NewScanner instantiates the new evasion scanner.
(config Config)
| 40 | |
| 41 | // NewScanner instantiates the new evasion scanner. |
| 42 | func NewScanner(config Config) *Scanner { |
| 43 | s := &Scanner{ |
| 44 | evasions: make([]Evasion, 0), |
| 45 | config: config, |
| 46 | } |
| 47 | |
| 48 | if config.EnableDirectSyscall { |
| 49 | s.addEvasion(NewDirectSyscall()) |
| 50 | } |
| 51 | if config.EnableIndirectSyscall { |
| 52 | s.addEvasion(NewIndirectSyscall()) |
| 53 | } |
| 54 | |
| 55 | return s |
| 56 | } |
| 57 | |
| 58 | func (s *Scanner) ProcessEvent(e *event.Event) (bool, error) { |
| 59 | // filter out CreateFile events with the open disposition |