mirror of
https://github.com/tsale/EDR-Telemetry
synced 2026-06-08 17:58:18 +00:00
Kostas
9e0c2a7912
* Uptycs addition * Update EDR_telem.json Updates based on evidence to be provided. * Update EDR_telem.json Minor correction to match evidence provided. * Post-review update for Uptycs * Update EDR_telem.json Changes per updated evidence provided privately. * Update EDR_telem.json: Update Process Access to "No" * Initial commit for linux telemetry generator script. * Refactor Linux telemetry generator script to include user account activities * Remove unused imports from Linux telemetry generator script * Add process hijack demo script using ptrace as suggested here: https://github.com/tsale/EDR-Telemetry/issues/21#issuecomment-2450048423 * Update raw_access_read function to read from /dev/sda in read-only mode and improve error handling * Fix function name typo in process_hijack_demo.py and refactor network socket management in lnx_telem_gen.py * Rename process_access to start_hijacking and update references; add network_connect method to NetworkSocketManager * Remove commented-out main function and unused RemoteLibraryInjector class from lnx_telem_gen.py * Refactor error handling in driver_load.py, scheduled_task.py, and process_tampering.py; add success messages and improve exception raising. Added README file. * Add eBPF execution functionality via pamspy * Update LINUX_TELEMETRY_GENERATOR_GUIDE.md * Remove requirements.txt and correct apt installations for Debian in LINUX_TELEMETRY_GENERATOR_GUIDE.md * Enhance Linux Telemetry Generator: Add PrettyTable dependency, improve process filtering, and implement execution summary logging * Restore ProcessAccess event handling and reduce delay between events in lnx_telem_gen.py * Add EDR telemetry configuration for process, file, user, network, and service activities * Linux telem update * Add Linux support to EDR telemetry scoring and enhance command line interface * Refactor SentinelOne field in EDR telemetry configuration to remove redundancy * No code changes made. --------- Co-authored-by: Josh Lemon - Uptycs <116134008+joshlemon-uptycs@users.noreply.github.com> Co-authored-by: SecurityAura <SecurityAura@users.noreply.github.com> Co-authored-by: Ján Trenčanský <j91321@users.noreply.github.com> Co-authored-by: mthcht <mthcht@users.noreply.github.com>"
52 lines
1.7 KiB
Python
52 lines
1.7 KiB
Python
import os
|
|
import subprocess
|
|
import urllib.request
|
|
|
|
def download_pamspy():
|
|
"""
|
|
Downloads the pamspy binary from the specified URL and saves it locally.
|
|
"""
|
|
url = "https://github.com/citronneur/pamspy/releases/download/v0.3/pamspy"
|
|
local_path = "./pamspy"
|
|
try:
|
|
print(f"Downloading pamspy from {url}...")
|
|
urllib.request.urlretrieve(url, local_path)
|
|
os.chmod(local_path, 0o755) # Make the downloaded file executable
|
|
print("Download complete.")
|
|
except Exception as e:
|
|
print(f"Failed to download pamspy: {e}")
|
|
raise
|
|
|
|
def execute_pamspy():
|
|
"""
|
|
Executes the pamspy binary with the specified arguments.
|
|
Returns:
|
|
int: The return code of the executed command.
|
|
"""
|
|
pam_path_command = "/usr/sbin/ldconfig -p | grep libpam.so | cut -d ' ' -f4"
|
|
try:
|
|
# Get the path to libpam.so
|
|
pam_path = subprocess.check_output(pam_path_command, shell=True).decode().strip()
|
|
if not pam_path:
|
|
raise Exception("libpam.so not found.")
|
|
|
|
# Construct the command to run pamspy
|
|
command = ["./pamspy", "-p", pam_path, "-d", "/var/log/trace.0"]
|
|
print(f"Executing pamspy with command: {' '.join(command)}")
|
|
result = subprocess.run(command)
|
|
return result.returncode
|
|
except subprocess.CalledProcessError as e:
|
|
print(f"Error executing command to get libpam path: {e}")
|
|
return -1
|
|
except Exception as e:
|
|
print(f"Failed to execute pamspy: {e}")
|
|
return -1
|
|
|
|
def run_pamspy():
|
|
try:
|
|
download_pamspy()
|
|
return_code = execute_pamspy()
|
|
return return_code
|
|
except Exception as e:
|
|
print(f"Error in run_pamspy: {e}")
|
|
return -1 |