true,'use_sanesecurity'=>true,'dirs'=>['/home'],'interval'=>15,'ignore_paths'=>['/proc','/sys','/dev'],'ignore_ext'=>['tmp','log'],'susp_ext'=>['locked','encrypted','crypt']]); $output=''; if ($_SERVER['REQUEST_METHOD']==='POST') { csrf_validate(); $action=$_POST['action']??''; if ($action==='save') { $cfg['use_yara']=!empty($_POST['use_yara']); $cfg['use_sanesecurity']=!empty($_POST['use_sanesecurity']); $cfg['dirs']=bg_normalize_lines($_POST['dirs']??''); $cfg['interval']=max(1,(int)($_POST['interval']??15)); $cfg['ignore_paths']=bg_normalize_lines($_POST['ignore_paths']??''); $cfg['ignore_ext']=bg_normalize_lines($_POST['ignore_ext']??''); $cfg['susp_ext']=bg_normalize_lines($_POST['susp_ext']??''); bg_write_json('antiransomware.json',$cfg); bg_flash('success','Anti-Ransomware configuration saved.'); bg_redirect('antiransomware.php'); } elseif (in_array($action,['start','stop','restart'],true)) { $res=bg_service_action(['BastionGuard-ransomware-realtime.service','bastionguard-ransomware-realtime.service'],$action); bg_flash($res['code']===0?'success':'warning',$res['output']?:'Command executed.'); bg_redirect('antiransomware.php'); } elseif ($action==='scan') { $path=trim($_POST['path']??''); if($path===''||!file_exists($path)) $output='Invalid path.'; else { $bin = bg_cmd_exists('BastionGuard-ransomware-scanner') ? 'BastionGuard-ransomware-scanner ' : (bg_cmd_exists('/usr/bin/BastionGuard-ransomware-scanner')?'/usr/bin/BastionGuard-ransomware-scanner ':''); $cmd = $bin ? 'sudo -n '.$bin.escapeshellarg($path).' 2>&1' : 'sudo -n '.(bg_cmd_exists('clamdscan')?'clamdscan --fdpass ':'clamscan -r ').escapeshellarg($path).' 2>&1'; $res=bg_run($cmd,600); $output=$res['output']."\n\nExit code: ".$res['code']; } } elseif ($action==='update-yara') { $res=bg_admin_helper(['update-yara', bg_detect_desktop_user()], 900); $output=$res['output']."\n\nExit code: ".$res['code']; } elseif ($action==='update-sanesecurity') { $res=bg_admin_helper(['update-sanesecurity', bg_detect_desktop_user()], 900); $output=$res['output']."\n\nExit code: ".$res['code']; } } $st=bg_service_status(['BastionGuard-ransomware-realtime.service','bastionguard-ransomware-realtime.service']); $logs=bg_journal(['BastionGuard-ransomware-realtime.service','bastionguard-ransomware-realtime.service'],120); include 'includes/header.php'; include 'includes/sidebar.php'; ?>

Anti-Ransomware

Heuristic scanning, YARA rules, Sanesecurity DB and realtime service.

Realtime service
Scanner configuration
>
>
Output
Anti-Ransomware log