Refactor AutoRun detection to use Scurvy library, enhance suspicious entry checks, and update UI rendering for detailed info
This commit is contained in:
@@ -78,7 +78,7 @@ func (m DetailViewModel) renderDetails() string {
|
||||
switch m.typeKey {
|
||||
case "autoruns":
|
||||
ar := m.data.AutoRuns[m.index]
|
||||
return fmt.Sprintf("Name: %s\nCommand: %s\nLocation: %s\nEnabled: %v\nDescription: %s", ar.Name, ar.Command, ar.Location, ar.Enabled, ar.Description)
|
||||
return fmt.Sprintf("Type: %s\nEntry: %s\nLaunch: %s\nLocation: %s\nImage: %s\nArgs: %s\nMD5: %s\nSHA1: %s\nSHA256: %s", ar.Type, ar.Entry, ar.LaunchString, ar.Location, ar.ImagePath, ar.Arguments, ar.MD5, ar.SHA1, ar.SHA256)
|
||||
case "binaries":
|
||||
b := m.data.Binaries[m.index]
|
||||
return fmt.Sprintf("Binary: %s\nAction: delete file", b)
|
||||
|
||||
@@ -46,8 +46,11 @@ func NewListView(typeKey string, sus suspicious.Suspicious, width, height int) L
|
||||
case "autoruns":
|
||||
header = "Suspicious AutoRuns"
|
||||
for _, ar := range sus.AutoRuns {
|
||||
title := ar.Name
|
||||
desc := fmt.Sprintf("%s (%s)", ar.Command, ar.Location)
|
||||
title := ar.ImageName
|
||||
if title == "" {
|
||||
title = ar.Entry
|
||||
}
|
||||
desc := fmt.Sprintf("%s (%s)", ar.ImagePath, ar.Location)
|
||||
items = append(items, listItem{title: title, desc: desc})
|
||||
}
|
||||
case "binaries":
|
||||
|
||||
Reference in New Issue
Block a user