Cloud Security Command Center V1 API - Class Google::Cloud::SecurityCenter::V1::KernelRootkit (v0.35.0)

Version 0.35.0

• 1.2.0 (latest)
• 1.1.0
• 1.0.0
• 0.41.0
• 0.40.0
• 0.39.0
• 0.38.0
• 0.37.0
• 0.36.0
• 0.35.0
• 0.34.2
• 0.33.0
• 0.32.0
• 0.31.1
• 0.30.0
• 0.29.1
• 0.28.0
• 0.27.0
• 0.26.0
• 0.25.1
• 0.24.0
• 0.23.0
• 0.22.0
• 0.21.0
• 0.20.0
• 0.19.0
• 0.18.0
• 0.17.0
• 0.16.0
• 0.15.0
• 0.14.0
• 0.13.0
• 0.12.1
• 0.11.1

Reference documentation and code samples for the Cloud Security Command Center V1 API class Google::Cloud::SecurityCenter::V1::KernelRootkit.

Kernel mode rootkit signatures.

Inherits

• Object

Extended By

• Google::Protobuf::MessageExts::ClassMethods

Includes

• Google::Protobuf::MessageExts

Methods

#name

def name() -> ::String

Returns

• (::String) — Rootkit name, when available.

#name=

def name=(value) -> ::String

Parameter

• value (::String) — Rootkit name, when available.

Returns

• (::String) — Rootkit name, when available.

#unexpected_code_modification

def unexpected_code_modification() -> ::Boolean

Returns

• (::Boolean) — True if unexpected modifications of kernel code memory are present.

#unexpected_code_modification=

def unexpected_code_modification=(value) -> ::Boolean

Parameter

• value (::Boolean) — True if unexpected modifications of kernel code memory are present.

Returns

• (::Boolean) — True if unexpected modifications of kernel code memory are present.

#unexpected_ftrace_handler

def unexpected_ftrace_handler() -> ::Boolean

Returns

• (::Boolean) — True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

#unexpected_ftrace_handler=

def unexpected_ftrace_handler=(value) -> ::Boolean

Parameter

• value (::Boolean) — True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

Returns

• (::Boolean) — True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

#unexpected_interrupt_handler

def unexpected_interrupt_handler() -> ::Boolean

Returns

• (::Boolean) — True if interrupt handlers that are are not in the expected kernel or module code regions are present.

#unexpected_interrupt_handler=

def unexpected_interrupt_handler=(value) -> ::Boolean

Parameter

• value (::Boolean) — True if interrupt handlers that are are not in the expected kernel or module code regions are present.

Returns

• (::Boolean) — True if interrupt handlers that are are not in the expected kernel or module code regions are present.

#unexpected_kernel_code_pages

def unexpected_kernel_code_pages() -> ::Boolean

Returns

• (::Boolean) — True if kernel code pages that are not in the expected kernel or module code regions are present.

#unexpected_kernel_code_pages=

def unexpected_kernel_code_pages=(value) -> ::Boolean

Parameter

• value (::Boolean) — True if kernel code pages that are not in the expected kernel or module code regions are present.

Returns

• (::Boolean) — True if kernel code pages that are not in the expected kernel or module code regions are present.

#unexpected_kprobe_handler

def unexpected_kprobe_handler() -> ::Boolean

Returns

• (::Boolean) — True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

#unexpected_kprobe_handler=

def unexpected_kprobe_handler=(value) -> ::Boolean

Parameter

• value (::Boolean) — True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

Returns

• (::Boolean) — True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

#unexpected_processes_in_runqueue

def unexpected_processes_in_runqueue() -> ::Boolean

Returns

• (::Boolean) — True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.

#unexpected_processes_in_runqueue=

def unexpected_processes_in_runqueue=(value) -> ::Boolean

Parameter

• value (::Boolean) — True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.

Returns

• (::Boolean) — True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.

#unexpected_read_only_data_modification

def unexpected_read_only_data_modification() -> ::Boolean

Returns

• (::Boolean) — True if unexpected modifications of kernel read-only data memory are present.

#unexpected_read_only_data_modification=

def unexpected_read_only_data_modification=(value) -> ::Boolean

Parameter

• value (::Boolean) — True if unexpected modifications of kernel read-only data memory are present.

Returns

• (::Boolean) — True if unexpected modifications of kernel read-only data memory are present.

#unexpected_system_call_handler

def unexpected_system_call_handler() -> ::Boolean

Returns

• (::Boolean) — True if system call handlers that are are not in the expected kernel or module code regions are present.

#unexpected_system_call_handler=

def unexpected_system_call_handler=(value) -> ::Boolean

Parameter

• value (::Boolean) — True if system call handlers that are are not in the expected kernel or module code regions are present.

Returns

• (::Boolean) — True if system call handlers that are are not in the expected kernel or module code regions are present.