forensicnomicon 0.2.2

The ForensicNomicon — comprehensive DFIR artifact catalog: UserAssist, Shimcache, Amcache, Prefetch, $MFT, ShellBags, EVTX, NTDS.dit, SAM, SRUM, LNK, Jump Lists + KAPE/Velociraptor/Sigma/MITRE. Zero deps.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum MalwareClass {
    LdPreloadProcessHider,
    LdPreloadPamHooker,
    LdPreloadNetworkHider,
    LdPreloadFullRootkit,
    LkmRootkit,
    CryptoMiner,
    GenericLdPreload,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
pub enum Classification {
    NoMatch,
    LowConfidence,
    ClassMatch,
    Probable,
    Confirmed,
}

#[derive(Debug)]
pub struct ProfileSignal {
    pub id: &'static str,
    pub weight: u32,
    pub required: bool,
}

#[derive(Debug)]
pub struct WeightedExclusion {
    pub id: &'static str,
    pub penalty: u32,
}

#[derive(Debug)]
pub struct MalwareProfile {
    pub id: &'static str,
    pub family: &'static str,
    pub aliases: &'static [&'static str],
    pub description: &'static str,
    pub malware_class: MalwareClass,
    pub mitre_techniques: &'static [&'static str],
    pub signals: &'static [ProfileSignal],
    pub exclusions: &'static [WeightedExclusion],
    pub class_threshold: u32,
    pub probable_threshold: u32,
    pub confirmed_threshold: u32,
}

#[derive(Debug)]
pub struct FiredSignal {
    pub id: &'static str,
    pub weight: u32,
}

#[derive(Debug)]
pub struct ProfileMatch {
    pub profile: &'static MalwareProfile,
    pub score: u32,
    pub classification: Classification,
    pub fired: Vec<FiredSignal>,
    pub missed_required: Vec<&'static str>,
}