update threatcheck.yml name

MythicAgents · Feb 16, 2024 · f3212fe · f3212fe
1 parent a5a8011
commit f3212fe
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/.github/workflows/threatcheck.yml b/.github/workflows/threatcheck.yml
@@ -1,11 +1,15 @@
-name: Agent Builds
+name: Check Against Defender
 
 on:
   push:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
 
+# on:
+#   schedule:
+#     - cron: "0 13 * * 1"
+
 jobs:
 
   build:

diff --git a/Payload_Type/athena/athena/agent_code/Tests/Agent.Tests/DefenderTests/AmsiTests.cs b/Payload_Type/athena/athena/agent_code/Tests/Agent.Tests/DefenderTests/AmsiTests.cs
@@ -16,6 +16,7 @@ public class AmsiTests
         [TestMethod]
         public void ScanFiles()
         {
+            //Can't be run with github actions
             bool malicious = false;
             string parent_dir = Directory.GetParent(Directory.GetCurrentDirectory()).Parent.Parent.Parent.Parent.FullName; //How deep does the rabbit hole go?
             foreach (string file in Directory.EnumerateFiles(parent_dir, "*.dll*", SearchOption.AllDirectories))
@@ -31,8 +32,10 @@ public void ScanFiles()
                 {
                     if (!amsi.RealTimeProtectionEnabled)
                     {
+                        //Default pass the test if real-time protection is not enabled (Github Actions has this disabled.)
                         Console.WriteLine("Ensure real-time protection is enabled");
-                        malicious = true;
+                        malicious = false;
+                        break;
                     }
 
                     amsi.AnalyzeBytes(b);