Module: Risu::Templates::MalwareTemplateHelper

Included in:
TemplateHelper
Defined in:
lib/risu/base/malware_template_helper.rb

Instance Method Summary collapse

Instance Method Details

#conficker_appendix_section ⇒ Object 



35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
 
# File 'lib/risu/base/malware_template_helper.rb', line 35

def conficker_appendix_section
	if conficker_count() <= 0
		return
	end

	heading2 "Conficker Worm Infection"

	headers = ["Host"]
	data = Array.new

	findings =  Item.where(:plugin_id => Plugin.where(:plugin_name => "Conficker Worm Detection (uncredentialed check)").first.id)

	findings.each do |finding|
		host = Host.find_by_id(finding.host_id)

		host_string = "#{host.name}"
		host_string << " (#{host.fqdn})" if host.fqdn != nil

		row = Array.new
		row.push host_string

		data << row
	end

	@output.table([headers] + data, :header => true, :width => output.bounds.width) do
		row(0).style(:font_style => :bold, :background_color => 'cccccc')
		cells.borders = [:top, :bottom, :left, :right]
	end

	text "\n"
end

#conficker_count ⇒ Object 



26
27
28
29
30
31
32
 
# File 'lib/risu/base/malware_template_helper.rb', line 26

def conficker_count
	begin
		return Item.where(:plugin_id => Plugin.where(:plugin_name => "Conficker Worm Detection (uncredentialed check)").first.id).count
	rescue
		return 0
	end
end

#conficker_section ⇒ Object 



68
69
70
71
72
73
74
75
76
77
78
79
 
# File 'lib/risu/base/malware_template_helper.rb', line 68

def conficker_section
	if conficker_count() <= 0
		return
	end

	conficker_count = Item.where(:plugin_id => Plugin.where(:plugin_name => "Conficker Worm Detection (uncredentialed check)").first.id).count
	heading2 "Conficker Worm Infection"

	text "Conficker Worm infections were found on #{conficker_count} of #{Report.title}'s computer systems. Conficker, also known as Downup, Downadup and Kido, is a computer worm targeting the Microsoft Windows operating system that was first detected in November 2008. It uses flaws in Windows software and dictionary attacks on administrator passwords to propagate while forming a botnet, and has been unusually difficult to counter because of its combined use of many advanced malware techniques. The systems of interest are detailed in the detailed findings report with remediation steps."

	text "\n"
end

#known_malicious_process_appendix_section ⇒ Object 



107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
 
# File 'lib/risu/base/malware_template_helper.rb', line 107

def known_malicious_process_appendix_section
	count = known_malicious_process_count()

	if count <= 0
		return
	end

	heading2 "Known Malicious Process" if count == 1
	heading2 "Known Malicious Processes" if count > 1

	findings = Item.where(:plugin_id => 59275)
	plugin = Plugin.find_by_id(59275)

	findings.each do |finding|
		host = Host.find_by_id(finding.host_id)

		text "Host", :style => :bold
		host_string = "#{host.name}"
		host_string << " (#{host.fqdn})" if host.fqdn != nil
		text host_string

		definition "Description", plugin.description.gsub(/[ ]{2,}/, " ") if plugin.description != nil
		definition "Plugin output", finding.plugin_output.gsub(/Any detected files 5 MB or less are available as attachments./, "")
	end

	text "\n"
end

#known_malicious_process_count ⇒ Object 



82
83
84
85
86
87
88
 
# File 'lib/risu/base/malware_template_helper.rb', line 82

def known_malicious_process_count
	begin
		return Item.where(:plugin_id => 59275).count
	rescue
		return 0
	end
end

#known_malicious_process_section ⇒ Object 



91
92
93
94
95
96
97
98
99
100
101
102
103
104
 
# File 'lib/risu/base/malware_template_helper.rb', line 91

def known_malicious_process_section
	count = known_malicious_process_count()

	if count <= 0
		return
	end

	heading1 "Known Malicious Process Detected" if count == 1
	heading1 "Known Malicious Processes Detected" if count > 1

	text "A known malicious process was detected active on the network. This process was detected using hash binary hashing. This hash was submitted to an malware detection service that checks each hash against several different anti virus software suites. Details can be found in Appendix A."

	text "\n"
end

#malware_appendix_section ⇒ Object 



142
143
144
145
 
# File 'lib/risu/base/malware_template_helper.rb', line 142

def malware_appendix_section
	conficker_appendix_section
	known_malicious_process_appendix_section
end

#malware_section ⇒ Object 



136
137
138
139
 
# File 'lib/risu/base/malware_template_helper.rb', line 136

def malware_section
	conficker_section
	known_malicious_process_section
end