Package modules :: Package signatures :: Module generic_metrics :: Class SystemMetrics
[hide private]
[frames] | no frames]

Class SystemMetrics

source code

                           object --+    
                                    |    
lib.cuckoo.common.abstracts.Signature --+
                                        |
                                       SystemMetrics

Instance Methods [hide private]
 
stop(self) source code
 
on_call(self, call, pid, tid)
Notify signature about API call.
source code

Inherited from lib.cuckoo.common.abstracts.Signature: __init__, check_dll_loaded, check_domain, check_file, check_ip, check_key, check_mutex, check_url, get_apkinfo, get_command_lines, get_dll_loaded, get_droidmon, get_files, get_googleplay, get_keys, get_mutexes, get_net_domains, get_net_generic, get_net_hosts, get_net_http, get_net_http_ex, get_net_icmp, get_net_irc, get_net_smtp, get_net_udp, get_process_by_pid, get_processes, get_results, get_summary, get_summary_generic, get_virustotal, get_volatility, get_wmi_queries, has_marks, init, mark, mark_call, mark_ioc, mark_vol, on_complete, on_process, on_signature, results

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables [hide private]
  name = "generic_metrics"
  description = "Uses GetSystemMetrics"
  severity = 2
  categories = ["generic"]
  authors = ["Cuckoo Developers"]
  minimum = "2.0"
hash(x)
  filter_processnames = ()
  filter_apinames = "GetSystemMetrics",
  filter_categories = ()
  enabled = False

Inherited from lib.cuckoo.common.abstracts.Signature: alert, families, markcount, maximum, on_call_dispatch, order, platform, references

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

on_call(self, call, pid, tid)

source code 

Notify signature about API call. Return value determines if this signature is done or could still match.

Only called if signature is "active".

Parameters:
  • call - logged API call.
  • process - proc object.
Overrides: lib.cuckoo.common.abstracts.Signature.on_call
(inherited documentation)