mirror of https://github.com/mvt-project/mvt.git
Impovements for SMS module (#438)
* Add indicator checking in the SMS module * Don't add SMS entries when read timestamp not set * Remove print() line
This commit is contained in:
parent
ab33789f06
commit
013282dbba
|
@ -44,20 +44,25 @@ class SMS(IOSExtraction):
|
|||
def serialize(self, record: dict) -> Union[dict, list]:
|
||||
text = record["text"].replace("\n", "\\n")
|
||||
sms_data = f"{record['service']}: {record['guid']} \"{text}\" from {record['phone_number']} ({record['account']})"
|
||||
return [
|
||||
sms_data = [
|
||||
{
|
||||
"timestamp": record["isodate"],
|
||||
"module": self.__class__.__name__,
|
||||
"event": "sms_received",
|
||||
"data": sms_data,
|
||||
},
|
||||
{
|
||||
"timestamp": record["isodate_read"],
|
||||
"module": self.__class__.__name__,
|
||||
"event": "sms_read",
|
||||
"data": sms_data,
|
||||
},
|
||||
]
|
||||
# If the message was read, we add an extra event.
|
||||
if record["isodate_read"]:
|
||||
sms_data.append(
|
||||
{
|
||||
"timestamp": record["isodate_read"],
|
||||
"module": self.__class__.__name__,
|
||||
"event": "sms_read",
|
||||
"data": sms_data,
|
||||
}
|
||||
)
|
||||
return sms_data
|
||||
|
||||
def check_indicators(self) -> None:
|
||||
for message in self.results:
|
||||
|
|
|
@ -55,6 +55,10 @@ class SMSAttachments(IOSExtraction):
|
|||
|
||||
def check_indicators(self) -> None:
|
||||
for attachment in self.results:
|
||||
# Check for known malicious filenames.
|
||||
if self.indicators.check_file_path(attachment["filename"]):
|
||||
self.detected.append(attachment)
|
||||
|
||||
if (
|
||||
attachment["filename"].startswith("/var/tmp/")
|
||||
and attachment["filename"].endswith("-1")
|
||||
|
|
|
@ -17,7 +17,7 @@ class TestSMSModule:
|
|||
m = SMS(target_path=get_ios_backup_folder())
|
||||
run_module(m)
|
||||
assert len(m.results) == 1
|
||||
assert len(m.timeline) == 2 # SMS received and read events.
|
||||
assert len(m.timeline) == 1
|
||||
assert len(m.detected) == 0
|
||||
|
||||
def test_detection(self, indicator_file):
|
||||
|
|
Loading…
Reference in New Issue