Giters

stopipv / isdi

ISDi (IPV Spyware Discovery) tool for Android and iOS.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Integrate more Stalkerware IOCs

Te-k opened this issue · comments

commented

Hi,

I would like to submit a PR to integrate IOCs from this repo https://github.com/Te-k/stalkerware-indicators in order to add more appids to your detection. Would that be ok ?

commented

Great suggestion! Do you have a preferred way to integrate IoC with isdi?

commented

@tek feel free to provide feedback on the above PR

commented

Hey, apologies for not following through on this. Is there any reason for you to get IOCs in static data in the repository instead of having the app download the file regularly? It would be more likely to have the last version of IOCs.
Something like :

  • On startup, the app check if therer is an IOC file and when it was created. if it doesn't exist or is older than a week, download it from github
  • Then load the IOC file in the IOCs directly
    What do you think?
commented

@Te-k the PR proposes a Github action to pull IOC file every week

commented

Thanks, is there any reason to have the file in the repository rather than downloaded on use?