From aa7085bf929bac4d454ed8f4c5dad413d3234f3d Mon Sep 17 00:00:00 2001
From: Ben Perry <avenjamin@users.noreply.github.com>
Date: Tue, 30 May 2023 18:19:46 +1000
Subject: [PATCH] Update tests_malware

---
 include/tests_malware | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/include/tests_malware b/include/tests_malware
index 40336fa5..41814b43 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -39,6 +39,7 @@
     MALWARE_SCANNER_INSTALLED=0
     MALWARE_DAEMON_RUNNING=0
     ROOTKIT_SCANNER_FOUND=0
+    SENTINELONE_SCANNER_FOUND=0
     SOPHOS_SCANNER_RUNNING=0
     SYMANTEC_SCANNER_RUNNING=0
     SYNOLOGY_DAEMON_RUNNING=0
@@ -231,6 +232,20 @@
             Report "malware_scanner[]=mcafee"
         fi
 
+       # SentinelOne
+       LogText "Text: checking process sentineld (SentinelOne)"
+       if isRunning "sentineld"; then SENTINELONE_SCANNER_RUNNING=1; fi # macOS
+       if isRunning "s1-agent"; then SENTINELONE_SCANNER_RUNNING=1; fi # Linux
+       if isRunning "SentinelAgent"; then SENTINELONE_SCANNER_RUNNING=1; fi # Windows
+       if [ ${SENTINELONE_SCANNER_RUNNING} -eq 1 ]; then
+            FOUND=1
+            if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} SentinelOne" --result "${STATUS_FOUND}" --color GREEN; fi
+            LogText "Result: Found SentinelOne"
+            MALWARE_DAEMON_RUNNING=1
+            MALWARE_SCANNER_INSTALLED=1
+            Report "malware_scanner[]=sentinelone"
+        fi
+
         # Sophos savscand/SophosScanD
         LogText "Test: checking process savscand"
         if IsRunning "savscand"; then