@@ -0,0 +1,2405 @@
+'''%0AWatch the shell commands being executed actively%0A'''%0A# Import python libs%0Aimport time%0A# Import salt libs%0Aimport salt.utils.vt%0A%0A# Command%0A# strace -f -e execve -p 3145%0A%0Adef _get_shells():%0A    '''%0A    Return the valid shells on this system%0A    '''%0A    start = time.time()%0A    if 'sh.last_shells' in __context__:%0A        if start - __context__%5B'sh.last_shells'%5D %3E 5:%0A            __context__%5B'sh.last_shells'%5D = start%0A        else:%0A            __context__%5B'sh.shells'%5D = __salt__%5B'cmd.shells'%5D()%0A    else:%0A        __context__%5B'sh.last_shells'%5D = start%0A        __context__%5B'sh.shells'%5D = __salt__%5B'cmd.shells'%5D()%0A    return __context__%5B'sh.shells'%5D%0A%0Adef beacon(config):%0A    '''%0A    Scan the shell execve%0A    '''%0A    ret = %5B%5D%0A    pkey = 'sh.vt'%0A    shells = _get_shells()%0A    ps_out = __salt__%5B'status.procs'%5D()%0A    track_pids = %5B%5D%0A    for pid in ps_out:%0A        if ps_out%5Bpid%5D.get('cmd', '') in shells:%0A            track_pids.append(pid)%0A    if pkey not in __context__:%0A        __context__%5Bpkey%5D = %7B%7D%0A    for pid in track_pids:%0A        if pid not in __context__%5Bpkey%5D:%0A            cmd = %5B'strace', '-f', '-e', 'execve', '-p', '%7B0%7D'.format(pid)%5D%0A            __context__%5Bpkey%5D%5Bpid%5D%5B'vt'%5D = salt.utils.vt.Terminal(%0A                    cmd,%0A                    log_stdout=True,%0A                    log_stderr=True,%0A                    stream_stdout=False,%0A                    stream_stderr=False)%0A            __context__%5Bpkey%5D%5Bpid%5D%5B'user'%5D = ps_out%5Bpid%5D.get('user')%0A    for pid in __context__%5Bpkey%5D:%0A        out = ''%0A        err = ''%0A        while __context__%5Bpkey%5D%5Bpid%5D%5B'vt'%5D.has_unread_data:%0A            tout, terr = __context__%5Bpkey%5D%5Bpid%5D%5B'vt'%5D.recv()%0A            out += tout%0A            err += terr%0A        for line in err.split('%5Cn'):%0A            event = %7B'args': %5B%5D,%0A                     'tag': pid%7D%0A            if 'execve' in line:%0A                comps = line.split('execve')%5B1%5D.split('%22')%0A                for ind in range(len(comps)):%0A                    if ind == 1:%0A                        event%5B'cmd'%5D = comps%5Bind%5D%0A                        continue%0A                    if ind %25 2 != 0:%0A                        event%5B'args'%5D.append(comps%5Bind%5D)%0A                event%5B'user'%5D = __context__%5Bpkey%5D%5Bpid%5D%5B'user'%5D%0A                ret.append(event)%0A        if not __context__%5Bpkey%5D%5Bpid%5D%5B'vt'%5D.is_alive():%0A            __context__%5Bpkey%5D%5Bpid%5D%5B'vt'%5D.close()%0A            __context__%5Bpkey%5D.pop(pid)%0A    return ret%0A

Add sh beacon