PartialKey computes the unique hash of the event that can be employed to determine if the event from the given process and source has been processed in the rule sequences.
()
| 344 | // from the given process and source has been processed |
| 345 | // in the rule sequences. |
| 346 | func (e *Event) PartialKey() uint64 { |
| 347 | switch e.Type { |
| 348 | case WriteFile, ReadFile: |
| 349 | return e.Params.MustGetUint64(params.FileObject) + uint64(e.PID) |
| 350 | case MapViewFile, UnmapViewFile: |
| 351 | return e.Params.MustGetUint64(params.FileViewBase) + uint64(e.PID) |
| 352 | case CreateFile: |
| 353 | file, _ := e.Params.GetString(params.FilePath) |
| 354 | b := make([]byte, 4+len(file)) |
| 355 | binary.LittleEndian.PutUint32(b, e.PID) |
| 356 | b = append(b, []byte(file)...) |
| 357 | return hashers.FnvUint64(b) |
| 358 | case OpenProcess: |
| 359 | pid := e.Params.MustGetUint32(params.ProcessID) |
| 360 | access := e.Params.MustGetUint32(params.DesiredAccess) |
| 361 | return uint64(pid + access + e.PID) |
| 362 | case OpenThread: |
| 363 | tid := e.Params.MustGetUint32(params.ThreadID) |
| 364 | access := e.Params.MustGetUint32(params.DesiredAccess) |
| 365 | return uint64(tid + access + e.PID) |
| 366 | case AcceptTCPv4, RecvTCPv4, RecvUDPv4: |
| 367 | b := make([]byte, 10) |
| 368 | ip, _ := e.Params.GetIP(params.NetSIP) |
| 369 | port, _ := e.Params.GetUint16(params.NetSport) |
| 370 | binary.LittleEndian.PutUint32(b, e.PID) |
| 371 | binary.LittleEndian.PutUint32(b, binary.BigEndian.Uint32(ip.To4())) |
| 372 | binary.LittleEndian.PutUint16(b, port) |
| 373 | return hashers.FnvUint64(b) |
| 374 | case AcceptTCPv6, RecvTCPv6, RecvUDPv6: |
| 375 | b := make([]byte, 22) |
| 376 | ip, _ := e.Params.GetIP(params.NetSIP) |
| 377 | port, _ := e.Params.GetUint16(params.NetSport) |
| 378 | binary.LittleEndian.PutUint32(b, e.PID) |
| 379 | binary.LittleEndian.PutUint64(b, binary.BigEndian.Uint64(ip.To16()[0:8])) |
| 380 | binary.LittleEndian.PutUint64(b, binary.BigEndian.Uint64(ip.To16()[8:16])) |
| 381 | binary.LittleEndian.PutUint16(b, port) |
| 382 | return hashers.FnvUint64(b) |
| 383 | case ConnectTCPv4, SendTCPv4, SendUDPv4: |
| 384 | b := make([]byte, 10) |
| 385 | ip, _ := e.Params.GetIP(params.NetDIP) |
| 386 | port, _ := e.Params.GetUint16(params.NetDport) |
| 387 | binary.LittleEndian.PutUint32(b, e.PID) |
| 388 | binary.LittleEndian.PutUint32(b, binary.BigEndian.Uint32(ip.To4())) |
| 389 | binary.LittleEndian.PutUint16(b, port) |
| 390 | return hashers.FnvUint64(b) |
| 391 | case ConnectTCPv6, SendTCPv6, SendUDPv6: |
| 392 | b := make([]byte, 22) |
| 393 | ip, _ := e.Params.GetIP(params.NetDIP) |
| 394 | port, _ := e.Params.GetUint16(params.NetDport) |
| 395 | binary.LittleEndian.PutUint32(b, e.PID) |
| 396 | binary.LittleEndian.PutUint64(b, binary.BigEndian.Uint64(ip.To16()[0:8])) |
| 397 | binary.LittleEndian.PutUint64(b, binary.BigEndian.Uint64(ip.To16()[8:16])) |
| 398 | binary.LittleEndian.PutUint16(b, port) |
| 399 | return hashers.FnvUint64(b) |
| 400 | case RegOpenKey, RegQueryKey, RegQueryValue, |
| 401 | RegDeleteKey, RegDeleteValue, RegSetValue, |
| 402 | RegCloseKey: |
| 403 | key, _ := e.Params.GetString(params.RegPath) |