Adds indicators check to iOS TCC module

This commit is contained in:
tek committed 2022-01-18 17:12:20 +01:00
1 parent 1460828c30
commit 95205d8e17
3 files changed
+20 -6

No files matched your search

+9
View File
@@ -66,6 +66,15 @@ class TCC(IOSExtraction):
"data": msg
}
def check_indicators(self):
if not self.indicators:
return
for result in self.results:
if self.indicators.check_process(result["client"]):
self.log.warning("Found malicious process in TCC database: %s", result["client"])
self.detected.append(result)
def process_db(self, file_path):
conn = sqlite3.connect(file_path)
cur = conn.cursor()