Webshell.yaml

name: Weekly webshell update

permissions:
  contents: write

on:
  schedule:
    - cron: '0 3 * * 0' # Runs at 03:00 every Sunday
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
      with:
        ref: ${{ github.head_ref }}
    
    - name: Install Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.10'
    - name: Install python requirements
      run: |
          pip install PyYAML==6.0 -q
          pip install requests -q
          pip install plyara -q #2.1.1

    - name: Update yara rules and buildvql
      run: |
          mkdir -p ./vql
          cd ./scripts
          python get_webshell_yara.py
          python yarawebshell.py
          
    - name: Git Auto Commit
      uses: stefanzweifel/git-auto-commit-action@v4.15.4
      with:
        commit_message: AutoUpdate VQL and yara
        file_pattern: vql/*.yaml yara/*.yar
        
    - name: Zip Folder
      run: zip -r DetectRaptorVQL.zip vql/*.yaml
    - uses: ncipollo/release-action@v1
      with:
        artifacts: DetectRaptorVQL.zip
        tag: DetectRaptor
        allowUpdates: true