gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-12 15:49:46 -08:00
Code Issues Packages Projects Releases Wiki Activity

record origin_monitor_id for more reliable process association

Browse Source 
tmp
This commit is contained in:
mr-tz
2024-12-12 09:42:25 +00:00
parent 1a82b9d0c5
commit 893378c10e
2 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
capa/features/extractors/vmray/__init__.py
View File

@@ -34,6 +34,7 @@ class VMRayMonitorProcess:
pid: int # process ID assigned by OS
ppid: int # parent process ID assigned by OS
monitor_id: int # unique ID assigned to process by VMRay
origin_monitor_id: int # unique VMRay ID of parent process
image_name: str
filename: str
cmd_line: str
@@ -165,6 +166,7 @@ class VMRayAnalysis:
process.os_pid,
ppid,
process.monitor_id,
process.origin_monitor_id,
process.image_name,
process.filename,
process.cmd_line,
@@ -176,6 +178,7 @@ class VMRayAnalysis:
monitor_process.os_pid,
monitor_process.os_parent_pid,
monitor_process.process_id,
monitor_process.parent_id,
monitor_process.image_name,
monitor_process.filename,
monitor_process.cmd_line,
@@ -185,7 +188,17 @@ class VMRayAnalysis:
self.monitor_processes[monitor_process.process_id] = vmray_monitor_process
else:
# we expect monitor processes recorded in both SummaryV2.json and flog.xml to equal
assert self.monitor_processes[monitor_process.process_id] == vmray_monitor_process
# to ensure this, we compare the pid, monitor_id, and origin_monitor_id
# for the other fields we've observed cases with slight deviations, e.g.,
# the ppid for a process in flog.xml is not set correctly, all other data is equal
sv2p = self.monitor_processes[monitor_process.process_id]
assert (sv2p.pid, sv2p.monitor_id, sv2p.origin_monitor_id) == (
vmray_monitor_process.pid,
vmray_monitor_process.monitor_id,
vmray_monitor_process.origin_monitor_id,
)
if self.monitor_processes[monitor_process.process_id] != vmray_monitor_process:
logger.debug("processes differ: %s (sv2) vs. %s (flog)", sv2p, vmray_monitor_process)
def _compute_monitor_threads(self):
for monitor_thread in self.flog.analysis.monitor_threads:

1
capa/features/extractors/vmray/models.py
View File

@@ -314,6 +314,7 @@ class Process(BaseModel):
# is_ioc: bool
monitor_id: int
# monitor_reason: str
origin_monitor_id: int # VMRay ID of parent process
os_pid: int
filename: SanitizedString
image_name: str