behavior

Documentation

Index

• type Event
• type MatchRule
• type ScanResult
• type Scanner
  • func New(behaviorRules string, logger log.Logger) (Scanner, error)
  • func (s Scanner) Close()
  • func (s Scanner) Scan(apiTrace []byte) (ScanResult, error)

Types

type Event

type Event struct {
	// Process identifier responsible for generating the event.
	ProcessID string `json:"proc_id"`
	// Type of the system event.
	Type string `json:"type"`
	// Path of the system event. For instance, when the event is of type:
	// `registry`, the path represents the registry key being used. For a
	// `network` event type, the path is the IP or domain used.
	Path string `json:"path"`
	// Th operation requested over the above `Path` field. This field means
	// different things according to the type of the system event.
	// - For file system events: can be either: create, read, write, delete, rename, ..
	// - For registry events: can be either: create, rename, set, delete.
	// - For network events: this represents the protocol of the communication, can
	// be either HTTP, HTTPS, FTP, FTP
	Operation string `json:"operation"`
}

Event represents a system event: a registry, network or file event.

type MatchRule

type MatchRule struct {
	// Description describes the purpose of the rule.
	Description string `json:"description"`
	// ID uniquely identify the rule.
	ID string `json:"id"`
	// Category indicates the category of the behavior rules.
	// examples include: anti-analysis, ransomware, ..
	Category string `json:"category"`
	// Severity indicates how confident the rule is to classify
	// the threat as malicious.
	Severity string `json:"severity"`
	// Process identifier responsible for matching the rule.
	// This field is not always available as some behavior rules matches over
	// multiple processes.
	ProcessID string `json:"proc_id"`
}

MatchRule describes a matched behavior rule.

type ScanResult

type ScanResult struct {
	Rules  []MatchRule `json:"matches"`
	Events []Event     `json:"events"`
}

ScanResult represents the behavior rules scan results.

type Scanner

type Scanner struct {
	L      *lua.State
	Logger log.Logger
}

func New

func New(behaviorRules string, logger log.Logger) (Scanner, error)

func (Scanner) Close

func (s Scanner) Close()

Close the lua state object.

func (Scanner) Scan

func (s Scanner) Scan(apiTrace []byte) (ScanResult, error)

Scan a behavior report and extract system events and matching rules.