Enum PrefetchAnomaly 

pub enum PrefetchAnomaly {
    SystemBinaryRelocated {
        name: String,
        image_path: String,
    },
    SuspiciousExecutionPath {
        executable: String,
        image_path: String,
    },
}

A graded prefetch finding. Each variant is a high-precision triage signal — it stays quiet on benign prefetch (e.g. a normal System32 program) and fires only on a genuinely anomalous pattern.

Variants

SystemBinaryRelocated

A Windows system-binary name whose traced image path is not under System32/SysWOW64 — consistent with masquerading (T1036.005).

Fields

name: String

The system-binary base name (e.g. SVCHOST.EXE).

image_path: String

Where it was actually loaded from.

SuspiciousExecutionPath

The program executed from a directory that is a common staging ground for malware (Temp, Downloads, $Recycle.Bin, …) — T1204.

Fields

executable: String

Executable base name.

image_path: String

The suspicious load path.

Trait Implementations

impl Clone for PrefetchAnomaly

fn clone(&self) -> PrefetchAnomaly

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PrefetchAnomaly

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for PrefetchAnomaly

impl Observation for PrefetchAnomaly

fn severity(&self) -> Option<Severity>

Severity, or None if the analyzer deliberately does not grade this kind.

fn category(&self) -> Category

Analytical lens; defaults to Category::from_code of Observation::code. Override when a code’s keyword classification is wrong.

fn code(&self) -> &'static str

Stable, scheme-prefixed machine code.

fn note(&self) -> String

Human-readable, consistent-with note.

fn mitre(&self) -> &'static [&'static str]

MITRE ATT&CK technique ids this kind is consistent with (default: none).

fn subjects(&self) -> Vec<SubjectRef>

Non-disk subjects this kind is about (default: none).

fn evidence(&self) -> Vec<Evidence>

Backing evidence rows (default: none).

fn confidence(&self) -> Option<Confidence>

Heuristic confidence, if inferential (default: none).

fn to_finding(&self, source: Source) -> Finding

Assemble the canonical Finding from this kind and its producing source.

impl PartialEq for PrefetchAnomaly

fn eq(&self, other: &PrefetchAnomaly) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for PrefetchAnomaly