MCPcopy Create free account
hub / github.com/rabbitstack/fibratus / RidToString

Function RidToString

pkg/sys/rid.go:59–81  ·  view source on GitHub ↗

RidToString given the SID representing the token mandatory label returns the string representation of the integrity level.

(sid *windows.SID)

Source from the content-addressed store, hash-verified

57// RidToString given the SID representing the token mandatory label
58// returns the string representation of the integrity level.
59func RidToString(sid *windows.SID) string {
60 if sid == nil {
61 return "UNKNOWN"
62 }
63 switch sid.SubAuthority(uint32(sid.SubAuthorityCount() - 1)) {
64 case UntrustedRid:
65 return "UNTRUSTED"
66 case LowRid:
67 return "LOW"
68 case MediumRid:
69 return "MEDIUM"
70 case MediumPlusRid:
71 return "MEDIUM+"
72 case HighRid:
73 return "HIGH"
74 case SystemRid:
75 return "SYSTEM"
76 case ProtectedProcessRid:
77 return "PROTECTED"
78 default:
79 return "UNKNOWN"
80 }
81}

Callers 3

newProcStateMethod · 0.92
FindMethod · 0.92
StringMethod · 0.92

Calls

no outgoing calls

Tested by

no test coverage detected