Reference documentation and code samples for the Google Cloud Security Command Center V1 Client class KernelRootkit.
Kernel mode rootkit signatures.
Generated from protobuf message google.cloud.securitycenter.v1.KernelRootkit
Methods
__construct
Constructor.
| Parameters | |
|---|---|
| Name | Description |
data |
array
Optional. Data for populating the Message object. |
↳ name |
string
Rootkit name when available. |
↳ unexpected_code_modification |
bool
True if unexpected modifications of kernel code memory are present. |
↳ unexpected_read_only_data_modification |
bool
True if unexpected modifications of kernel read-only data memory are present. |
↳ unexpected_ftrace_handler |
bool
True if |
↳ unexpected_kprobe_handler |
bool
True if |
↳ unexpected_kernel_code_pages |
bool
True if kernel code pages that are not in the expected kernel or module code regions are present. |
↳ unexpected_system_call_handler |
bool
True if system call handlers that are are not in the expected kernel or module code regions are present. |
↳ unexpected_interrupt_handler |
bool
True if interrupt handlers that are are not in the expected kernel or module code regions are present. |
↳ unexpected_processes_in_runqueue |
bool
True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list. |
getName
Rootkit name when available.
Generated from protobuf field string name = 1;
| Returns | |
|---|---|
| Type | Description |
string | |
setName
Rootkit name when available.
Generated from protobuf field string name = 1;
| Parameter | |
|---|---|
| Name | Description |
var |
string
|
| Returns | |
|---|---|
| Type | Description |
$this | |
getUnexpectedCodeModification
True if unexpected modifications of kernel code memory are present.
Generated from protobuf field bool unexpected_code_modification = 2;
| Returns | |
|---|---|
| Type | Description |
bool | |
setUnexpectedCodeModification
True if unexpected modifications of kernel code memory are present.
Generated from protobuf field bool unexpected_code_modification = 2;
| Parameter | |
|---|---|
| Name | Description |
var |
bool
|
| Returns | |
|---|---|
| Type | Description |
$this | |
getUnexpectedReadOnlyDataModification
True if unexpected modifications of kernel read-only data memory are present.
Generated from protobuf field bool unexpected_read_only_data_modification = 3;
| Returns | |
|---|---|
| Type | Description |
bool | |
setUnexpectedReadOnlyDataModification
True if unexpected modifications of kernel read-only data memory are present.
Generated from protobuf field bool unexpected_read_only_data_modification = 3;
| Parameter | |
|---|---|
| Name | Description |
var |
bool
|
| Returns | |
|---|---|
| Type | Description |
$this | |
getUnexpectedFtraceHandler
True if ftrace points are present with callbacks pointing to regions
that are not in the expected kernel or module code range.
Generated from protobuf field bool unexpected_ftrace_handler = 4;
| Returns | |
|---|---|
| Type | Description |
bool | |
setUnexpectedFtraceHandler
True if ftrace points are present with callbacks pointing to regions
that are not in the expected kernel or module code range.
Generated from protobuf field bool unexpected_ftrace_handler = 4;
| Parameter | |
|---|---|
| Name | Description |
var |
bool
|
| Returns | |
|---|---|
| Type | Description |
$this | |
getUnexpectedKprobeHandler
True if kprobe points are present with callbacks pointing to regions
that are not in the expected kernel or module code range.
Generated from protobuf field bool unexpected_kprobe_handler = 5;
| Returns | |
|---|---|
| Type | Description |
bool | |
setUnexpectedKprobeHandler
True if kprobe points are present with callbacks pointing to regions
that are not in the expected kernel or module code range.
Generated from protobuf field bool unexpected_kprobe_handler = 5;
| Parameter | |
|---|---|
| Name | Description |
var |
bool
|
| Returns | |
|---|---|
| Type | Description |
$this | |
getUnexpectedKernelCodePages
True if kernel code pages that are not in the expected kernel or module code regions are present.
Generated from protobuf field bool unexpected_kernel_code_pages = 6;
| Returns | |
|---|---|
| Type | Description |
bool | |
setUnexpectedKernelCodePages
True if kernel code pages that are not in the expected kernel or module code regions are present.
Generated from protobuf field bool unexpected_kernel_code_pages = 6;
| Parameter | |
|---|---|
| Name | Description |
var |
bool
|
| Returns | |
|---|---|
| Type | Description |
$this | |
getUnexpectedSystemCallHandler
True if system call handlers that are are not in the expected kernel or module code regions are present.
Generated from protobuf field bool unexpected_system_call_handler = 7;
| Returns | |
|---|---|
| Type | Description |
bool | |
setUnexpectedSystemCallHandler
True if system call handlers that are are not in the expected kernel or module code regions are present.
Generated from protobuf field bool unexpected_system_call_handler = 7;
| Parameter | |
|---|---|
| Name | Description |
var |
bool
|
| Returns | |
|---|---|
| Type | Description |
$this | |
getUnexpectedInterruptHandler
True if interrupt handlers that are are not in the expected kernel or module code regions are present.
Generated from protobuf field bool unexpected_interrupt_handler = 8;
| Returns | |
|---|---|
| Type | Description |
bool | |
setUnexpectedInterruptHandler
True if interrupt handlers that are are not in the expected kernel or module code regions are present.
Generated from protobuf field bool unexpected_interrupt_handler = 8;
| Parameter | |
|---|---|
| Name | Description |
var |
bool
|
| Returns | |
|---|---|
| Type | Description |
$this | |
getUnexpectedProcessesInRunqueue
True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.
Generated from protobuf field bool unexpected_processes_in_runqueue = 9;
| Returns | |
|---|---|
| Type | Description |
bool | |
setUnexpectedProcessesInRunqueue
True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.
Generated from protobuf field bool unexpected_processes_in_runqueue = 9;
| Parameter | |
|---|---|
| Name | Description |
var |
bool
|
| Returns | |
|---|---|
| Type | Description |
$this | |