CalvinBackup/mvt
1
0
Fork 0
mirror of https://github.com/mvt-project/mvt.git synced 2026-08-16 08:00:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fixes issues in analytics module

Browse Source
This commit is contained in:
tek
2023-04-07 12:25:17 +02:00
parent 2942209f62
commit 577fcf752d
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mvt/ios/modules/fs/analytics.py
+9 -6
View File
@@ -6,6 +6,7 @@
import logging import logging
import plistlib import plistlib
import sqlite3 import sqlite3
import copy
from typing import Optional, Union from typing import Optional, Union
from mvt.common.utils import convert_mactime_to_iso from mvt.common.utils import convert_mactime_to_iso
@@ -55,18 +56,20 @@ class Analytics(IOSExtraction):
if ioc: if ioc:
self.log.warning("Found mention of a malicious process \"%s\" in %s file at %s", self.log.warning("Found mention of a malicious process \"%s\" in %s file at %s",
value, result["artifact"], value, result["artifact"],
result["timestamp"]) result["isodate"])
result["matched_indicator"] = ioc new_result = copy.copy(result)
self.detected.append(result) new_result["matched_indicator"] = ioc
self.detected.append(new_result)
continue continue
ioc = self.indicators.check_domain(value) ioc = self.indicators.check_domain(value)
if ioc: if ioc:
self.log.warning("Found mention of a malicious domain \"%s\" in %s file at %s", self.log.warning("Found mention of a malicious domain \"%s\" in %s file at %s",
value, result["artifact"], value, result["artifact"],
result["timestamp"]) result["isodate"])
result["matched_indicator"] = ioc new_result = copy.copy(result)
self.detected.append(result) new_result["matched_indicator"] = ioc
self.detected.append(new_result)
def _extract_analytics_data(self): def _extract_analytics_data(self):
artifact = self.file_path.split("/")[-1] artifact = self.file_path.split("/")[-1]