1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
|
/*
* @Author: EnderByEndera
* @Date: 2020-12-19 11:59:02
* @LastEditTime: 2021-01-15 07:16:12
* @LastEditors: Please set LastEditors
* @Description: root of the commdetection cmd
* @FilePath: /commdetection/cmd/root.go
*/
package cmd
import (
"commdetection/comm"
"commdetection/logger"
"commdetection/model"
"commdetection/router"
"commdetection/rules"
"encoding/json"
"io/ioutil"
"os"
"path/filepath"
"time"
"github.com/sirupsen/logrus"
"github.com/spf13/cobra"
)
var rootCmd = &cobra.Command{
Use: "commdetection",
Short: "commdetection is the command-line tool for detecting harmful commands",
Long: "A fast and precise command-line tool for detecting harmful commands",
Run: func(cmd *cobra.Command, args []string) {
root()
},
}
var (
filterStr string
evaluations []string
file string
logLevel uint32
filters = []comm.Filter{}
rs = model.Rules{}
)
// Execute executes the command
func Execute() error {
return rootCmd.Execute()
}
func init() {
rootCmd.PersistentFlags().StringVar(&filterStr, "filter", "which", "choose one filter to filt the data from the file")
rootCmd.PersistentFlags().StringSliceVarP(&evaluations, "evaluations", "e", []string{"command"}, "choose one or more evaluations to evaluate commands")
rootCmd.PersistentFlags().StringVar(&file, "file", "/root/.bash_history", "choose one file storing data of the commands")
rootCmd.PersistentFlags().Uint32Var(&logLevel, "loglevel", uint32(logrus.DebugLevel), "choose log level")
rootCmd.AddCommand(verCmd) // add version as a subcommand
logger.LogLevel = logrus.Level(logLevel)
}
func root() {
for _, ev := range evaluations {
switch ev {
case "command":
rs = rules.AddRule(rs, model.Rule{
Name: "Command",
RuleFunc: "EvaluateCommandRule",
})
case "path":
rs = rules.AddRule(rs, model.Rule{
Name: "Path",
RuleFunc: "EvaluatePathRule",
})
default:
logger.Warnln("invalid rule name: " + ev)
}
}
switch filterStr {
case "which":
filters = append(filters, comm.WhichCommandFilter)
case "simple":
filters = append(filters, comm.SimpleCommandFilter)
case "help":
filters = append(filters, comm.HelpCommandFilter)
case "man":
filters = append(filters, comm.ManCommandFilter)
}
go func() {
for {
var comms model.Commands
comms = comm.GetCommands()
comms = comm.FlushCommands(comms, filters)
comms.InsertAllTo("test", "commands")
comms.GetCommandsFrom("test", "commands")
css := rules.InitCommScores(comms)
css = rules.EvaluateCommScore(css, rs)
jsonBuf, _ := json.Marshal(css)
ioutil.WriteFile(filepath.Join(os.Getenv("COMMDEPATH"), "static", "base", "output.json"), jsonBuf, os.ModeAppend)
logger.Debugln("New output.json file is built")
time.Sleep(3 * time.Minute)
}
}()
router.StartRouter()
}
|
