|g}||j
| z }| | S rc )
r r rU r r r& r
RESTORABLE
isinstancer| r rI rT ) chunk_of_idsr^ r r cleanuprestores r8 r z/MalwareHit.malicious_select..expression s mG'36::l333
G3:,,-=-EFFF
G3:>>*:*EFFF dC(( " 6D38<<---::<<%%g.. .r7 T)exec_expr_with_empty_iterr\ r# )r^ r r r r r r s `` r8 malicious_selectzMalwareHit.malicious_select sS / / / / / / +Cdd
r7 )statusesc 2 fd}t || S )Nc j | }r |j z } | S rc )r} rU r rI rT )filesr r^ r s r8 r z'MalwareHit.get_hits..expression sT m''..G
43:>>(333::<<%%g.. .r7 )r# )r^ r r r s ` ` r8 get_hitszMalwareHit.get_hits s4 / / / / / / /z5AAAr7 hits_infor c x d |D }d |D }d |D t t t j | t j | }fd|D }|S )Nc g | ] }|j
S r6 rK r entrys r8 r z*MalwareHit.get_db_hits.. s 333333r7 c g | ] }|j
S r6 app_namer s r8 r z*MalwareHit.get_db_hits.. s 6665666r7 c * g | ]}|j |j fS r6 rK r r s r8 r z*MalwareHit.get_db_hits.. s! JJJuuz5>2JJJr7 c 4 g | ]}|j |j fv |S r6 r} r )r hit
paths_appss r8 r z*MalwareHit.get_db_hits.. s3
CM3<#@J#N#NC#N#N#Nr7 )r\ rs rI rT r} rU r )r^ r rD appsrw r s @r8 get_db_hitszMalwareHit.get_db_hits s 3333366I666JJ JJJ
U:'++E22
3
3
U:&**400
1
1
r7 c . fd}t || S )Nc j | S rc )r rT r} rU )r r^ s r8 r z*MalwareHit.delete_hits..expression s/ ::<<%%cm&7&7&>&>?? ?r7 r )r^ r r s ` r8 delete_hitszMalwareHit.delete_hits s3 @ @ @ @ @ +:u===r7 c j t | | S rc )rQ get_pk_exprr~ s r8 refreshzMalwareHit.refresh s" Dzz~~dmmoo...r7 Iterable[MalwareHit]c L fd}t t || S )Nc }r3 t t }| j d | D S )Nc g | ] }|j
S r6 r r r s r8 r z?MalwareHit.refresh_hits..expression.. s *B*B*Bc36*B*B*Br7 )rI r+ r rT r rU )rw ra r^ include_scan_infos r8 r z+MalwareHit.refresh_hits..expression si JJLLE
G
3 4499+FF;;svzz*B*BT*B*B*B C CDD Dr7 r )r^ rw r r s ` ` r8 refresh_hitszMalwareHit.refresh_hits sC E E E E E E 3JEEFFFr7 c | | j t j j k S rc )rI rT rS r' rm rn r s r8 db_hitszMalwareHit.db_hits s4 zz||!! !8!;!A A
r7 c v | | j t j k S )z,Return db hits that are in queue for cleanup)r rT r r& r r s r8 db_hits_pending_cleanupz"MalwareHit.db_hits_pending_cleanup 2 {{}}"" J*: :
r7 c v | | j t j k S )z3Return db hits for which the cleanup is in progress)r rT r r& r r s r8 db_hits_under_cleanupz MalwareHit.db_hits_under_cleanup r r7 c v | | j t j k S )z3Return db hits for which the restore is in progressr rT r r& CLEANUP_RESTORE_STARTEDr s r8 db_hits_under_restorationz$MalwareHit.db_hits_under_restoration s2 {{}}"" J*B B
r7 c < d |D }d |D }d |D | | j | | j | }fd|D S )z
Return db hits for which the cleanup is in progress
specified by the provided set of MalwareDatabaseHitInfo
c h | ] }|j
S r6 r r hit_infos r8 z6MalwareHit.db_hits_under_cleanup_in.. s ???hHM???r7 c h | ] }|j
S r6 r r s r8 r z6MalwareHit.db_hits_under_cleanup_in.. s GGGh)GGGr7 c * h | ]}|j |j fS r6 r r s r8 r z6MalwareHit.db_hits_under_cleanup_in.. s/
3;X]H - .
r7 c 4 g | ]}|j |j fv |S r6 r )r r path_app_name_sets r8 r z7MalwareHit.db_hits_under_cleanup_in.. s8
s|,0AAA
AAAr7 )r rT r} rU r )r^ hit_info_setpath_set app_name_setra r s @r8 db_hits_under_cleanup_inz#MalwareHit.db_hits_under_cleanup_in s @?,???GG,GGG
?K
% % ' '
U3=$$X..
/
/
U3<##L11
2
2
r7 c v | | j t j k S rc )r rT r r& CLEANUP_RESTORE_PENDINGr s r8 db_hits_pending_cleanup_restorez*MalwareHit.db_hits_pending_cleanup_restore 0 {{}}"" J*B B
r7 c v | | j t j k S rc r
r s r8 db_hits_under_cleanup_restorez(MalwareHit.db_hits_under_cleanup_restore r r7
hit_list_listList['MalwareHit'] attributer| Dict[str, List['MalwareHit']]c t d t j | D t | }d t j |t | D S )Nc 3 K | ]}|V d S rc r6 r s r8 z0MalwareHit.group_by_attribute.. s" I ISS I I I I I Ir7 )keyc 4 i | ]\ }}|t | S r6 )r\ )r
attr_valuerw s r8
z1MalwareHit.group_by_attribute.. s4
D
T
r7 )sorted itertoolschain
from_iterabler groupby)r% r# hit_lists r8 group_by_attributez MalwareHit.group_by_attribute s I IIO 9 9- H H I I I9%%
$-$5 y))% % %
r7 c i d| j d| j d| j d| j j d| j d| j j d| j d| j d | j d
| j d | j
d | j d
| j di d| j
d| j d| j | j | j | j t$ j j k rQt+ t, t, j t, j t, j t, j | j k t, j | j k t, j | j k t, j
| j
k t, j | j k t, j | j k t, j | j k t, j d t, j d t, j d
ng dS )Nr usernamefilecreatedscan_idrF rS rQ hashsizer r r
extra_datadb_namer db_hostF)db_portsnippet table_fields) r r r} rL rM scanid_idrQ rS r: r; r r r r= r r> r? r@ r' rm rn r\ MalwareHistoryrI
table_name table_field
table_row_infrT rK r9 is_nullr] r s r8 r zMalwareHit.as_dict$ s ,
$',
,
DN,
t{* ,
t~ ,
)
,
T /,
DI,
DI,
DI,
,
dk,
$/,
" ,
t| ,
!,
"
t|#,
$ ||, %)@)C)III) "))&1&2&4
U&/4=@&.$,>&.$,>&.$,>&+t~=&48JJ&.$+=&199%@@&2::5AA&4< r? r= r@ propertyr r rq r r r r r r r r r r r r r r r r r r r r r r r" r r4 r rK r6 r7 r8 rs rs sc 44" " " " " " " "
B
_%f F
I5 ! ! !E 9% D
5)))I 9% D %777I 9$ D 9$ D
%%%I Y / 5
6
6
6F&&&J I
E%,,/28/4:
M yd###HiT"""GiT"""GiT"""GiT"""G
X "
,! ,! ,! [,!\ D D [D DH [
[
27 8 8 8 8 [8
[
B B B [B [ [ [ 9>
[
. )- B B B B [B [ > > [> / / / G G G G [G
[
[
[
[
[
.
[
[
\
-
-
-
^N N N N Nr7 rs T)frozenc e Zd ZU dZded< ded< ded< ded< ded< d ed
< ded < ded < d ed
< ded< ed Zed ZdS )MalwareHitAlternatezA
Used as a replacement for MalwareHit for file hits only
r| rL r} Noner rL r intr; r: rQ rM boolr c
| ||d |d |d |d |d |d d d |d d d |d d d
S ) NrL r r; r: rw r matchesrM
suspicious)
rL r} r rL r r; r: rQ rM r r6 )r^ rL filenamer s r8 createzMalwareHitAlternate.createo ss s w-f f f f a +6l1ok2 v,q/,77
r7 c N t t j | j S rc )r osfsdecoder} r s r8 r z"MalwareHitAlternate.orig_file_path~ s BK//000r7 N) r0 r1 r2 rd __annotations__rq rY rN r r6 r7 r8 rQ rQ ] s KKKNNNNNNJJJ
III
III
III
IIINNNOOO
[
1 1 X1 1 1r7 rQ c J e Zd ZdZ G d d ZdZ e Z e Z ed e
d g Z e dd Z
ed
Ze fd Ze fd Ze ddd Zedd Zed Z xZS )MalwareIgnorePathz+A path that must be excluded from all scansc $ e Zd Zej ZdZdZdS )MalwareIgnorePath.Metamalware_ignore_path)))rK rS TN)r0 r1 r2 r r3 r4 r5 indexesr6 r7 r8 r9 ra s ;(6r7 r9 NFz resource_type in ('file','db')r= c 8 t t S rc rS r r6 r7 r8 zMalwareIgnorePath. s #dff++ r7 r? c t | | j }|| _ d S rc )r\ rI rW rK r] CACHE)r^ r s r8
_update_cachez MalwareIgnorePath._update_cache s> SZZ\\**3844::<<== r7 c R d | _ t t | j di |S )Nr6 )rh superr_ rY )r^ r rJ s r8 rY zMalwareIgnorePath.create s. 3u&,,3==f===r7 c ` d | _ t t | S rc )rh rk r_ r )r^ rJ s r8 r zMalwareIgnorePath.delete s' &,,33555r7 rS r| c \ | | j } | | | j |k } | | | j |k } |-| | j | } | | | j |k } || | } || | } |t || | } |t | }
| | j t |
dz | j t |
k z | j t t | k z } | d } | d | D fS )N/TrG c , g | ]}t | S r6 r r s r8 r z:MalwareIgnorePath.paths_count_and_list.. s - - -C]3
- - -r7 )rI rW rK rT
added_datecontainsrS rZ rY r r"
startswithr| r) r[ ) r^ rY rZ r rS r r_ r` rW r user_homer s r8 paths_count_and_listz&MalwareIgnorePath.paths_count_and_list s
JJLL ! !#( + + %/00A
>",--A ))&1122A $)]:;;A A A xa00A 1$77I$$S^^c%9::8s9~~-/8s;t#4#4 5 557 A GGG-- - -1 - - -
r7 r List[str]c : | j |i |\ }}d |D S )Nc g | ]
}|d S r r6 r s r8 r z/MalwareIgnorePath.path_list.. s 111F 111r7 )rt )r^ r r _ path_lists r8 ry zMalwareIgnorePath.path_list s1 /s/@@@ 911y1111r7 c K | j | t | }| j D ]C}t j d d{V t |d }||k s ||j v r dS DdS )zChecks whether path stored in MalwareIgnorePath cache or
if it's belongs to path from cache or if it matches patters from cache
:param str check_path: path to check
:return: bool: is ignored according MalwareIgnorePath
Nr rK TF)rh ri r asynciosleepparents)r^
check_pathrK p ignored_paths r8 is_path_ignoredz!MalwareIgnorePath.is_path_ignored s 9 J A-"" " " " " " " " & ??L $$,$,*F*Ftt +Gur7 )NNNNNNNN)rS r| )r ru )r0 r1 r2 rd r9 rh r r r rK r rS r rp rq ri rY r rt ry r
__classcell__)rJ s @r8 r_ r_ s 557 7 7 7 7 7 7 7
E B 9;;D I
'G!H!H I M 52E2EFFFJ [ > > > > [> 6 6 6 6 [6 !
&
&
&
&
[&
P 2 2 2 [2 [ r7 r_ c e Zd ZdZ G d d Z ed Z ed Z ed e d
e j j
e j j
f ge j j
Z ed Z ed Z ed Z ed Z ed Z edd
Z ed Z ed Z ed Z ed Z ed Z ed Z ed Z e dd Z e d
Z e dd Z!e dd Z"d S )rC z:Records every event related to :class:`MalwareHit` recordsc e Zd Zej ZdZdS )MalwareHistory.Metamalware_historyNr/ r6 r7 r8 r9 r s ;$r7 r9 Fr; TrB )r< r> r@ c 8 t t S rc re r6 r7 r8 rf zMalwareHistory.
s S[[ r7 r? Nc | j |k | j |k z }|r/|| j | t d|f z z }|r|| j |k z }| | | | } |t |t | } t | }
|
d |
fS )Nz(INSTR(path, ?))TrG )ctimeeventrq r file_userrI rT rY rZ r] r rC r\ r[ ) r^ r_ r` rY rZ r r rW r ra list_results r8 get_historyzMalwareHistory.get_history s 9%#)r/: **622& 22
G - s}, ,G
""7++11%88??GGMMOO "8^UCCE5kk {{t{,,k99r7 c | j d| dd p t j | dd p t j | dd pt j j d| d S )Nrp causerS )rp r rS r6 )
insertpopr ROOTr( MANUALr' ro rn execute)r^ r s r8
save_eventzMalwareHistory.save_event. s
jjd33Dx}**Wd++E/E **_d;; 2&+1
')))))r7 rw
List[dict]c t j 5 t |dt | j j z D ])}| | * d d d d S # 1 swxY w Y d S )Ni )
chunk_size) r r3 atomicr$ len_metacolumns insert_manyr )r^ rw
hits_chunks r8 save_eventszMalwareHistory.save_events8 s
[
!
! 6 6
.CI,=(>(>!>
6
6
++335555
6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6s ABB
BrD r\ r_ rS c > | | j t j | j | | j t k z | j |k z | j
S rc ) rI rK r r rT rU r r% r rV tuples)r^ rD r_ s r8 get_failed_cleanup_events_countz.MalwareHistory.get_failed_cleanup_events_countD s{
JJsx , ,
U U##9 1139%'
Xch
VXX
r7 )NNN)rw r )rD r\ r_ rS )#r0 r1 r2 rd r9 r rK r r r re r' rm rn ro rS r r rp
file_ownerr r r r> r? r= rD rE rF r9 rq r r r r r6 r7 r8 rC rC s: DD% % % % % % % %
=e $ $ $Dyd###H I
E%,,/28/4:
(,2
M
I5 ! ! !E
I5 ! ! !E u%%%I&&&J u%%%I Le-@-@ A A AEiT"""GiT"""GiT"""G%%%J)&&&K Ld+++MiT"""GHL: : : [:& [ 6 6 6 [ 6
[
r7 rC )r se * # " " " " " ! ! ! ! ! ! 2 2 2 2 2 2 2 2 2 2 2 2 2 2
. - - - - - 5 5 5 5 5 5 1 1 1 1 1 1 1 1
5 4 4 4 4 4pB pB pB pB pB% pB pB pBf`N `N `N `N `N `N `N `NF
$"1 "1 "1 "1 "1 "1 "1 "1J` ` ` ` ` ` ` `Fi
i
i
i
i
U i
i
i
i
i
r7