Struct IocReport

Source

pub struct IocReport {
    pub c2_urls: Vec<C2Url>,
    pub decoded_payloads: Vec<DecodedPayload>,
    pub credential_forms: Vec<CredentialForm>,
    pub exfiltrated_data: Vec<ExfilData>,
    pub persistence: Vec<Persistence>,
    pub redirects: Vec<String>,
    pub domains: Vec<String>,
    pub crypto_iocs: Vec<CryptoIoc>,
    pub clipboard_iocs: Vec<ClipboardIoc>,
}

Expand description

Extracted IOCs from a detonation.

Fields§

§c2_urls: Vec<C2Url>

C2/exfiltration URLs contacted.

§decoded_payloads: Vec<DecodedPayload>

Decoded payloads from eval(atob(…)) chains.

§credential_forms: Vec<CredentialForm>

Credential harvesting infrastructure.

§exfiltrated_data: Vec<ExfilData>

Data exfiltrated (cookies, UA, etc.).

§persistence: Vec<Persistence>

Persistence mechanisms.

§redirects: Vec<String>

Redirect chain.

§domains: Vec<String>

All external domains referenced.

§crypto_iocs: Vec<CryptoIoc>

Crypto wallet interactions.

§clipboard_iocs: Vec<ClipboardIoc>

Clipboard manipulation.

Implementations§

Source §

impl IocReport

Source

pub fn format_text(&self) -> String

Format as a structured terminal report.

Source

pub fn is_empty(&self) -> bool

Trait Implementations§

Source §

impl Debug for IocReport

Source §

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter. Read more

Source §

impl Default for IocReport

Source §

fn default() -> IocReport

Returns the “default value” for a type. Read more

Auto Trait Implementations§

§

impl UnwindSafe for IocReport

Blanket Implementations§

Source §

impl<T> Any for T
where T: 'static + ?Sized,

Source §

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more

Source §

impl<T> Borrow<T> for T
where T: ?Sized,

Source §

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more

Source §

impl<T> BorrowMut<T> for T
where T: ?Sized,

Source §

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more

Source §

impl<T> From<T> for T

Source §

fn from(t: T) -> T

Returns the argument unchanged.

Source §

impl<T> Instrument for T

Source §

fn instrument(self, span: Span) -> Instrumented<Self>

Instruments this type with the provided Span, returning an Instrumented wrapper. Read more

Source §

fn in_current_span(self) -> Instrumented<Self>

Instruments this type with the current Span, returning an Instrumented wrapper. Read more

Source §

impl<T, U> Into for T
where U: From<T>,

Source §

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Source §

impl<T> IntoEither for T

Source §

fn into_either(self, into_left: bool) -> Either<Self, Self>

Converts self into a Left variant of Either<Self, Self> if into_left is true. Converts self into a Right variant of Either<Self, Self> otherwise. Read more

Source §

fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
where F: FnOnce(&Self) -> bool,

Converts self into a Left variant of Either<Self, Self> if into_left(&self) returns true. Converts self into a Right variant of Either<Self, Self> otherwise. Read more

Source §