mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-24 04:01:52 +08:00
refactor: 合并 avdetect 到 systeminfo,修复杀软检测误报
- 将 avdetect 的进程匹配逻辑合并到 systeminfo 插件 - 修复进程匹配使用 Contains 导致大量误报,改为精确匹配 - 修正 auto.json 中 Microsoft Security Essentials 为 Microsoft Defender - 使用 map 索引优化进程匹配性能 - 清理废弃的 envinfo/avdetect i18n key
This commit is contained in:
+1
-1
@@ -113,7 +113,7 @@ func Flag(Info *HostInfo) error {
|
||||
flag.Int64Var(&fv.GlobalTimeout, "gt", 180, i18n.GetText("flag_global_timeout"))
|
||||
flag.BoolVar(&fv.DisablePing, "np", false, i18n.GetText("flag_disable_ping"))
|
||||
flag.BoolVar(&fv.DisableTcpProbe, "ntp", false, i18n.GetText("flag_disable_tcp_probe"))
|
||||
flag.StringVar(&fv.LocalPlugin, "local", "", "指定本地插件名称 (如: cleaner, avdetect, keylogger 等)")
|
||||
flag.StringVar(&fv.LocalPlugin, "local", "", "指定本地插件名称 (如: cleaner, systeminfo, keylogger 等)")
|
||||
flag.BoolVar(&fv.AliveOnly, "ao", false, i18n.GetText("flag_alive_only"))
|
||||
|
||||
// ═════════════════════════════════════════════════
|
||||
|
||||
@@ -564,9 +564,6 @@ keylogger_save_failed:
|
||||
keylogger_no_input:
|
||||
other: "No keyboard input captured"
|
||||
|
||||
# Environment info
|
||||
envinfo_sensitive:
|
||||
other: "Found sensitive environment variable: {{.Arg1}}"
|
||||
|
||||
# Windows WMI
|
||||
winwmi_success:
|
||||
@@ -594,16 +591,6 @@ forwardshell_client_connected:
|
||||
forwardshell_read_failed:
|
||||
other: "Failed to read client command: {{.Arg1}}"
|
||||
|
||||
# AV detection
|
||||
avdetect_load_failed:
|
||||
other: "Failed to load AV database: {{.Arg1}}"
|
||||
avdetect_loaded:
|
||||
other: "Loaded {{.Arg1}} AV product info"
|
||||
avdetect_found:
|
||||
other: "Detected AV: {{.Arg1}} ({{.Arg2}} processes)"
|
||||
avdetect_process:
|
||||
other: " - {{.Arg1}}"
|
||||
|
||||
# Windows startup folder
|
||||
winstartup_success:
|
||||
other: "Windows startup folder persistence completed: {{.Arg1}} methods"
|
||||
@@ -709,6 +696,8 @@ systeminfo_patches:
|
||||
other: "Installed Patches: {{.Arg1}}"
|
||||
systeminfo_antivirus:
|
||||
other: "Antivirus Detected: {{.Arg1}}"
|
||||
systeminfo_av_process:
|
||||
other: " - {{.Arg1}}"
|
||||
systeminfo_sudo:
|
||||
other: "Sudo Privileges: {{.Arg1}}"
|
||||
systeminfo_macos_detail:
|
||||
|
||||
@@ -564,10 +564,6 @@ keylogger_save_failed:
|
||||
keylogger_no_input:
|
||||
other: "没有捕获到键盘输入"
|
||||
|
||||
# 环境变量信息
|
||||
envinfo_sensitive:
|
||||
other: "发现敏感环境变量: {{.Arg1}}"
|
||||
|
||||
# Windows WMI
|
||||
winwmi_success:
|
||||
other: "Windows WMI事件订阅持久化完成: {{.Arg1}}个项目"
|
||||
@@ -594,16 +590,6 @@ forwardshell_client_connected:
|
||||
forwardshell_read_failed:
|
||||
other: "读取客户端命令失败: {{.Arg1}}"
|
||||
|
||||
# AV检测
|
||||
avdetect_load_failed:
|
||||
other: "加载AV数据库失败: {{.Arg1}}"
|
||||
avdetect_loaded:
|
||||
other: "加载了 {{.Arg1}} 个AV产品信息"
|
||||
avdetect_found:
|
||||
other: "检测到AV: {{.Arg1}} ({{.Arg2}}个进程)"
|
||||
avdetect_process:
|
||||
other: " - {{.Arg1}}"
|
||||
|
||||
# Windows启动文件夹
|
||||
winstartup_success:
|
||||
other: "Windows启动文件夹持久化完成: {{.Arg1}}个方法"
|
||||
@@ -709,6 +695,8 @@ systeminfo_patches:
|
||||
other: "已安装补丁: {{.Arg1}}个"
|
||||
systeminfo_antivirus:
|
||||
other: "检测到杀软: {{.Arg1}}"
|
||||
systeminfo_av_process:
|
||||
other: " - {{.Arg1}}"
|
||||
systeminfo_sudo:
|
||||
other: "sudo权限: {{.Arg1}}"
|
||||
systeminfo_macos_detail:
|
||||
|
||||
Reference in New Issue
Block a user