47 lines
1.2 KiB
Go
47 lines
1.2 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package detectors
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
|
|
)
|
|
|
|
var inputDevicePrefixes = []string{
|
|
"/dev/input/event", "/dev/uinput", "/dev/hidraw",
|
|
}
|
|
|
|
// InputSnooper ports the Python input_snooper detector (SID 100032).
|
|
func InputSnooper(state model.State, cfg config.Config) []model.Alert {
|
|
alerts := make([]model.Alert, 0)
|
|
for _, process := range state.Processes {
|
|
comm := process.Comm
|
|
if comm == "" {
|
|
comm = "?"
|
|
}
|
|
if cfg.InputSnooperAllowComms[comm] {
|
|
continue
|
|
}
|
|
for _, fd := range sortedFDs(process.FDTargets) {
|
|
target := process.FDTargets[fd]
|
|
if !hasAnyPrefix(target, inputDevicePrefixes) {
|
|
continue
|
|
}
|
|
alerts = append(alerts, model.Alert{
|
|
SID: 100032,
|
|
Severity: "HIGH",
|
|
Signature: "input_snooper",
|
|
Classtype: "credential-keylogging",
|
|
Key: fmt.Sprintf("input:%d:%s", process.PID, target),
|
|
Detail: fmt.Sprintf(
|
|
"pid=%d comm=%s fd=%s has input device open: %s",
|
|
process.PID, comm, fd, target),
|
|
PIDs: []int{process.PID},
|
|
})
|
|
break
|
|
}
|
|
}
|
|
return alerts
|
|
}
|