process_scanner.go

package main

import (
	"fmt"
	"runtime/debug"

	"github.com/hillu/go-yara/v4"
)

// ProcessInformation wrap basic process information and memory dump in a structure
type ProcessInformation struct {
	PID         uint32
	ProcessName string
	ProcessPath string
	MemoryDump  []byte
}

// ScanMemory enumerates processes and scans their memory
func ScanMemory(config Configuration, rules *yara.Rules) {
	LogMessage(LOG_INFO, "(INIT)", "Starting memory scan...")

	procs := ListProcesses()
	LogMessage(LOG_INFO, "(INFO)", fmt.Sprintf("Found %d running processes", len(procs)))

	ScanProcesses(procs, config, rules)

	LogMessage(LOG_INFO, "(INFO)", "Memory scan finished")
}

// ScanProcesses scans a list of processes for patterns and YARA rules
func ScanProcesses(procs []ProcessInformation, config Configuration, rules *yara.Rules) int {
	totalMatches := 0
	for _, proc := range procs {
		LogMessage(LOG_VERBOSE, "(MEMORY)", "Scanning process:", proc.ProcessName, fmt.Sprintf("(PID: %d)", proc.PID))

		// Check memory content with Grep
		if len(config.Input.Content.Grep) > 0 {
			// checkForStringPattern already handles logging and alerting
			matches := checkForStringPattern(fmt.Sprintf("MEMORY:%s:%d", proc.ProcessName, proc.PID), proc.MemoryDump, config.Input.Content.Grep)
			totalMatches += len(matches)
		}

		// Check memory content with YARA
		if rules != nil && len(rules.GetRules()) > 0 {
			matchs, err := PerformYaraScan(&proc.MemoryDump, rules)
			if err != nil {
				LogMessage(LOG_ERROR, "(ERROR)", "Memory YARA scan failed for", proc.ProcessName, err)
			} else {
				totalMatches += len(matchs)
			}

			for i := 0; i < len(matchs); i++ {
				LogMessage(LOG_ALERT, "(ALERT)", "Memory YARA match:")
				LogMessage(LOG_ALERT, " | process:", proc.ProcessName)
				LogMessage(LOG_ALERT, " | PID:", fmt.Sprintf("%d", proc.PID))
				LogMessage(LOG_ALERT, " | rule:", matchs[i].Rule)
				LogMessage(LOG_ALERT, " | namespace:", matchs[i].Namespace)

				// Forward alert
				metadata := map[string]string{
					"pid":            fmt.Sprintf("%d", proc.PID),
					"process_name":   proc.ProcessName,
					"rule_namespace": matchs[i].Namespace,
				}
				ForwardAlertEvent(matchs[i].Rule, "memory:"+proc.ProcessName, int64(len(proc.MemoryDump)), "", metadata)
			}
		}

		// Clean memory
		proc.MemoryDump = nil
		debug.FreeOSMemory()
	}
	return totalMatches
}