Ansible playbook to check for files related to Exaramel

exaramel.yml

---
# Checks if files exists that related to Exaramel Malware
# Ref:https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf

- name: Setting files to check
  set_fact:
    maliciousFiles:
      - /tmp/.applocktx
      - /tmp/.applock
      - /usr/local/centreon/www/search.php
      - /usr/share/centreon/www/search.php
      - /usr/share/centreon/www/modules/Discovery/include/DB−Drop.php
      - /usr/share/centreon/www/htmlHeader.php

- name: Check whether a file exists
  stat:
    path: "{{item}}"
  register: exaramelInfected
  with_items: "{{maliciousFiles}}"

- name: Evaluate Results
  set_fact: 
    res: "{% for file in exaramelInfected.results %}{% if file.stat.exists %}{{file.stat.path}};{%endif%}{% endfor %}"

- name: Print Clean Hosts
  debug:
    msg: "'{{ inventory_hostname }}' Likely Clean!"
  when: res == ""

- name: Print Infected Hosts
  fail:
    msg: "'{{ inventory_hostname }}' infected with Exaramel malware: {{res}}"
  when: res != ""