Added extra path catch handle and more edr products

PwnDexter · Aug 13, 2020 · 235d490 · 235d490
1 parent 085d39f
commit 235d490
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 2 deletions.
diff --git a/SharpEDRChecker/DriverChecker.cs b/SharpEDRChecker/DriverChecker.cs
@@ -93,6 +93,10 @@ internal static string CheckDriver(string driverFileName, string driverBaseName)
                 {
                     fixedDriverPath = fixedDriverPath.Replace(@"\windows\".ToLower(), @"c:\windows\".ToLower());
                 }
+                else if (fixedDriverPath.ToLower().StartsWith(@"\??\"))
+                {
+                    fixedDriverPath = fixedDriverPath.ToLower().Replace(@"\??\", @"");
+                }
                 var metadata = $"{FileChecker.GetFileInfo(fixedDriverPath)}";
                 var allattribs = $"{driverBaseName} - {metadata}";
 

diff --git a/SharpEDRChecker/EDRData.cs b/SharpEDRChecker/EDRData.cs
@@ -12,6 +12,7 @@ class EDRData
                 "anti virus",
                 "anti-virus",
                 "antivirus",
+                "appsense",
                 "authtap",
                 "avast",
                 "avecto",
@@ -47,6 +48,7 @@ class EDRData
                 "groundling",
                 "GRRservic",
                 "inspector",
+                "ivanti",
                 "kaspersky",
                 "lacuna",
                 "logrhythm",
@@ -94,7 +96,8 @@ class EDRData
                 "windowssensor",
                 "wireshark",
                 "threat",
-                "xagt"
+                "xagt.exe",
+                "xagtnotif.exe"
         };
     }
 }
diff --git a/SharpEDRChecker/FileChecker.cs b/SharpEDRChecker/FileChecker.cs
@@ -27,7 +27,7 @@ internal static string GetFileInfo(string filePath)
             {
                 if (filePath.ToLower().StartsWith(@"c:\windows\system32\"))
                 {
-                    filePath = filePath.ToLower().Replace(@"c:\windows\system32\", @"C:\Windows\Sysnative\");
+                    filePath = filePath.ToLower().Replace(@"c:\windows\system32\", @"c:\Windows\Sysnative\");
                     return GetFileInfo(filePath);
                 }
                 else