Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add checks for McAfee related processes #2401

Merged
merged 2 commits into from
Apr 25, 2023
Merged

Conversation

iai-rsa
Copy link
Contributor

@iai-rsa iai-rsa commented Apr 14, 2023

Details:
For [Atomic Test #1 - Security Software Discovery], this PR adds checks for McAfee related processes through the string "mc". McAfee antivirus program is still very popular, and should be checked.

For [Atomic Test #2 - Security Software Discovery - powershell] , this PR adds check based on ProcessName rather than Description. Note that, depending on the privilege of current user, get-process | ?{$.Description -like ""} may not return the processes related to AV products of the check. For instance, only with Administrator right, you can see the process description of McAffee processes. Hence, it is better to use get-process | ?{$.ProcessName -like ""}, if you know the name of those processes.

Testing:
Done locally, it works fine.

Associated Issues:
None.

Copy link
Collaborator

@clr2of8 clr2of8 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice additions and explanations. Thank you.

@clr2of8 clr2of8 merged commit 60a4735 into redcanaryco:master Apr 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants