Add Acronis Cyber Protect identifiers to edrlist#7
Open
xuanxuan0 wants to merge 1 commit into
Open
Conversation
Acronis Cyber Protect (EDR/XDR) has no representation in the keyword list. Since allattribs matching pulls in FileVersionInfo (CompanyName, ProductName) for processes/modules/services/drivers, "acronis" alone covers most binaries signed "Acronis International GmbH". Also adds name-based fallback tokens for cases where file metadata isn't available: aakore, active_protection_service, anti_ransomware_service, cyber-protect-service (processes/services), and fltsrv, snapman, tdrpman (drivers). Sources: Acronis KB articles on Cyber Protect processes/services; Microsoft's filter-altitude documentation for the driver names.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds Acronis Cyber Protect to
edrlist. It's an EDR/XDR product with no coverage here currently.The checkers all match against
allattribs, which pulls inFileChecker.GetFileInfo()(CompanyName/ProductName fromFileVersionInfo). Acronis binaries are signed "Acronis International GmbH" and usually report an "Acronis..." ProductName, soacronisalone should catch most of it across processes, modules, services, and drivers, plus the install-path check inDirectoryChecker(C:\Program Files\Acronis\...).Also added a few name-based fallbacks for when metadata's stripped or unavailable:
aakore,active_protection_service,anti_ransomware_service,cyber-protect-service,fltsrv,snapman,tdrpman— same idea as pairingcrowdstrikewith fallbacks likecsfalcon/cyserver.Left out generic-sounding names like a bare
mmsorschedul2sinceacronisalready covers those via metadata and they'd risk false positives on unrelated software.Names are from Acronis's KB docs and Microsoft's filter-altitude doc for the drivers. Didn't have a .NET SDK handy to build it, but it's just string literals added to the array — checked braces/quotes are balanced.