diff --git a/modules/Antivirus/CylanceScore.py b/modules/Antivirus/CylanceScore.py new file mode 100644 index 00000000..567f6e40 --- /dev/null +++ b/modules/Antivirus/CylanceScore.py @@ -0,0 +1,72 @@ +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. +from __future__ import division, absolute_import, with_statement, print_function, unicode_literals +import subprocess +import re + +__author__ = "Mike Long" +__license__ = "MPL 2.0" + +TYPE = "Antivirus" +NAME = "Cylance" + +SCORE = "/opt/infinity/bin/mono /opt/infinity/bin/InfinityDaemonClient localhost:9002 p ScoreFile" + +DEFAULTCONF = { + "ENABLED": False, + "score": SCORE +} + +def check(conf=DEFAULTCONF): + if not conf['ENABLED']: + return False + if not ping(): + return False + return True + +def ping(): + try: + # Cylance service runs locally on port 9002 by default, change if configured differently + status = "(echo >/dev/tcp/127.0.0.1/9002) &>/dev/null && echo '0' || echo '1'" + return bool(subprocess.check_output([status], shell=True, executable='/bin/bash')) + except: + raise + + +def scan(filelist, conf=DEFAULTCONF): + results = [] + + if ping(): + try: + for f in filelist: + scoreFile = conf["score"] + " "+ f + output = subprocess.check_output([scoreFile], shell=True) + + ## Cleaning up the output ## + ## Let's Remove the first two lines, not needed + output = output.split("\n", 2)[2] + ## Splitting output at funky characaters + output = re.split('---- | ----|{|}|,|\n', output) + ## There are empty strings in the list, removing.... + output = [i for i in output if i != ''] + ## Cleaning up leading whitespaces + output = [x.strip(' ') for x in output] + ## End of cleaning ## + + # Add list to result + # results.append((f,output)) + # Add score only to result + results.append((f, output[9])) + + except: + raise + else: + print("Cylance Service on port 9002 is not running...") + + metadata = { + 'Name': "Cylance", + 'Type': "Antivirus" + } + + return (results, metadata)