Class: Google::Apis::SecuritycenterV1beta1::KernelRootkit

Inherits:
Object
  • Object
show all
Includes:
Core::Hashable, Core::JsonObjectSupport
Defined in:
lib/google/apis/securitycenter_v1beta1/classes.rb,
lib/google/apis/securitycenter_v1beta1/representations.rb,
lib/google/apis/securitycenter_v1beta1/representations.rb

Overview

Kernel mode rootkit signatures.

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(**args) ⇒ KernelRootkit

Returns a new instance of KernelRootkit.



11731
11732
11733
 
# File 'lib/google/apis/securitycenter_v1beta1/classes.rb', line 11731

def initialize(**args)
   update!(**args)
end

Instance Attribute Details

#name ⇒ String

Rootkit name, when available. Corresponds to the JSON property name

Returns:

  • (String) 


11675
11676
11677
 
# File 'lib/google/apis/securitycenter_v1beta1/classes.rb', line 11675

def name
  @name
end

#unexpected_code_modification ⇒ Boolean Also known as: unexpected_code_modification?

True if unexpected modifications of kernel code memory are present. Corresponds to the JSON property unexpectedCodeModification

Returns:

  • (Boolean) 


11680
11681
11682
 
# File 'lib/google/apis/securitycenter_v1beta1/classes.rb', line 11680

def unexpected_code_modification
  @unexpected_code_modification
end

#unexpected_ftrace_handler ⇒ Boolean Also known as: unexpected_ftrace_handler?

True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range. Corresponds to the JSON property unexpectedFtraceHandler

Returns:

  • (Boolean) 


11687
11688
11689
 
# File 'lib/google/apis/securitycenter_v1beta1/classes.rb', line 11687

def unexpected_ftrace_handler
  @unexpected_ftrace_handler
end

#unexpected_interrupt_handler ⇒ Boolean Also known as: unexpected_interrupt_handler?

True if interrupt handlers that are are not in the expected kernel or module code regions are present. Corresponds to the JSON property unexpectedInterruptHandler

Returns:

  • (Boolean) 


11694
11695
11696
 
# File 'lib/google/apis/securitycenter_v1beta1/classes.rb', line 11694

def unexpected_interrupt_handler
  @unexpected_interrupt_handler
end

#unexpected_kernel_code_pages ⇒ Boolean Also known as: unexpected_kernel_code_pages?

True if kernel code pages that are not in the expected kernel or module code regions are present. Corresponds to the JSON property unexpectedKernelCodePages

Returns:

  • (Boolean) 


11701
11702
11703
 
# File 'lib/google/apis/securitycenter_v1beta1/classes.rb', line 11701

def unexpected_kernel_code_pages
  @unexpected_kernel_code_pages
end

#unexpected_kprobe_handler ⇒ Boolean Also known as: unexpected_kprobe_handler?

True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range. Corresponds to the JSON property unexpectedKprobeHandler

Returns:

  • (Boolean) 


11708
11709
11710
 
# File 'lib/google/apis/securitycenter_v1beta1/classes.rb', line 11708

def unexpected_kprobe_handler
  @unexpected_kprobe_handler
end

#unexpected_processes_in_runqueue ⇒ Boolean Also known as: unexpected_processes_in_runqueue?

True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list. Corresponds to the JSON property unexpectedProcessesInRunqueue

Returns:

  • (Boolean) 


11715
11716
11717
 
# File 'lib/google/apis/securitycenter_v1beta1/classes.rb', line 11715

def unexpected_processes_in_runqueue
  @unexpected_processes_in_runqueue
end

#unexpected_read_only_data_modification ⇒ Boolean Also known as: unexpected_read_only_data_modification?

True if unexpected modifications of kernel read-only data memory are present. Corresponds to the JSON property unexpectedReadOnlyDataModification

Returns:

  • (Boolean) 


11721
11722
11723
 
# File 'lib/google/apis/securitycenter_v1beta1/classes.rb', line 11721

def unexpected_read_only_data_modification
  @unexpected_read_only_data_modification
end

#unexpected_system_call_handler ⇒ Boolean Also known as: unexpected_system_call_handler?

True if system call handlers that are are not in the expected kernel or module code regions are present. Corresponds to the JSON property unexpectedSystemCallHandler

Returns:

  • (Boolean) 


11728
11729
11730
 
# File 'lib/google/apis/securitycenter_v1beta1/classes.rb', line 11728

def unexpected_system_call_handler
  @unexpected_system_call_handler
end

Instance Method Details

#update!(**args) ⇒ Object

Update properties of this object



11736
11737
11738
11739
11740
11741
11742
11743
11744
11745
11746
 
# File 'lib/google/apis/securitycenter_v1beta1/classes.rb', line 11736

def update!(**args)
  @name = args[:name] if args.key?(:name)
  @unexpected_code_modification = args[:unexpected_code_modification] if args.key?(:unexpected_code_modification)
  @unexpected_ftrace_handler = args[:unexpected_ftrace_handler] if args.key?(:unexpected_ftrace_handler)
  @unexpected_interrupt_handler = args[:unexpected_interrupt_handler] if args.key?(:unexpected_interrupt_handler)
  @unexpected_kernel_code_pages = args[:unexpected_kernel_code_pages] if args.key?(:unexpected_kernel_code_pages)
  @unexpected_kprobe_handler = args[:unexpected_kprobe_handler] if args.key?(:unexpected_kprobe_handler)
  @unexpected_processes_in_runqueue = args[:unexpected_processes_in_runqueue] if args.key?(:unexpected_processes_in_runqueue)
  @unexpected_read_only_data_modification = args[:unexpected_read_only_data_modification] if args.key?(:unexpected_read_only_data_modification)
  @unexpected_system_call_handler = args[:unexpected_system_call_handler] if args.key?(:unexpected_system_call_handler)
end