Package modules :: Package signatures :: Module generic_metrics
[hide private]
[frames] | no frames]

Source Code for Module modules.signatures.generic_metrics

 1  # Copyright (C) 2010-2013 Claudio Guarnieri. 
 2  # Copyright (C) 2014-2016 Cuckoo Foundation. 
 3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 4  # See the file 'docs/LICENSE' for copying permission. 
 5   
 6  from lib.cuckoo.common.abstracts import Signature 
 7   
8 -class SystemMetrics(Signature):
9 name = "generic_metrics" 10 description = "Uses GetSystemMetrics" 11 severity = 2 12 categories = ["generic"] 13 authors = ["Cuckoo Developers"] 14 minimum = "2.0" 15 16 # Evented signatures can specify filters that reduce the amount of 17 # API calls that are streamed in. One can filter Process name, API 18 # name/identifier and category. 19 filter_processnames = () 20 filter_apinames = "GetSystemMetrics", 21 filter_categories = () 22 23 # This is a signature template. It should be used as a skeleton for 24 # creating custom signatures, therefore is disabled by default. 25 # The on_call function is used in "evented" signatures. 26 # These use a more efficient way of processing logged API calls. 27 enabled = False 28
29 - def stop(self):
30 # In the stop method one can implement any cleanup code and 31 # decide one last time if this signature matches or not. 32 # Return True in case it matches. 33 return False
34 35 # This method will be called for every logged API call by the loop 36 # in the RunSignatures plugin. The return value determines the "state" 37 # of this signature. True means the signature matched and False means 38 # it can't match anymore. Both of which stop streaming in API calls. 39 # Returning None keeps the signature active and will continue.
40 - def on_call(self, call, pid, tid):
41 # This check would in reality not be needed as we already make use 42 # of filter_apinames above. 43 if call["api"] == "GetSystemMetrics": 44 # Signature matched, return True. 45 return True 46 47 # continue 48 return None
49