modules.signatures.generic_metrics

Package modules :: Package signatures :: Module generic_metrics |
[hide private]
[frames] | no frames]

# Source Code for Module modules.signatures.generic_metrics

     1  # Copyright (C) 2010-2013 Claudio Guarnieri.
     2  # Copyright (C) 2014-2016 Cuckoo Foundation.
     3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
     4  # See the file 'docs/LICENSE' for copying permission.
     5
     6  from lib.cuckoo.common.abstracts import Signature
     7
     8 -class SystemMetrics(Signature):
     9      name = "generic_metrics"
    10      description = "Uses GetSystemMetrics"
    11      severity = 2
    12      categories = ["generic"]
    13      authors = ["Cuckoo Developers"]
    14      minimum = "2.0"
    15
    16      # Evented signatures can specify filters that reduce the amount of
    17      # API calls that are streamed in. One can filter Process name, API
    18      # name/identifier and category.
    19      filter_processnames = ()
    20      filter_apinames = "GetSystemMetrics",
    21      filter_categories = ()
    22
    23      # This is a signature template. It should be used as a skeleton for
    24      # creating custom signatures, therefore is disabled by default.
    25      # The on_call function is used in "evented" signatures.
    26      # These use a more efficient way of processing logged API calls.
    27      enabled = False
    28
    29 -    def stop(self):
    30          # In the stop method one can implement any cleanup code and
    31          #  decide one last time if this signature matches or not.
    32          #  Return True in case it matches.
    33          return False
    34
    35      # This method will be called for every logged API call by the loop
    36      # in the RunSignatures plugin. The return value determines the "state"
    37      # of this signature. True means the signature matched and False means
    38      # it can't match anymore. Both of which stop streaming in API calls.
    39      # Returning None keeps the signature active and will continue.
    40 -    def on_call(self, call, pid, tid):
    41          # This check would in reality not be needed as we already make use
    42          # of filter_apinames above.
    43          if call["api"] == "GetSystemMetrics":
    44              # Signature matched, return True.
    45              return True
    46
    47          # continue
    48          return None
    49