AggressorScripts/EDR.cna

#EDR Query
#Author: @r3dQu1nn

@edr = @("cbstream.sys", "cbk7.sys", "Parity.sys", "libwamf.sys", "LRAgentMF.sys", "BrCow_x_x_x_x.sys", "brfilter.sys", "BDSandBox.sys", "TRUFOS.SYS", "AVC3.SYS", "Atc.sys", "AVCKF.SYS", "bddevflt.sys", "gzflt.sys", "bdsvm.sys", "hbflt.sys", "cve.sys", "psepfilter.sys", "cposfw.sys", "dsfa.sys", "medlpflt.sys", "epregflt.sys", "TmFileEncDmk.sys", "tmevtmgr.sys", "TmEsFlt.sys", "fileflt.sys", "SakMFile.sys", "SakFile.sys", "AcDriver.sys", "TMUMH.sys", "hfileflt.sys", "TMUMS.sys", "MfeEEFF.sys", "mfprom.sys", "hdlpflt.sys", "swin.sys", "mfehidk.sys", "mfencoas.sys", "epdrv.sys", "carbonblackk.sys", "csacentr.sys", "csaenh.sys", "csareg.sys", "csascr.sys", "csaav.sys", "csaam.sys", "esensor.sys", "fsgk.sys", "fsatp.sys", "fshs.sys", "eaw.sys", "im.sys", "csagent.sys", "rvsavd.sys", "dgdmk.sys", "atrsdfw.sys", "mbamwatchdog.sys", "edevmon.sys", "SentinelMonitor.sys", "edrsensor.sys", "ehdrv.sys", "HexisFSMonitor.sys", "CyOptics.sys", "CarbonBlackK.sys", "CyProtectDrv32.sys", "CyProtectDrv64.sys", "CRExecPrev.sys", "ssfmonm.sys", "CybKernelTracker.sys", "SAVOnAccess.sys", "savonaccess.sys", "sld.sys", "aswSP.sys", "FeKern.sys", "klifks.sys", "klifaa.sys", "Klifsm.sys", "mfeaskm.sys", "mfencfilter.sys", "WFP_MRT.sys", "groundling32.sys", "SAFE-Agent.sys", "groundling64.sys", "avgtpx86.sys", "avgtpx64.sys", "pgpwdefs.sys", "GEProtection.sys", "diflt.sys", "sysMon.sys", "ssrfsf.sys", "emxdrv2.sys", "reghook.sys", "spbbcdrv.sys", "bhdrvx86.sys", "bhdrvx64.sys", "SISIPSFileFilter.sys", "symevent.sys", "VirtualAgent.sys", "vxfsrep.sys", "VirtFile.sys", "SymAFR.sys", "symefasi.sys", "symefa.sys", "symefa64.sys", "SymHsm.sys", "evmf.sys", "GEFCMP.sys", "VFSEnc.sys", "pgpfs.sys", "fencry.sys", "symrg.sys", "cfrmd.sys", "cmdccav.sys", "cmdguard.sys", "CmdMnEfs.sys", "MyDLPMF.sys", "PSINPROC.SYS", "PSINFILE.SYS", "amfsm.sys", "amm8660.sys", "amm6460.sys");

#EDR_Query Command Register
beacon_command_register("EDR_Query", "Queries the System for all major EDR products installed",
    "Syntax: EDR_Query\n" .
    "Checks C:\\Windows\\System32\\drivers for installed EDR products");

#EDR_Query alias
alias EDR_Query {
    $bd = bdata($1);
    if ($bd['barch'] eq "x64") {
        blog($1, "\cBDetermining what EDR products are installed...");
        bls($1, "C:\\windows\\System32\\drivers", &list);
    }
    else {
        blog($1, "\cBDetermining what EDR products are installed...");
        bls($1, "C:\\windows\\sysnative\\drivers", &list);
    }
    
}

#Parse dem results
sub list {
    local('$entry $type $size $modified $name $out');
    @results = split("\n", ["$3" trim]);
    @matches = @();
    foreach $entry (@results) {
    ($type, $size, $modified, $name) = split("\t", $entry);
        if ($name in @edr) {
            blog($1, "\cB$name Found");
            add(@matches, $name, 0);
        }
    }
    $size = size(@matches);
    $out .= "\c4$size EDR Products Found!\n";
    $out .= "    \c0======================\n";
    $out .= "    | Vendor Information | \n";
    $out .= "\c0    ----------------------";
    if (size(@matches) == 0) {
        blog($1, "\c9No EDR products found! Operate at your own risk!");
        clear(@matches);
    }
    if (size(@matches) > 0) {
        blog($1, $out);
    }
    if ('FeKern.sys' in @matches || 'WFP_MRT.sys' in @matches) {
        blog($1, "FireEye Found!");
    }
    if ('eaw.sys' in @matches) {
        blog($1, "Raytheon Cyber Solutions Found!");
    }
    if ('rvsavd.sys' in @matches) {
        blog($1, "CJSC Returnil Software Found!");
    }
    if ('dgdmk.sys' in @matches) {
        blog($1, "Verdasys Inc. Found!");
    }
    if ('atrsdfw.sys' in @matches) {
        blog($1, "Altiris (Symantec) Found!");
    }
    if ('mbamwatchdog.sys' in @matches) {
        blog($1, "Malwarebytes Found!");
    }
    if ('edevmon.sys' in @matches || 'ehdrv.sys' in @matches) {
        blog($1, "ESET Found!");
    }
    if ('SentinelMonitor.sys' in @matches) {
        blog($1, "SentinelOne Found!");
    }
    if ('edrsensor.sys' in @matches || 'hbflt.sys' in @matches || 'bdsvm.sys' in @matches || 'gzflt.sys' in @matches || 'bddevflt.sys' in @matches || 'AVCKF.SYS' in @matches || 'Atc.sys' in @matches || 'AVC3.SYS' in @matches || 'TRUFOS.SYS' in @matches || 'BDSandBox.sys' in @matches) {
        blog($1, "BitDefender Found!");
    }
    if ('HexisFSMonitor.sys' in @matches) {
        blog($1, "Hexis Cyber Solutions Found!");
    }
    if ('CyOptics.sys' in @matches || 'CyProtectDrv32.sys' in @matches || 'CyProtectDrv64.sys' in @matches) {
        blog($1, "Cylance Inc. Found!");
    }
    if ('aswSP.sys' in @matches) {
        blog($1, "Avast Found!");
    }
    if ('mfeaskm.sys' in @matches || 'mfencfilter.sys' in @matches || 'epdrv.sys' in @matches || 'mfencoas.sys' in @matches || 'mfehidk.sys' in @matches || 'swin.sys' in @matches || 'hdlpflt.sys' in @matches || 'mfprom.sys' in @matches || 'MfeEEFF.sys' in @matches) {
        blog($1, "McAfee Found!");
    }
    if ('groundling32.sys' in @matches || 'groundling64.sys' in @matches) {
        blog($1, "Dell Secureworks Found!");
    }
    if ('avgtpx86.sys' in @matches || 'avgtpx64.sys' in @matches) {
        blog($1, "AVG Technologies Found!");
    }
    if ('pgpwdefs.sys' in @matches || 'GEProtection.sys' in @matches || 'diflt.sys' in @matches || 'sysMon.sys' in @matches || 'ssrfsf.sys' in @matches || 'emxdrv2.sys' in @matches || 'reghook.sys' in @matches || 'spbbcdrv.sys' in @matches || 'bhdrvx86.sys' in @matches || 'bhdrvx64.sys' in @matches || 'SISIPSFileFilter.sys' in @matches || 'symevent.sys' in @matches || 'vxfsrep.sys' in @matches || 'VirtFile.sys' in @matches || 'SymAFR.sys' in @matches || 'symefasi.sys' in @matches || 'symefa.sys' in @matches || 'symefa64.sys' in @matches || 'SymHsm.sys' in @matches || 'evmf.sys' in @matches || 'GEFCMP.sys' in @matches || 'VFSEnc.sys' in @matches || 'pgpfs.sys' in @matches || 'fencry.sys' in @matches || 'symrg.sys' in @matches) {
        blog($1, "Symantec Found!");
    }               
    if ('SAFE-Agent.sys' in @matches) {
        blog($1, "SAFE-Cyberdefense Found!");
    }
    if ('CybKernelTracker.sys' in @matches) {
        blog($1, "CyberArk Software Found!");
    }
    if ('klifks.sys' in @matches || 'klifaa.sys' in @matches || 'Klifsm.sys' in @matches) {
        blog($1, "Kaspersky Found!");
    }
    if ('SAVOnAccess.sys' in @matches || 'savonaccess.sys' in @matches || 'sld.sys' in @matches) {
        blog($1, "Sophos Found!");
    }
    if ('ssfmonm.sys' in @matches) {
        blog($1, "Webroot Software, Inc. Found!");
    }
    if ('CarbonBlackK.sys' in @matches || 'carbonblackk.sys' in @matches || "Parity.sys" in @matches || "cbk7.sys" in @matches || "cbstream.sys" in @matches) {
        blog($1, "Carbon Black Found!");
    }
    if ('CRExecPrev.sys' in @matches) {
        blog($1, "Cybereason Found!");
    }
    if ('im.sys' in @matches || 'csagent.sys' in @matches) {
        blog($1, "CrowdStrike Found!");
    }
    if ('cfrmd.sys' in @matches || 'cmdccav.sys' in @matches || 'cmdguard.sys' in @matches || 'CmdMnEfs.sys' in @matches || 'MyDLPMF.sys' in @matches) {
        blog($1, "Comodo Security Solutions Found!");
    }
    if ('PSINPROC.SYS' in @matches || 'PSINFILE.SYS' in @matches || 'amfsm.sys' in @matches || 'amm8660.sys' in @matches || 'amm6460.sys' in @matches) {
        blog($1, "Panda Security Found!");
    }
    if ('fsgk.sys' in @matches || 'fsatp.sys' in @matches || 'fshs.sys' in @matches) {
        blog($1, "F-Secure Found!");
    }
    if ('esensor.sys' in @matches) {
        blog($1, "Endgame Found!");
    }
    if ('csacentr.sys' in @matches || 'csaenh.sys' in @matches || 'csareg.sys' in @matches || 'csascr.sys' in @matches || 'csaav.sys' in @matches || 'csaam.sys' in @matches) {
        blog($1, "Cisco Found!");
    }
    if ('TMUMS.sys' in @matches || 'hfileflt.sys' in @matches || 'TMUMH.sys' in @matches || 'AcDriver.sys' in @matches || 'SakFile.sys' in @matches || 'SakMFile.sys' in @matches || 'fileflt.sys' in @matches || 'TmEsFlt.sys' in @matches || 'tmevtmgr.sys' in @matches || 'TmFileEncDmk.sys' in @matches) {
        blog($1, "Trend Micro Inc Found!");
    }
    if ('epregflt.sys' in @matches || 'medlpflt.sys' in @matches || 'dsfa.sys' in @matches || 'cposfw.sys' in @matches) {
        blog($1, "Check Point Software Technologies Found!");
    }
    if ('psepfilter.sys' in @matches || 'cve.sys' in @matches) {
        blog($1, "Absolute Found!");
    }
    if ('brfilter.sys' in @matches || 'BrCow_x_x_x_x.sys' in @matches) {
        blog($1, "Bromium Found!");
    }
    if ('LRAgentMF.sys' in @matches) {
        blog($1, "LogRhythm Found!");
    }
    if ('libwamf.sys' in @matches) {
        blog($1, "OPSWAT Inc Found!");
    }
}