| 56 | } |
| 57 | |
| 58 | func (s *Scanner) ProcessEvent(e *event.Event) (bool, error) { |
| 59 | // filter out CreateFile events with the open disposition |
| 60 | // as they tend to be noisy and could impact performance |
| 61 | // when hitting evasion detectors |
| 62 | if e.IsOpenDisposition() { |
| 63 | return true, nil |
| 64 | } |
| 65 | |
| 66 | var enq bool |
| 67 | |
| 68 | // run registered evasion detectors |
| 69 | for _, evasion := range s.evasions { |
| 70 | matches, err := evasion.Eval(e) |
| 71 | if err != nil { |
| 72 | return false, err |
| 73 | } |
| 74 | if matches { |
| 75 | enq = true |
| 76 | evasion.SetMask(e) |
| 77 | evasionsCount.Add(evasion.Type().String(), 1) |
| 78 | e.AddOrAppendMetaSlice(event.EvasionsKey, evasion.Type().String()) |
| 79 | log.Debugf("detected evasion %q on event [%s] and callstack [%s]", evasion.Type(), e, e.Callstack) |
| 80 | } |
| 81 | } |
| 82 | |
| 83 | return enq, nil |
| 84 | } |
| 85 | |
| 86 | func (s *Scanner) CanEnqueue() bool { return false } |
| 87 | |