FourCoreLabs-EDRHunt/pkg/scanners/scan_malwarebytes.go

package scanners

import "github.com/FourCoreLabs/EDRHunt/pkg/resources"

type MalwareBytesDetection struct{}

func (w *MalwareBytesDetection) Name() string {
	return "Malware Bytes"
}

func (w *MalwareBytesDetection) Type() resources.EDRType {
	return resources.MalwareBytesEDR
}

var MalwareBytesHeuristic = []string{
	"MalwareBytes",
	"mbae.exe",
	"mbae64.dll",
	"mbae64.exe",
	"mbae-api.dll",
	"mbae-svc.exe",
	"mbae-uninstaller.exe",
	"mbae.sys",
	"mbae64.sys",
	"mbae-svc.exe",
	"Malwarebytes Anti-Exploit Service",
	"C:\\Program Files\\Malwarebytes Anti-Exploit\\mbae.exe",
	"mbae-loader.exe ",
	"mbaeLoader32.exe",
	"mbaeloader64.exe",
	"mbamcore.dll",
	"mbam-dor.exe",
	"mbamext.dll",
	"mbamgui.exe",
	"mbamnet.dll",
	"mbamservice.exe",
	"mbamtrayctrl.exe",
	"mbampt.exe",
	"mbamscheduler.exe",
	"C:\\Program Files\\Malwarebytes Anti-Rootkit",
	"mbar-1.08.2.1001.exe ",
	"mbeadomain.dll",
	"mbae-setup.exe",
	"MBAMHelper.exe",
}

func (w *MalwareBytesDetection) Detect(data resources.SystemData) (resources.EDRType, bool) {
	_, ok := data.CountMatchesAll(MalwareBytesHeuristic)
	if !ok {
		return "", false
	}

	return resources.MalwareBytesEDR, true
}