Island: Allow Windows ransomware target paths to be UNC paths

This commit is contained in:
Mike Salvatore 2021-07-05 13:54:04 -04:00
parent 9d4ee88e09
commit d2dda4519f
1 changed files with 4 additions and 3 deletions

View File

@ -12,8 +12,8 @@ const windowsAbsolutePathRegex = /^([A-Za-z]:(\\|\/))/ // path starts like `C:\`
const windowsEnvVarNonNumeric = '[A-Za-z#\\$\'\\(\\)\\*\\+,-\\.\\?@\\[\\]_`\\{\\}~+ ]' const windowsEnvVarNonNumeric = '[A-Za-z#\\$\'\\(\\)\\*\\+,-\\.\\?@\\[\\]_`\\{\\}~+ ]'
const windowsPathStartsWithEnvVariableRegex = new RegExp( const windowsPathStartsWithEnvVariableRegex = new RegExp(
`^%(${windowsEnvVarNonNumeric}+(${windowsEnvVarNonNumeric}|\\d)*)%` `^%(${windowsEnvVarNonNumeric}+(${windowsEnvVarNonNumeric}|\\d)*)%`
);// path starts like `$` OR `%abc%` ) // path starts like `$` OR `%abc%`
const windowsUncPathRegex = /^\\{2}/ // Path starts like `\\`
const emptyRegex = /^$/ const emptyRegex = /^$/
@ -55,6 +55,7 @@ function buildValidRansomwarePathWindowsRegex() {
return new RegExp([ return new RegExp([
emptyRegex.source, emptyRegex.source,
windowsAbsolutePathRegex.source, windowsAbsolutePathRegex.source,
windowsPathStartsWithEnvVariableRegex.source windowsPathStartsWithEnvVariableRegex.source,
windowsUncPathRegex.source
].join('|')) ].join('|'))
} }