win-custom-remove-malware.py

#!/usr/bin/env python3
# Custom Wazuh Active Response - Remove Malware by File Path (Windows)

import os
import sys
import json
import datetime

LOG_FILE = "C:\\Program Files (x86)\\ossec-agent\\active-response\\active-responses.log"

ADD_COMMAND = 0
DELETE_COMMAND = 1
CONTINUE_COMMAND = 2
ABORT_COMMAND = 3

OS_SUCCESS = 0
OS_INVALID = -1

def write_log(msg):
    try:
        with open(LOG_FILE, "a") as f:
            f.write(f"{datetime.datetime.now()} win-custom-remove-malware: {msg}\n")
    except Exception as e:
        with open("C:\\log_win_custom_remove_fallback.txt", "a") as f:
            f.write(f"{datetime.datetime.now()} Fallback log: {msg} | Error: {str(e)}\n")

def setup_message():
    try:
        input_str = sys.stdin.readline()
        data = json.loads(input_str)
        alert = data.get("parameters", {}).get("alert", {})
        file_path = alert.get("data", {}).get("virustotal", {}).get("source", {}).get("file")
        if not file_path:
            file_path = alert.get("syscheck", {}).get("path")
        if not file_path:
            file_path = alert.get("data", {}).get("misp", {}).get("file_path")
        command = data.get("command", "")
        return file_path, command
    except Exception as e:
        write_log(f"Error parsing stdin JSON: {str(e)}")
        return None, None

def main():
    file_path, command = setup_message()

    if not file_path:
        write_log("No file path found in alert data")
        sys.exit(OS_INVALID)

    write_log(f"Command: {command}, file_path: {file_path}")

    if command == "add":
        try:
            norm_path = os.path.normpath(file_path)
            if os.path.exists(norm_path):
                os.remove(norm_path)
                write_log(f"SUCCESS: Removed file '{norm_path}'")
            else:
                write_log(f"NOT FOUND: File '{norm_path}' does not exist")
        except Exception as e:
            write_log(f"ERROR removing file '{file_path}': {str(e)}")
            sys.exit(OS_INVALID)

    elif command == "delete":
        write_log("Delete command received (no action taken)")
    else:
        write_log(f"Invalid command: {command}")
        sys.exit(OS_INVALID)

    sys.exit(OS_SUCCESS)

if __name__ == "__main__":
    main()