Trees | Indices | Help |
|
---|
|
1 # Copyright (C) 2010-2013 Claudio Guarnieri. 2 # Copyright (C) 2014-2016 Cuckoo Foundation. 3 # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 4 # See the file 'docs/LICENSE' for copying permission. 5 6 from lib.cuckoo.common.abstracts import Signature 79 name = "generic_metrics" 10 description = "Uses GetSystemMetrics" 11 severity = 2 12 categories = ["generic"] 13 authors = ["Cuckoo Developers"] 14 minimum = "2.0" 15 16 # Evented signatures can specify filters that reduce the amount of 17 # API calls that are streamed in. One can filter Process name, API 18 # name/identifier and category. 19 filter_processnames = () 20 filter_apinames = "GetSystemMetrics", 21 filter_categories = () 22 23 # This is a signature template. It should be used as a skeleton for 24 # creating custom signatures, therefore is disabled by default. 25 # The on_call function is used in "evented" signatures. 26 # These use a more efficient way of processing logged API calls. 27 enabled = False 284930 # In the stop method one can implement any cleanup code and 31 # decide one last time if this signature matches or not. 32 # Return True in case it matches. 33 return False34 35 # This method will be called for every logged API call by the loop 36 # in the RunSignatures plugin. The return value determines the "state" 37 # of this signature. True means the signature matched and False means 38 # it can't match anymore. Both of which stop streaming in API calls. 39 # Returning None keeps the signature active and will continue.
Trees | Indices | Help |
|
---|
Generated by Epydoc 3.0.1 on Fri Nov 4 23:21:59 2016 | http://epydoc.sourceforge.net |