azcomputerguru/claudetools
1
0
Fork 0
Code Issues 72 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
cda32b53bbe3604b2dee39b151e7f207db2345e5
claudetools/session-logs/2026-07/2026-07-10-howard-guruscan-rkill-whitelist.md
Howard Enos 0fdeabde3d sync: auto-sync from HOWARD-HOME at 2026-07-10 14:44:39 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-10 14:44:39
2026-07-10 14:45:46 -07:00

8.4 KiB
Raw Blame History

GuruScan — RKill Process Whitelist + Scan-Log Protection — 2026-07-10

User

  • User: Howard Enos (howard)
  • Machine: Howard-Home
  • Role: tech

Session Summary

Resumed the paused GuruScan verification effort (multi-engine malware scanner, projects/msp-tools/guru-scan) to fix a real defect: RKill, which runs first in the chain as a process killer, could terminate the PowerShell host running the scan itself, aborting the whole chain before HitmanPro and Emsisoft ever launch. A parallel commit pushed from another machine this same day (7a5a657 test-results: TPM-PC production scan ... RKill-kills-parent bug found) independently confirmed the bug against a live production scan, so the fix lands on an observed real-world failure.

The clean fix uses RKill's own -w <file> switch, which takes a whitelist of full EXE paths (one per line, no quotes — quotes break RKill's path matching) that it must not terminate. The module now writes C:\GuruScan\rkill-whitelist.txt before the scanner loop, containing the live host path ((Get-Process -Id $PID).Path) plus the standard 64/32-bit powershell.exe locations, written ASCII (no BOM) so the first line matches cleanly. scanners.json passes -w C:\GuruScan\rkill-whitelist.txt on RKill's scan and clean args. RKill was already scanner #1 in the array order, so no reordering was needed.

Two follow-up changes came from user direction. First, the EICAR prep-phase seed in the RMM test harness (.claude/scripts/guruscan-agent-test.sh) was disabled, not deleted — gated behind a SEED_EICAR flag (default off) with its own self-contained Defender exclusion, so it can be switched back on (SEED_EICAR=1) to smoke-test detection as new scanners are added. Detection testing otherwise uses the real malware-samples set via the scan-one/verify-each phases. Second, the post-reboot cleanup was hardened so scan logs are never removed: Invoke-ScannerCleanup.ps1 already only deleted scanner install dirs + C:\GuruScan\downloads (never C:\ScanLogs), but it now documents that invariant and adds a runtime guard that skips any path under C:\ScanLogs or C:\GuruScan\reports, so a future edit can't accidentally delete the logs or archives that must survive the remediate → reboot → cleanup lifecycle.

All three guru-scan files parse clean and the harness passes bash -n. The guru-scan submodule was committed and pushed (rebased onto the other machine's concurrent commits); the superproject gitlink bump + harness change + this log sync via /save.

Key Decisions

  • RKill -w whitelist over any process-renaming or ordering hack — RKill natively supports a whitelist file of full EXE paths; using it is the simplest correct fix and needs no change to how the orchestrator launches.
  • Whitelist written ASCII (no BOM) — RKill reads the whitelist line-by-line; a UTF-8 BOM would corrupt the first path match. The existing whitelist.txt (Emsisoft/HitmanPro) stays UTF-8 because those engines tolerate it; the RKill file is deliberately ASCII.
  • EICAR disabled, not removed — user wants it retained for future scanner smoke-tests. Gated behind SEED_EICAR (default 0) rather than deleted.
  • Cleanup guard scoped to C:\ScanLogs + C:\GuruScan\reports — belt-and-suspenders: logs were already safe, but an explicit runtime guard + doc comment prevents a future edit from ever adding a log path to the removal list.
  • RKill fix in module + scanners.json (not harness-only) — so it applies to production runs, not just the test harness (the harness just deploys the same module/JSON).

Problems Encountered

  • guru-scan push rejected (non-fast-forward) — remote had newer commits from another machine (including the TPM-PC RKill-kills-parent finding). Resolved by git fetch + git rebase origin/main, then push (7a5a657..087c73c).

Configuration Changes

Modified (guru-scan submodule, committed 087c73c + pushed):

  • GuruScan.psm1 — write C:\GuruScan\rkill-whitelist.txt (ASCII) before the scanner loop; live host path via Get-Process -Id $PID + standard PowerShell paths, de-duped.
  • scanners.json — RKill scan_args/clean_args add -w C:\GuruScan\rkill-whitelist.txt.
  • Invoke-ScannerCleanup.ps1 — doc that scan logs/archives are never removed; runtime guard skips any path under C:\ScanLogs or C:\GuruScan\reports.

Modified (main repo):

  • .claude/scripts/guruscan-agent-test.sh — EICAR prep seed gated behind SEED_EICAR (default off, self-contained Defender exclusion); readiness check no longer requires EICAR; header/alert comments updated.

Credentials & Secrets

  • None created or discovered this session.

Infrastructure & Servers

  • DESKTOP-MS42HNC — GuruScan test VM (agent id 0de89b88-b21d-4647-ab64-96157ba87cc5, AZ Computer Guru / Howard-VM). Not touched this session; RKill-whitelist verification (re-run prep) pending its next online window.
  • TPM-PC — production endpoint where the RKill-kills-parent bug was observed (see the concurrent commit 7a5a657 / test-results/ in guru-scan).
  • GuruRMM API — http://172.16.3.30:3001; creds vault infrastructure/gururmm-server.sops.yaml.
  • GuruScan deploy paths: C:\GuruScan\ (module + rkill-whitelist.txt), C:\GuruScan\downloads\ (scanner EXEs), C:\EmsisoftCmd\ (Emsisoft), C:\ScanLogs\<scanid>\ (logs, preserved), C:\GuruScan\reports\<scanid>.zip (log archive, preserved).

Commands & Outputs

  • RKill whitelist switch: rkill -w C:\path\wl.txt — full EXE paths, one per line, no quotes, ANSI/UTF-8 (no BOM). RKill lists whitelisted-and-ignored processes at run.
  • Validation: bash -n .claude/scripts/guruscan-agent-test.sh → OK; PowerShell AST ParseFile on GuruScan.psm1 + Invoke-ScannerCleanup.ps1 → clean.
  • Enable EICAR smoke-test: SEED_EICAR=1 bash .claude/scripts/guruscan-agent-test.sh <host> prep.
  • guru-scan submodule push: 7a5a657..087c73c main -> main.

Pending / Incomplete Tasks

  • Verify the RKill whitelist live — re-run bash .claude/scripts/guruscan-agent-test.sh DESKTOP-MS42HNC prep (or scan) when the VM is online; confirm rkill-whitelist.txt is written and RKill logs the PowerShell host as an ignored/whitelisted process.
  • Emsisoft vs HitmanPro detection comparison — still open from the prior session (scan-one Emsisoft on DESKTOP-MS42HNC). See project_guruscan_in_test_paused.
  • Clean up DESKTOP-MS42HNC — remove samples/zip/EICAR/test artifacts; re-enable Defender RTP + Tamper Protection (disabled at the console for malware testing).

Reference Information

  • guru-scan commit: 087c73c (pushed to https://git.azcomputerguru.com/azcomputerguru/guru-scan.git main).
  • Prior related logs: session-logs/2026-06/2026-06-22-howard-guruscan-hardening.md, .../2026-06-22-howard-gururmm-dispatch-hang-fix-guruscan-paused.md.
  • Memory: project_guruscan_in_test_paused.
  • RKill command-line reference (BleepingComputer): -d debug, -h help, -l <log>, -w <whitelist>.
  • HitmanPro exit-code bitmask: bit0(1)=threats, bit2(4)=reboot → 5 = threats+reboot.

Update: guru-scan 3ca5ba7 — whitelist Syncro/Datto EDR/GuruRMM from RKill + HitmanPro

Per follow-up: ensure RKill and HitmanPro (and Emsisoft) never touch Syncro, Datto EDR, or GuruRMM files/folders.

  • HitmanPro/Emsisoft (folder exclusion via whitelist.txt) — GuruRMM (C:\Program Files\GuruRMM, C:\ProgramData\GuruRMM) and Syncro (C:\Program Files\RepairTech, (x86), C:\ProgramData\Syncro) were already listed. Added Datto EDR / Datto AV (Infocyte lineage): C:\Program Files\Infocyte, C:\Program Files\Datto, C:\Program Files (x86)\Datto, C:\ProgramData\Datto, C:\ProgramData\CentraStage\AEMAgent\RMM.AdvancedThreatDetection. Datto EDR agent is agent.exe (service HUNTAgent); standard install is the Infocyte tree, CentraStage path covers a Datto-RMM-bundled EDR deployment.
  • RKill (process killer, not a file scanner) — folder exclusions don't apply, so the module now enumerates every RUNNING process whose EXE lives under a whitelisted tool folder and adds it to the -w RKill whitelist by full path (folder-membership → no hardcoded exe names). Spares GuruRMM, Syncro, Datto EDR, ScreenConnect, Bitdefender, MSP360, Splashtop agents live at scan time.

Datto EDR paths confirmed from Datto's own allowlisting guide (edr.datto.com/.../allowlisting-agent.htm). GuruScan.psm1 parses clean. guru-scan HEAD now 3ca5ba7 (pushed).

Reference in New Issue View Git Blame Copy Permalink