# SPDX-License-Identifier: GPL-3.0-or-later
"""deleted_exe — a process running from a deleted or memfd-backed binary.

Fileless malware unlinks its dropper (or runs straight from ``memfd``) so there
is nothing on disk to scan. The kernel still labels the ``/proc/<pid>/exe``
symlink ``(deleted)`` or ``memfd:``. Normal-path deleted exes (a daemon still
running after a package upgrade) are ignored — only attacker-controlled/fileless
locations alert.
"""
from __future__ import annotations

from collections.abc import Iterator

from ..alert import Alert, Severity
from ..config import Config
from ..system import SystemState

_SUSPICIOUS_PREFIXES = ("/tmp/", "/dev/shm/", "/var/tmp/", "/run/")


def _is_fileless(exe: str) -> bool:
    if "memfd:" in exe:
        return True
    if "(deleted)" not in exe:
        return False
    return exe.startswith(_SUSPICIOUS_PREFIXES)


def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
    for proc in state.processes:
        exe = proc.exe
        if not exe or not _is_fileless(exe):
            continue
        yield Alert(
            severity=Severity.CRITICAL,
            signature="deleted_exe",
            key=f"del:{proc.pid}",
            detail=f"pid={proc.pid} comm={proc.comm} exe=[{exe}]",
            pids=(proc.pid,),
            sid=100012,
            classtype="fileless-execution",
        )