File size: 931 Bytes
d2507b5 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | package bundle
// ShellAnalyzer inspects shell scripts (.sh/.bash and shebang-detected text).
// It is behavioral: a script that ships no suspicious indicator emits NO
// finding (presence != malice). High-confidence patterns — exfil co-occurring
// with env reads, curl|sh RCE, destructive commands, registry rewrites — come
// straight from the shared indicator vocabulary, plus a padding-evasion flag
// when the file was truncated at the read cap with a high newline ratio.
type ShellAnalyzer struct{}
func (ShellAnalyzer) Name() string { return "shell" }
func (ShellAnalyzer) Handles(kind FileKind) bool { return kind == KindShell }
func (ShellAnalyzer) Analyze(f *File, b *Bundle) ([]Finding, error) {
if f == nil {
return nil, nil
}
text := string(f.Sniff)
out := sharedIndicatorScan(text, f.RelPath, "shell")
if pe, ok := paddingEvasionFinding(f, "shell"); ok {
out = append(out, pe)
}
return out, nil
}
|