diff --git a/mvt/android/modules/adb/files.py b/mvt/android/modules/adb/files.py index 41887ba..d2d3b5c 100644 --- a/mvt/android/modules/adb/files.py +++ b/mvt/android/modules/adb/files.py @@ -89,7 +89,7 @@ class Files(AndroidExtraction): return for result in self.results: - if self.indicators.check_filename(result["path"]): + if self.indicators.check_file_name(result["path"]): self.log.warning("Found a known suspicous filename at path: \"%s\"", result["path"]) self.detected.append(result) diff --git a/mvt/common/indicators.py b/mvt/common/indicators.py index 995b242..7683bf4 100644 --- a/mvt/common/indicators.py +++ b/mvt/common/indicators.py @@ -271,7 +271,7 @@ class Indicators: return False - def check_filename(self, file_path) -> bool: + def check_file_name(self, file_path) -> bool: """Check the provided file path against the list of file indicators. :param file_path: File path or file name to check against file @@ -307,6 +307,7 @@ class Indicators: # Strip any trailing slash from indicator paths to match directories. if file_path.startswith(ioc_file.rstrip("/")): return True + return False def check_profile(self, profile_uuid) -> bool: diff --git a/mvt/ios/modules/backup/manifest.py b/mvt/ios/modules/backup/manifest.py index 2cce637..87d7859 100644 --- a/mvt/ios/modules/backup/manifest.py +++ b/mvt/ios/modules/backup/manifest.py @@ -83,7 +83,7 @@ class Manifest(IOSExtraction): self.detected.append(result) continue - if self.indicators.check_filename(result["relative_path"]): + if self.indicators.check_file_name(result["relative_path"]): self.log.warning("Found a known malicious file at path: %s", result["relative_path"]) self.detected.append(result) continue