[backend] Add matching on parent process name for inject expectation …

…signature
OpenBAS-Platform · Nov 7, 2024 · 7d15dd7 · 7d15dd7
1 parent 3ada46d
commit 7d15dd7
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/openbas-api/src/main/java/io/openbas/injectors/openbas/OpenBASImplantExecutor.java b/openbas-api/src/main/java/io/openbas/injectors/openbas/OpenBASImplantExecutor.java
@@ -255,6 +255,11 @@ public ExecutionProcess process(Execution execution, ExecutableInject injection)
                         case "Command":
                           Command payloadCommand =
                               (Command) Hibernate.unproxy(injectorContract.getPayload());
+                          injectExpectationSignatures.add(
+                              InjectExpectationSignature.builder()
+                                  .type(EXPECTATION_SIGNATURE_TYPE_PARENT_PROCESS_NAME)
+                                  .value("obas-implant-" + inject.getId())
+                                  .build());
                           injectExpectationSignatures.add(
                               InjectExpectationSignature.builder()
                                   .type(EXPECTATION_SIGNATURE_TYPE_COMMAND_LINE)

diff --git a/openbas-model/src/main/java/io/openbas/database/model/InjectExpectationSignature.java b/openbas-model/src/main/java/io/openbas/database/model/InjectExpectationSignature.java
@@ -8,6 +8,7 @@
 @Data
 @Builder
 public class InjectExpectationSignature {
+  public static final String EXPECTATION_SIGNATURE_TYPE_PARENT_PROCESS_NAME = "parent_process_name";
   public static final String EXPECTATION_SIGNATURE_TYPE_PROCESS_NAME = "process_name";
   public static final String EXPECTATION_SIGNATURE_TYPE_COMMAND_LINE = "command_line";
   public static final String EXPECTATION_SIGNATURE_TYPE_HASH = "hash";