Add eliminate package with functions for removing suspicious artifacts (files, directories, processes, services, scheduled tasks) and enhance detection logic to include whitelist checks and multi-indicator scoring

This commit is contained in:
Evan Hosinski
2025-10-11 17:22:44 -04:00
parent e835629643
commit b855f0eaec
15 changed files with 346 additions and 114 deletions
+16
View File
@@ -0,0 +1,16 @@
package eliminate
import (
. "rmm-hunter/internal/suspicious"
scurvy "github.com/Kraken-OffSec/Scurvy"
)
// EliminateProcess kills a process and removes its binary from the system
func EliminateProcess(p Process) error {
err, proc := scurvy.FindProcessByPID(p.PID)
if err != nil {
return err
}
return proc.Kill()
}