import re

class mitre_rules():
    def __init__(self):
        self.oid = []
        self.tactic = 'Defense Evasion'
        self.tid = 'T1089'
        self.name = 'Disabling Security Tools'
        self.description = '''Disable security tools to avoid possible detection of their tools and activities.'''
        
    def run_rules(self, bundles):
        cnt = 0
        tool_list = ["@AAWTray","_avp32","_avpcc","_avpm","a2cmd","a2guard","a2service","a2start","a2wizard","AAV_Guard","AAV_Service_Vista","aAvgApi","abmainsv","ackwin32","acs","Ad-Aware","adaware","AdAwareDesktop","AdAwareService","AdAwareTray","AdvancedSystemProtector","advxdwin","afwServ","AgentSvc","agentsvr","agentw","alertsvc","alevir","ALMon","alogserv","ALsvc","amon9x","anti-trojan","antivirservice","antivirus","ants","apimonitor","aplica32","apvxdwin","arr","ARWSRVC","ASCService","ASDSvc","ASDUp","ashDisp","ashQuick","ashUpd","aswChLic","aswidsagenta","aswmbr","aswOfferTool","aswWrcIELoader32","aswWrcIELoader64","atcon","atguard","atro55en","atupdater","atwatch","au","aupdate","auto-protect.nav80try","AutoCare","autodown","autotrace","autoupdate","av_task","avast_free_antivirus_setup_online","AvastNM","AvastPE2","AvastSvc","AvastUI","avcom","avconfig","avconsol","ave32","AvEmUpdate","aveservice","avgcc32","avgcsrvx","avgctrl","avgemc","avgidsagent","avgnt","avgrsx","avgserv","avgserv9","AVGSvc","avguard","avgw","avgwdsvc","Avira.ServiceHost","AVK","avkpop","avkproxy","avkserv","avkservice","AVKTray","avkwctl9","AVKWCtlx64","AvLaunch","avltmain","avnt","avp","avp32","avpcc","avpdos32","avpm","avpmapp","avptc32","avpupd","avscan","AVScanningService","avsched32","avss","avsynmgr","AVWatchService","avwin","avwin95","avwinnt","avwupd","avwupd32","avwupsrv","avxmonitor9x","avxmonitornt","avxquar","axengine","backweb","bargains","Bav","bavhm","BavSvc","BavTray","BavUpdater","BavWebClient","bd_professional","bdagent","bdservicehost","BDSSVC","beagle","belt","BgScan","bidef","bidserver","bipcp","bipcpevalsetup","bisp","blackd","blackice","blink","blinksvc","blss","bootconf","bootwarn","borg2","bpc","bs120","BullGuard","BullGuardBhvScanner","BullGuardCore","BullGuardUpdate","BullGuarScanner","bvt","callmsi","capinfos","catchme","cavwp","ccapp","ccavsrv","ccevtmgr","ccpxysvc","ccSvcHst","cdp","CertReg","cfd","cfgwiz","cfiadmin","cfiaudit","cfinet","cfinet32","cfp","cis","CisTray","clamav","clamscan","ClamTray","ClamWin","claw95","claw95cf","cleaner","cleaner3","cleanpc","click","cmcark","cmdagent","cmesys","cmgrdian","cmon016","ComboFix","CommService","ConfigSecurityPolicy","connectionmonitor","CONSCTLX","coreFrameworkHost","coreServiceShell","cpd","cpf9x206","cpfnt206","ctrl","cv","cwnb181","cwntdwmo","datemanager","dcomx","defalert","defscangui","defwatch","deputy","divx","dllcache","dllreg","doors","dpf","dpfsetup","dpps2","dragon_updater","drwatson","drweb32","drwebupw","dssagent","dumpcap","dvp95","dvp95_0","dwservice","eCapture","ecengine","ecls","ecmd","ecmds","eComServer","econceal","econser","editcap","eeclnt","EEYEEVNT","efpeadm","egui","ekrn","EmDmp","EMLPROXY","EmsiClean","EmsisoftAntiMalwareSetup","emsw","ent","eOPPFrame","esafe","escanhnt","escanmon","escanpro","escanv95","espwatch","ethereal","etrustcipe","evpn","exantivirus-cnet","exe.avxw","expert","explore","f-agnt95","f-prot","f-prot95","f-stopw","fameh32","fast","fcappdb","FCDBlog","fch32","FCHelper64","fih32","FilMsg","FilUp","filwscc","findviru","flister","fmon","fnrb32","FortiClient","FortiClient_Diagnostic_Tool","FortiESNAC","FortiFW","FortiProxy","FortiSettings","FortiSSLVPNdaemon","FortiTray","fp-win","fp-win_trial","fpavserver","fprot","FProtTray","FPWin","freshclam","freshclamwrap","frw","fsaa","fsav","fsav32","fsav530stbyb","fsav530wtbyb","fsav95","fsgk32","fsguiexe","FSHDLL64","fshoster","fshoster32","fshoster64","fsm32","fsma","fsma32","fsmb32","fsorsp","fssm32","fsulprothoster","gator","gbmenu","gbpoll","GdBgInx64","GDFwSvcx","GDKBFltExe32","GDSC","GDScan","generics","gmt","grizzlyav","grizzlysvc","gsam","guard","guarddog","guardxkickoff","guardxkickoff_64","guardxkickoff_x64","guardxservice","guardxservice_x64","hacktracersetup","hbinst","hbsrv","hijackthis","HookShark","hotactio","hotpatch","htlog","htpatch","hwpe","hxdl","hxiul","iamapp","iamserv","iamstats","ibmasn","ibmavsp","icload95","icloadnt","icmon","icsupp95","icsuppnt","idle","iedll","iedriver","iface","ifw2000","ikarus-guardx","immunetprotect","inetlnfo","infus","infwin","init","instup","intdel","intren","iomon98","iptray","istsvc","jammer","jdbgmrg","jedi","K7AVScan","K7CrvSvc","K7EmlPxy","K7FWSrvc","K7PSSrvc","K7RTScan","K7SysMon","K7TSecurity","K7TSMain","K7TSMngr","kavlite40eng","kavpers40eng","kavpf","kazza","keenvalue","kerio-pf-213-en-win","kerio-wrl-421-en-win","kerio-wrp-421-en-win","kernel32","killprocesssetup161","ldnetmon","ldpro","ldpromenu","ldscan","LittleHook","lnetinfo","localnet","lockdown","lockdown2000","lookout","lordpe","lsetup","luall","luau","lucomserver","luinit","luspt","malwarebytes_assistant","mapisvc32","mbam","mbamgui","MbamPt","mbamscheduler","MBAMService","mbamtray","MBAMWsc","mbr","mcagent","McCSPServiceHost","mcmnhdlr","MCS-Uninstall","McsAgent","mcshield","MCShieldCCC","MCShieldDS","MCShieldRTM","mctool","McUICnt","mcupdate","mcvsrte","mcvsshld","md","mergecap","MFEConsole","mfin32","mfw2en","mfweng3.02d30","mgavrtcl","mgavrte","mghtml","mgui","minilog","mmod","ModuleCoreService","monitor","moolive","mostat","MpCmdRun","mpfagent","mpfservice","mpftray","MpUXSrv","mrflux","msapp","MSASCui","msbb","msblast","mscache","msccn32","mscman","msdm","msdos","msgui","msiexec16","msinfo32","mskrn","mslaugh","msmgt","MsMpEng","msmpsvc","msmsgri32","msseces","mssmmc32","mssys","msvxd","mu0311ad","MWAGENT","MWASER","mwatch","n32scanw","nanoav","nanoav64","nanosvc","nav","navap.navapsvc","navapsvc","navapw32","navdx","navlu32","navnt","navstub","navw32","navwnt","nbrowser","nc2000","ncinst4","ndd32","neomonitor","neowatchlog","netarmor","netd32","netinfo","netmon","netscanpro","netspyhunter-1.2","netstat","netutils","nfservice","nisserv","NisSrv","nisum","njeeves2","nmain","nnf","nod32","normist","norton_internet_secu_3.0_407","NortonAntiBot","nortonsecurity","notstart","npf40_tw_98_nt_me_2k","npfmessenger","nprosec","nprotect","npscheck","npssvc","NS","nsched32","nseupdatesvc","nssys32","nstask32","nsupdate","nt","ntrtscan","ntvdm","ntxconfig","nui","nupgrade","nvarch16","nvc95","nvcod","nvcsvc","nvoy","nvsvc32","nwinst4","nwscmon","nwservice","nwtool16","ollydbg","ONLINENT","onsrvr","op_mon","OPSSVC","optimize","ostronet","otfix","outpost","outpostinstall","outpostproinstall","padmin","panixk","patch","Pavark","pavcl","pavproxy","pavsched","pavsrv","pavw","pccwin98","pcfwallicon","pcip10117_0","PCKAVService","pcscan","pdsetup","periscope","persfw","perswf","pf2","pfwadmin","pgmonitr","pingscan","platin","pop3trap","poproxy","popscan","portdetective","portmonitor","powerscan","ppinupdt","pptbc","ppvstop","prizesurfer","prmt","prmvr","procdump","processhacker-2.39-setup","ProcessHacker","processmonitor","procexp","procexplorerv1.0","programauditor","proport","protectx","PSANHost","pshost","pspf","PSUAMain","PSUAService","psview","PtSessionAgent","PtSvcHost","PtWatchDog","qconsole","QHActiveDefense","qhpisvr","QHWatchdog","QQPCRTP","QQPCTray","qserver","quamgr","QUHLPSVC","rapapp","rav7","rav7win","rav8win32eng","rawshark","rb32","rcsync","realmon","reged","RegReveal","REPRSVC","rescue","rescue32","rrguard","rshell","RsMgrSvc","RsTray","rstrui","rtvscan","rtvscn95","rulaunch","run32dll","rundll","rundll16","ruxdll32","safeweb","sahagent","SAPISSVC","SASCore64","SASTask","savenow","SAVAdminService","savservice","SBAMSvc","SBAMTray","SBPIMSvc","sbserv","scam32","scan32","scan95","SCANNER","scanpm","SCANWSCS","sched","schmgr","scproxysrv","scrscan","ScSecSvc","SDFSSvc","SDScan","SDTray","SDWelcome","serv95","setup_flowprotector_us","setupvameeval","sfc","sgssfw32","shellspyinstall","shn","showbehind","SISIPSService","smc","smss32","soap","sofi","speclean","sperm","spf","sphinx","spideragent","spoler","spoolcv","spoolsv32","spybotsd","spyxx","srexe","srng","ss3edit","ssg_4104","ssgrate","SSUpdate64","st2","stcloader","STOPzilla","SUPERAntiSpyware","SUPERDelete","supftrl","svchostc","svchosts","svshost","sweep95","sweepnet.sweepsrv.sys.swnetsup","symproxysvc","SysInspector","sysupd","SZServer","tbscan","tcm","tds-3","tds2-98","tds2-nt","teekids","text2pcap","tfak","tfak5","tgbob","titanin","titaninxp","tracert","TRAYICOS","TRAYSSER","trickler","trigger","trjscan","trjsetup","trojantrap3","tsadbot","tshark","tvmd","tvtmd","twister","twsscan","twssrv","uiSeAgnt","uiUpdateTray","uiWatchDog","uiWinMgr","undoboot","UnThreat","updat","update","upgrad","UserReg","utpost","utsvc","V3Main","V3Medic","V3Proxy","V3SP","V3Svc","V3Up","vba32ldr","vba32ldrgui","vbcmserv","vbcons","vbservprof","vbust","vbwin9x","vbwinntw","VC90Setup_P_DESKTOP_All_x64","vcsetup","vet32","vet95","vettray","vfsetup","VIEWTCP","VipreAAPSvc","VIPREUI","vir-help","ViRobot7x64_Trial","ViRobot7x86_Trial","ViRobotAPTShieldSetup_Free","virusmdpersonalfirewall","virusutilities","VisthAux","vnlan300","vnpc3000","vpc32","vpc42","vpfw30s","vptray","vscan40","vscenu6.02d30","vsched","vsecomr","vshwin32","vsisetup","vsmain","vsmon","vsstat","vswin9xe","vswinntse","vswinperse","w32dsm89","w9x","watchdog","WebCompanion","webdav","webscanx","webtrap","wfindv32","whoswatchingme","wimmun32","win-bugsfix","win32","win32us","winactive","windefend","window","windows","wininetd","wininitx","winlogin","winmain","winnet","winppr32","winrecon","winservn","winssk32","winstart","winstart001","wintsk32","winupdate","wireshark","wkufind","wnad","wnt","wradmin","wrctrl","WRSA","wsbgate","wsc_proxy","wupdater","wupdt","wyvernworksfirewall","xpf202en","ZAM","Zanda","ZAPrivacyService","zapro","zapsetup3001","zatutor","Zemana.AntiMalware.Setup","ZIS","ZISCore","zlclient","Zlh","zlhh","zonalm2601","zonealarm"]
        tool_ptn = r"({0})(\.exe)".format("|".join(tool_list))
        for entry in bundles['objects']:
            if entry['type'] == 'indicator':
                if re.search('process:command_line .*taskkill.*\s'+tool_ptn+ r'\s.*', entry['pattern'], re.IGNORECASE):
                    self.oid.append(entry['id'])
                    cnt += 1
                    break
                if re.search('process:command_line .*(netsh(\.exe)?\s*advfirewall set (allprofiles|currentprofile|domainprofile|privateprofile|publicprofile) state off)|(netsh(\.exe)?\s*firewall set opmode mode=disable)', entry['pattern']):
                    self.oid.append(entry['id'])
                    cnt += 1
                    break
        if cnt != 0:
            return self
        else:
            return False