Function isLOLDriver

pkg/filter/util.go:40–64

isLOLDriver interacts with the loldrivers client to determine whether the loaded/dropped driver is malicious or vulnerable.

(f fields.Field, e *event.Event)

// isLOLDriver interacts with the loldrivers client to determine
// whether the loaded/dropped driver is malicious or vulnerable.
func isLOLDriver(f fields.Field, e *event.Event) (params.Value, error) {
	var filename string

	if e.Category == event.File {
		filename = e.GetParamAsString(params.FilePath)
	} else {
		filename = e.GetParamAsString(params.ModulePath)
	}

	isDriver := filepath.Ext(filename) == ".sys" || e.Params.TryGetBool(params.FileIsDriver)
	if !isDriver {
		return nil, nil
	}
	ok, driver := loldrivers.GetClient().MatchHash(filename)
	if !ok {
		return nil, nil
	}
	if (f == fields.FileIsDriverVulnerable || f == fields.ImageIsDriverVulnerable) && driver.IsVulnerable {
		return true, nil
	}
	if (f == fields.FileIsDriverMalicious || f == fields.ImageIsDriverMalicious) && driver.IsMalicious {
		return true, nil
	}
	return false, nil
}

// initLOLDriversClient initializes the loldrivers client if the filter expression
// contains any of the relevant fields.