dissect.target.plugins.apps.av.symantec

Module Contents

Classes

SymantecPlugin

Symantec Endpoint Security Suite Plugin, based on https://malwaremaloney.blogspot.com/2021/01/

Attributes

SEPLogRecord
SEPFirewallRecord

dissect.target.plugins.apps.av.symantec.SEPLogRecord

dissect.target.plugins.apps.av.symantec.SEPFirewallRecord

class dissect.target.plugins.apps.av.symantec.SymantecPlugin(target: dissect.target.Target)

Bases: dissect.target.plugin.Plugin

Symantec Endpoint Security Suite Plugin, based on https://malwaremaloney.blogspot.com/2021/01/

__namespace__ = 'symantec'

Defines the plugin namespace.

LOG_SEP_AV = 'sysvol/ProgramData/Symantec/Symantec Endpoint Protection/*/Data/Logs/AV/*'

LOG_SEP_NET = 'sysvol/ProgramData/Symantec/Symantec Endpoint Protection/*/Data/Logs/tralog.log'

LOGS

MARKER_INFECTION = 5

QUARANTINE_SUCCESS = 2

CLEANABLE = 0

DELETABLE = 4

STILL_INFECTED = 1

OUTBOUND = 2

BLOCKED = 1

COMPRESSED = 1

TCP_INIT = 301

TCP_CLOSE = 304

UDP_DATA = 302

AV_TIMESTAMP = 0

AV_EVENT = 1

AV_USER = 5

AV_VIRUS = 6

AV_FILE = 7

AV_ACTION_TAKEN = 10

AV_VIRUS_TYPE = 11

AV_SCAN_ID = 14

AV_EVENT_DATA = 17

AV_QUARANTINE_ID = 18

AV_VIRUS_ID = 19

AV_QUARANTINE_STATUS = 20

AV_COMPRESSED = 23

AV_DEPTH = 24

AV_STILL_INFECTED = 25

AV_CLEANABLE = 28

AV_DELETABLE = 29

AV_CONFIDENCE = 65

AV_PREVALENCE = 67

AV_DOWNLOADED_FROM = 68

AV_RISK = 71

FW_TIMESTAMP = 1

FW_PROTOCOL = 2

FW_LOCAL_IP = 3

FW_REMOTE_IP = 4

FW_LOCAL_PORT = 5

FW_REMOTE_PORT = 6

FW_DIRECTION = 7

FW_BEGIN_TIME = 8

FW_END_TIME = 9

FW_REPETITION = 10

FW_ACTION = 11

FW_SEVERITY = 13

FW_RULE_ID = 14

FW_REMOTE_HOST_NAME = 15

FW_RULE_NAME = 16

FW_APPLICATION = 17

FW_LOCATION = 20

FW_USER = 21

FW_LOCAL_IP6 = 25

FW_REMOTE_IP6 = 26

PROTOCOL

SEVERITY = ['Critical', 'Critical', 'Critical', 'Critical', 'Major', 'Major', 'Major', 'Major', 'Minor',...

ACTION

VIRUS_TYPE

codepage

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

logs() → Iterator[SEPLogRecord]

Return log records.

Yields SEPLogRecord with the following fields:

ts (datetime): Timestamp associated with the event.
virus (string): Name of the virus.
user (string): Name of the user associated with the event.
source_file (path): File that contains the virus.
action_taken (string): Action taken by SEP.
virus_type (string): Description of the type of virus.
scan_id (varint): ID of the scan associated with the event.
event_data (string): String or bytes from a virus event.
quarantine_id (varint): ID associated with the quarantined virus.
still_infected (boolean): Whether the system is still infected.
quarantined (boolean): True if the virus has been quarantined succesfully.
compressed (boolean): True if the virus was in a compressed file.
depth (varint): How many layers of compression the virus was hidden in.
cleanable (boolean): Whether the virus is cleanable.
deletable (boolean): Whether the virus can be deleted.
confidence (varint): Confidence level about threat verdict (higher is more confident).
prevalence (varint): Prevalence of the threat (higher is more prevalent).
risk (varint): Risk level of the threat (1-4, higher is more dangerous, 0 = unknown).
download_url (uri): Source of the virus (if available).
line_no (varint): Reference line number in log file.

firewall() → Iterator[SEPFirewallRecord]

Return log firewall records.

Yields SEPFirewallRecord with the following fields:

ts (datetime): Timestamp associated with the event.
protocol (string): Protocol name associated with the firewall record.
local_ip ("net.ipaddress"): Local IP address associated with the event.
remote_ip ("net.ipaddress"): Remote IP address associated with the event.
local_ip6 ("net.ipaddress"): Local IPv6 address associated with the event.
remote_ip6 ("net.ipaddress"): Remote IPv6 address associated with the event.
local_port (varint): Local port associated with the event.
remote_port (varint): Local port associated with the event.
outbound (boolean): True in case of outbound traffic/connection.
begin_time (datetime): Start of the event.
end_time (datetime): End of the event.
repetition (varint): How many times this event happened within the time frame.
blocked (boolean): Whether the traffic/connection was succesfully blocked.
severity (string): Severity of the event.
rule_id (varint): Firewall rule ID associated with this event.
rule_name (string): Name of the Firewall rule associated with this event.
remote_host (string): Name of the remote host if it can be traced.
application (path): Application responsible for/affected by event.
user (string): User associated with the event.
line_no (varint): Reference line number in log file.