Expand description
Output types for Linux forensic walkers.
Structs§
- ArpEntry
Info - An ARP cache entry from the kernel neighbour table.
- Audit
Tamper Info - Audit rule suppression / netlink audit tamper info.
- Bash
History Info - A recovered bash command history entry.
- Boot
Time Estimate - A single boot time estimate from a specific source.
- Boot
Time Info - Aggregated boot time information from multiple sources.
- Cmdline
Info - Process command line extracted from
mm_struct.arg_start..arg_end. - Connection
Info - Information about a network connection extracted from kernel memory.
- Container
Escape Correlate Info - Container escape / breakout detection info.
- CpuPinning
Info - CPU affinity / cryptominer detection info.
- Crontab
Entry - A crontab entry recovered from process memory.
- ElfInfo
- Information about an ELF binary found in process memory.
- EnvVar
Info - A single environment variable from a process.
- FdAbuse
Info - Timer/signal FD abuse info.
- File
Descriptor Info - Information about an open file descriptor.
- Fuse
Abuse Info - FUSE filesystem abuse info.
- Hidden
Module Info - Information about a potentially hidden kernel module.
- Hidden
Process Info - PID namespace vs task list discrepancy — hidden process detection.
- Kernel
Hook Info - Information about a potential inline kernel function hook.
- Malfind
Info - A suspicious memory region detected by malfind analysis.
- Module
Info - Information about a loaded kernel module.
- Mount
Info - Information about a mounted filesystem.
- Netfilter
Rule Info - An iptables/nftables rule recovered from kernel memory.
- Process
Info - Information about a Linux process extracted from
task_struct. - PsTree
Entry - A process tree entry with depth annotation for display.
- PsxView
Info - Cross-view process visibility information for DKOM detection.
- Shared
MemAnomaly Info - Shared memory anomaly info.
- SshKey
Info - An SSH key artifact found in sshd process memory.
- Syscall
Info - Information about a syscall table entry.
- Thread
Info - Information about a Linux thread extracted from
task_struct. - TtyCheck
Info - Information about a TTY operations function pointer check.
- User
NsEscalation Info - User namespace escalation detection info.
- Vdso
Tamper Info - vDSO tampering detection info.
- VmaFlags
- Permission flags for a virtual memory area.
- VmaInfo
- Information about a process virtual memory area.
Enums§
- Boot
Time Source - Source of a boot time estimate.
- Connection
State - TCP connection state.
- ElfType
- ELF object type from the ELF header
e_typefield. - FdAbuse
Type - Timer/signal FD abuse type.
- Module
State - State of a kernel module.
- Neigh
State - NUD (Neighbour Unreachability Detection) state.
- Process
State - State of a Linux process.
- Protocol
- Network protocol.
- SshKey
Type - Type of SSH key found in memory.