action

Documentation

Index

• Variables
• func CachedRules(ctx context.Context, fss []fs.FS) (*yara.Rules, error)
• func Diff(ctx context.Context, c malcontent.Config) (*malcontent.Report, error)
• func Scan(ctx context.Context, c malcontent.Config) (*malcontent.Report, error)
• type ProcessInfo
  • func ActiveProcesses(ctx context.Context) ([]*ProcessInfo, error)

Variables

var (
	ErrMatchedCondition = errors.New("matched exit criteria")
)

Functions

func CachedRules

func CachedRules(ctx context.Context, fss []fs.FS) (*yara.Rules, error)

func Diff

func Diff(ctx context.Context, c malcontent.Config) (*malcontent.Report, error)

func Scan

func Scan(ctx context.Context, c malcontent.Config) (*malcontent.Report, error)

Scan YARA scans a data source, applying output filters if necessary.

Types

type ProcessInfo

type ProcessInfo struct {
	PID            int32
	PPID           int32
	Name           string
	ScanPath       string
	AdvertisedPath string
	CmdLine        []string
}

func ActiveProcesses

func ActiveProcesses(ctx context.Context) ([]*ProcessInfo, error)

ActiveProcesses is an exported function that a list of active processes.