Google Cloud Security Command Center V1 Client - Class KernelRootkit (1.19.1)

Reference documentation and code samples for the Google Cloud Security Command Center V1 Client class KernelRootkit.

Kernel mode rootkit signatures.

Generated from protobuf message google.cloud.securitycenter.v1.KernelRootkit

Namespace

Google \ Cloud \ SecurityCenter \ V1

Methods

__construct

Constructor.

Parameters
Name	Description
`data`	`array` Optional. Data for populating the Message object.
`↳ name`	`string` Rootkit name, when available.
`↳ unexpected_code_modification`	`bool` True if unexpected modifications of kernel code memory are present.
`↳ unexpected_read_only_data_modification`	`bool` True if unexpected modifications of kernel read-only data memory are present.
`↳ unexpected_ftrace_handler`	`bool` True if `ftrace` points are present with callbacks pointing to regions that are not in the expected kernel or module code range.
`↳ unexpected_kprobe_handler`	`bool` True if `kprobe` points are present with callbacks pointing to regions that are not in the expected kernel or module code range.
`↳ unexpected_kernel_code_pages`	`bool` True if kernel code pages that are not in the expected kernel or module code regions are present.
`↳ unexpected_system_call_handler`	`bool` True if system call handlers that are are not in the expected kernel or module code regions are present.
`↳ unexpected_interrupt_handler`	`bool` True if interrupt handlers that are are not in the expected kernel or module code regions are present.
`↳ unexpected_processes_in_runqueue`	`bool` True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.

getName

Rootkit name, when available.

Returns
Type	Description
`string`

setName

Rootkit name, when available.

Parameter
Name	Description
`var`	`string`

Returns
Type	Description
`$this`

getUnexpectedCodeModification

True if unexpected modifications of kernel code memory are present.

Returns
Type	Description
`bool`

setUnexpectedCodeModification

True if unexpected modifications of kernel code memory are present.

Parameter
Name	Description
`var`	`bool`

Returns
Type	Description
`$this`

getUnexpectedReadOnlyDataModification

True if unexpected modifications of kernel read-only data memory are present.

Returns
Type	Description
`bool`

setUnexpectedReadOnlyDataModification

True if unexpected modifications of kernel read-only data memory are present.

Parameter
Name	Description
`var`	`bool`

Returns
Type	Description
`$this`

getUnexpectedFtraceHandler

True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

Returns
Type	Description
`bool`

setUnexpectedFtraceHandler

True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

Parameter
Name	Description
`var`	`bool`

Returns
Type	Description
`$this`

getUnexpectedKprobeHandler

True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

Returns
Type	Description
`bool`

setUnexpectedKprobeHandler

True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

Parameter
Name	Description
`var`	`bool`

Returns
Type	Description
`$this`

getUnexpectedKernelCodePages

True if kernel code pages that are not in the expected kernel or module code regions are present.

Returns
Type	Description
`bool`

setUnexpectedKernelCodePages

True if kernel code pages that are not in the expected kernel or module code regions are present.

Parameter
Name	Description
`var`	`bool`

Returns
Type	Description
`$this`

getUnexpectedSystemCallHandler

True if system call handlers that are are not in the expected kernel or module code regions are present.

Returns
Type	Description
`bool`

setUnexpectedSystemCallHandler

True if system call handlers that are are not in the expected kernel or module code regions are present.

Parameter
Name	Description
`var`	`bool`

Returns
Type	Description
`$this`

getUnexpectedInterruptHandler

True if interrupt handlers that are are not in the expected kernel or module code regions are present.

Returns
Type	Description
`bool`

setUnexpectedInterruptHandler

True if interrupt handlers that are are not in the expected kernel or module code regions are present.

Parameter
Name	Description
`var`	`bool`

Returns
Type	Description
`$this`

getUnexpectedProcessesInRunqueue

True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.

Returns
Type	Description
`bool`

setUnexpectedProcessesInRunqueue

True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.

Parameter
Name	Description
`var`	`bool`

Returns
Type	Description
`$this`