Google Cloud Security Command Center v1 API - Class KernelRootkit (3.7.0)

public sealed class KernelRootkit : IMessage<KernelRootkit>, IEquatable<KernelRootkit>, IDeepCloneable<KernelRootkit>, IBufferMessage, IMessage

Reference documentation and code samples for the Google Cloud Security Command Center v1 API class KernelRootkit.

Kernel mode rootkit signatures.

Inheritance

Object > KernelRootkit

Namespace

Google.Cloud.SecurityCenter.V1

Assembly

Google.Cloud.SecurityCenter.V1.dll

Constructors

KernelRootkit()

public KernelRootkit()

KernelRootkit(KernelRootkit)

public KernelRootkit(KernelRootkit other)
Parameter
NameDescription
otherKernelRootkit

Properties

Name

public string Name { get; set; }

Rootkit name when available.

Property Value
TypeDescription
String

UnexpectedCodeModification

public bool UnexpectedCodeModification { get; set; }

True if unexpected modifications of kernel code memory are present.

Property Value
TypeDescription
Boolean

UnexpectedFtraceHandler

public bool UnexpectedFtraceHandler { get; set; }

True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

Property Value
TypeDescription
Boolean

UnexpectedInterruptHandler

public bool UnexpectedInterruptHandler { get; set; }

True if interrupt handlers that are are not in the expected kernel or module code regions are present.

Property Value
TypeDescription
Boolean

UnexpectedKernelCodePages

public bool UnexpectedKernelCodePages { get; set; }

True if kernel code pages that are not in the expected kernel or module code regions are present.

Property Value
TypeDescription
Boolean

UnexpectedKprobeHandler

public bool UnexpectedKprobeHandler { get; set; }

True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

Property Value
TypeDescription
Boolean

UnexpectedProcessesInRunqueue

public bool UnexpectedProcessesInRunqueue { get; set; }

True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.

Property Value
TypeDescription
Boolean

UnexpectedReadOnlyDataModification

public bool UnexpectedReadOnlyDataModification { get; set; }

True if unexpected modifications of kernel read-only data memory are present.

Property Value
TypeDescription
Boolean

UnexpectedSystemCallHandler

public bool UnexpectedSystemCallHandler { get; set; }

True if system call handlers that are are not in the expected kernel or module code regions are present.

Property Value
TypeDescription
Boolean