Enum DeviceAnomaly 

pub enum DeviceAnomaly {
    DmaCapableDevice {
        instance_id: String,
        bus: Bus,
    },
    MassStorageConnected {
        instance_id: String,
    },
    HidDevice {
        instance_id: String,
    },
    OsGeneratedSerial {
        instance_id: String,
    },
}

A graded external-device anomaly.

Variants

DmaCapableDevice

A bus-mastering DMA-capable device (FireWire / Thunderbolt / PCIe / ExpressCard) was connected — a direct-memory-access attack surface. MITRE T1200.

Fields

instance_id: String

The device instance id.

bus: Bus

The DMA-capable bus.

MassStorageConnected

Removable mass storage was connected — an exfiltration / autorun-payload surface. MITRE T1052.001 / T1091.

Fields

instance_id: String

The device instance id.

HidDevice

A Human Interface Device was connected — possible keystroke-injection (BadUSB). MITRE T1200.

Fields

instance_id: String

The device instance id.

OsGeneratedSerial

The device’s serial was synthesized by Windows (no real iSerial), so attribution back to a specific physical device is weaker.

Fields

instance_id: String

The device instance id.

Implementations

impl DeviceAnomaly

pub fn code(&self) -> &'static str

The stable, published anomaly code (scheme-prefixed SCREAMING-KEBAB).

Trait Implementations

impl Clone for DeviceAnomaly

fn clone(&self) -> DeviceAnomaly

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DeviceAnomaly

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for DeviceAnomaly

impl Observation for DeviceAnomaly

fn severity(&self) -> Option<Severity>

Severity, or None if the analyzer deliberately does not grade this kind.

fn code(&self) -> &'static str

Stable, scheme-prefixed machine code.

fn category(&self) -> Category

Analytical lens; defaults to Category::from_code of Observation::code. Override when a code’s keyword classification is wrong.

fn mitre(&self) -> &'static [&'static str]

MITRE ATT&CK technique ids this kind is consistent with (default: none).

fn note(&self) -> String

Human-readable, consistent-with note.

fn subjects(&self) -> Vec<SubjectRef>

Non-disk subjects this kind is about (default: none).

fn evidence(&self) -> Vec<Evidence>

Backing evidence rows (default: none).

fn confidence(&self) -> Option<Confidence>

Heuristic confidence, if inferential (default: none).

fn to_finding(&self, source: Source) -> Finding

Assemble the canonical Finding from this kind and its producing source.

impl PartialEq for DeviceAnomaly

fn eq(&self, other: &DeviceAnomaly) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for DeviceAnomaly