Skip to content

Drive Badger configuration: exclude PDF readers and editing software during exfiltration

License

Notifications You must be signed in to change notification settings

drivebadger/exclude-pdf

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 
 
 
 
 

Repository files navigation

This is an extension for Drive Badger. It provides exclude.list file, containing a list of exclusions compatible with popular rsync program.

The purpose of these exclusions is to decrease the amount of data to be exfiltrated by Drive Badger, and thus to speed up the attack, by eliminating files and directories, that are not valuable in any way to the attacker:

  • PDF readers/writers: Adobe Reader, Foxit Reader, Foxit PhantomPDF, novaPDF, PDF Architect, PDFCreator, PDFsam

Installing

Clone this repository as /opt/drivebadger/config/exclude-pdf directory on your Drive Badger persistent partition.

More information

About

Drive Badger configuration: exclude PDF readers and editing software during exfiltration

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published