Base class for Cuckoo signatures.
|
__init__(self,
caller)
x.__init__(...) initializes x; see help(type(x)) for signature |
source code
|
|
|
|
|
|
|
|
|
|
|
get_summary(self,
key=None,
default=[])
Get one or all values related to the global summary. |
source code
|
|
|
|
|
get_files(self,
pid=None,
actions=None)
Get files read, queried, or written to optionally by a specific
process. |
source code
|
|
|
|
|
|
|
check_file(self,
pattern,
regex=False,
actions=None,
pid=None,
all=False)
Checks for a file being opened. |
source code
|
|
|
|
|
check_key(self,
pattern,
regex=False,
actions=None,
pid=None,
all=False)
Checks for a registry key being accessed. |
source code
|
|
|
|
|
|
|
get_command_lines(self)
Retrieves all command lines used. |
source code
|
|
|
get_wmi_queries(self)
Retrieves all executed WMI queries. |
source code
|
|
|
|
|
get_net_hosts(self)
Returns a list of all hosts. |
source code
|
|
|
get_net_domains(self)
Returns a list of all domains. |
source code
|
|
|
get_net_http(self)
Returns a list of all http data. |
source code
|
|
|
get_net_http_ex(self)
Returns a list of all http data. |
source code
|
|
|
get_net_udp(self)
Returns a list of all udp data. |
source code
|
|
|
get_net_icmp(self)
Returns a list of all icmp data. |
source code
|
|
|
get_net_irc(self)
Returns a list of all irc data. |
source code
|
|
|
get_net_smtp(self)
Returns a list of all smtp data. |
source code
|
|
|
get_virustotal(self)
Returns the information retrieved from virustotal. |
source code
|
|
|
get_volatility(self,
module=None)
Returns the data that belongs to the given module. |
source code
|
|
|
get_apkinfo(self,
section=None,
default={})
Returns the apkinfo results for this analysis. |
source code
|
|
|
get_droidmon(self,
section=None,
default={})
Returns the droidmon results for this analysis. |
source code
|
|
|
get_googleplay(self,
section=None,
default={})
Returns the Google Play results for this analysis. |
source code
|
|
|
check_ip(self,
pattern,
regex=False,
all=False)
Checks for an IP address being contacted. |
source code
|
|
|
|
|
|
|
init(self)
Allow signatures to initialize themselves. |
source code
|
|
|
mark_call(self,
*args,
**kwargs)
Mark the current call as explanation as to why this signature
matched. |
source code
|
|
|
mark_ioc(self,
category,
ioc,
description=None)
Mark an IOC as explanation as to why the current signature matched. |
source code
|
|
|
mark_vol(self,
plugin,
**kwargs)
Mark output of a Volatility plugin as explanation as to why the
current signature matched. |
source code
|
|
|
|
|
has_marks(self,
count=None)
Returns true if this signature has one or more marks. |
source code
|
|
|
|
|
|
|
|
|
on_complete(self)
Signature is notified when all API calls have been processed. |
source code
|
|
|
results(self)
Turn this signature into actionable results. |
source code
|
|
Inherited from object :
__delattr__ ,
__format__ ,
__getattribute__ ,
__hash__ ,
__new__ ,
__reduce__ ,
__reduce_ex__ ,
__repr__ ,
__setattr__ ,
__sizeof__ ,
__str__ ,
__subclasshook__
|