objective-see / objective-see/BlockBlock
Feature Request: Switch the Virustotal target depending on parent process
Nobody has claimed this yet.
- Dominant language
- Objective-C
- Stars
- 848
- Forks
- 49
- PR merge metrics
- No merged PRs in 30d
Description
There's been quite a few times where I've gotten a BlockBlock notification about backgroundtaskmanagementd parent adding a new startup entry, I click the VirusTotal button and it shows me the detection status of the parent instead of the new startup process.
It'd be quite nice if there was some logic that would swap the target depending on the parent process, I know that backgroundtaskmanagementd is legitimate but I'm interested in the status of the new startup entry.
I really love BlockBlock, thanks so much to all the folks at Objective-See for building it and releasing it for free :-)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the VirusTotal button handling and how the notification records its parent process and new startup process; the payload names no files or tests. Done means the button selects the new startup process for VirusTotal when the parent is the reported legitimate process, while preserving the appropriate target in other cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- objective-c
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100