fix multiple same av detections
Simon Smith committed
Oct 4, 2023 at 12:04 UTC
31bb6d7864f81eeb3cec97cccfa269f596fbd82e
1 file changed
+15
-1
agents/modules_meshcore/win-info.js
+15
-1
@@ -53,9 +53,23 @@ function av()
53
child.stdin.write('[reflection.Assembly]::LoadWithPartialName("system.core")\r\n');
54
child.stdin.write('Get-WmiObject -Namespace "root/SecurityCenter2" -Class AntiVirusProduct | ');
55
child.stdin.write('ForEach-Object -Process { ');
56
+ child.stdin.write('$matches = [regex]::Matches($_.pathToSignedProductExe, "%(.*?)%"); ');
57
+ child.stdin.write('$modifiedPath = $_.pathToSignedProductExe; ');
58
+ child.stdin.write('foreach ($match in $matches) { ');
59
+ child.stdin.write('$modifiedPath = $modifiedPath -replace [regex]::Escape($match.Value), [System.Environment]::GetEnvironmentVariable($match.Groups[1].Value, "Process") ');
60
+ child.stdin.write('} ');
61
+ child.stdin.write('$flag = $true; ');
62
+ child.stdin.write('if ($modifiedPath -ne "windowsdefender://"){ ');
63
+ child.stdin.write('if (-not (Test-Path -Path $modifiedPath -PathType Leaf)) { ');
64
+ child.stdin.write('$flag = $false; ');
65
+ child.stdin.write('} ');
66
+ child.stdin.write('} ');
67
+ child.stdin.write('if ($flag -eq $true) { ')
68
child.stdin.write('$Bytes = [System.Text.Encoding]::UTF8.GetBytes($_.displayName); ');
69
child.stdin.write('$EncodedText =[Convert]::ToBase64String($Bytes); ');
58
- child.stdin.write('Write-Output ("{0},{1}" -f $_.productState,$EncodedText); }\r\n');
70
+ child.stdin.write('Write-Output ("{0},{1}" -f $_.productState,$EncodedText); ');
71
+ child.stdin.write('} ');
72
+ child.stdin.write('}\r\n ');
73
child.stdin.write('exit\r\n');
74
child.waitExit();
75