Update fetch_data.py

Author: venatus9

fetch_data.py

@@ -3,16 +3,23 @@
 import subprocess
 import logging
 import ipaddress
-from datetime import datetime
+from datetime import datetime, timedelta
 
 # Configure logging
 logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s: %(message)s")
 
 OUTPUT_DIR = "data"
 OUTPUT_FILE = os.path.join(OUTPUT_DIR, "data.json")
 
-# Define suspicious ports often used by malware/trojans (example)
 SUSPICIOUS_PORTS = {6667, 31337, 4444, 5555, 12345, 27374, 31338}
+SUSPICIOUS_EXTENSIONS = {".dmg", ".sh", ".command", ".app", ".py", ".pl", ".rb", ".exe", ".jar"}
+# Directories to scan for suspicious files
+WATCHED_DIRS = [
+    "/tmp",
+    "/var/tmp",
+    os.path.expanduser("~/Library/Application Support"),
+    os.path.expanduser("~/Downloads"),
+]
 
 def is_public_ip(ip):
     try:
@@ -35,11 +42,6 @@ def parse_lsof():
     suspicious_endpoints = []
 
     lines = output.strip().split("\n")
-    header = lines[0]
-    cols = header.split()
-    # Typical columns: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
-    # We'll focus on COMMAND, PID, USER, NAME (last column has IP:port info)
-
     for line in lines[1:]:
         parts = line.split()
         if len(parts) < 9:
@@ -48,10 +50,8 @@ def parse_lsof():
         command = parts[0]
         pid = parts[1]
         user = parts[2]
-        name = parts[-1]  # format like TCP 192.168.1.5:56789->198.51.100.23:80 (ESTABLISHED)
+        name = parts[-1]
 
-        # Extract remote IP and port from NAME if possible
-        # Example: TCP 192.168.1.5:56789->198.51.100.23:80 (ESTABLISHED)
         if "->" not in name:
             continue
 
@@ -66,7 +66,6 @@ def parse_lsof():
         except ValueError:
             continue
 
-        # Check if remote_ip is public and port is suspicious
         if is_public_ip(remote_ip) or remote_port in SUSPICIOUS_PORTS:
             suspicious_endpoints.append({
                 "timestamp": datetime.utcnow().isoformat() + "Z",
@@ -80,20 +79,73 @@ def parse_lsof():
 
     return suspicious_endpoints
 
+def check_suspicious_files():
+    """
+    Scan WATCHED_DIRS for recently created suspicious files.
+    """
+    suspicious_files = []
+    now = datetime.now()
+    lookback = now - timedelta(days=1)  # last 1 day
+
+    for directory in WATCHED_DIRS:
+        if not os.path.exists(directory):
+            continue
+
+        logging.info(f"Scanning directory for suspicious files: {directory}")
+
+        # Use find command to list files modified in last 1 day
+        try:
+            cmd = ["find", directory, "-type", "f", "-mtime", "-1", "-print"]
+            output = subprocess.check_output(cmd, text=True)
+            files = output.strip().split("\n")
+        except Exception as e:
+            logging.error(f"Failed to scan directory {directory}: {e}")
+            continue
+
+        for filepath in files:
+            if not filepath:
+                continue
+            _, ext = os.path.splitext(filepath.lower())
+
+            if ext in SUSPICIOUS_EXTENSIONS or any(s in filepath.lower() for s in ["temp", "tmp", "update", "install", "launch"]):
+                try:
+                    stat = os.stat(filepath)
+                    ctime = datetime.fromtimestamp(stat.st_ctime)
+                    if ctime < lookback:
+                        # Ignore files older than lookback anyway
+                        continue
+                except Exception:
+                    ctime = None
+
+                suspicious_files.append({
+                    "timestamp": ctime.isoformat() + "Z" if ctime else None,
+                    "filepath": filepath,
+                    "extension": ext,
+                })
+
+    return suspicious_files
+
 def save_data_to_json(data, filepath):
     os.makedirs(os.path.dirname(filepath), exist_ok=True)
     with open(filepath, "w", encoding="utf-8") as f:
         json.dump(data, f, indent=4)
-    logging.info(f"Saved {len(data)} suspicious endpoints to {filepath}")
+    logging.info(f"Saved data to {filepath}")
 
 def main():
-    suspicious_data = parse_lsof()
-    if suspicious_data:
-        logging.info(f"Found {len(suspicious_data)} suspicious network endpoints.")
-        save_data_to_json(suspicious_data, OUTPUT_FILE)
+    network_suspicious = parse_lsof()
+    file_suspicious = check_suspicious_files()
+
+    all_suspicious = {
+        "network_suspicious_endpoints": network_suspicious,
+        "suspicious_files_created": file_suspicious,
+    }
+
+    if network_suspicious or file_suspicious:
+        logging.info(f"Found {len(network_suspicious)} suspicious network endpoints and {len(file_suspicious)} suspicious files.")
     else:
-        logging.info("No suspicious network endpoints found.")
+        logging.info("No suspicious network endpoints or file creations found.")
+
+    save_data_to_json(all_suspicious, OUTPUT_FILE)
 
 if __name__ == "__main__":
     main()
-