malware

type Kind string

type Match struct {
	SignatureID string
	Name        string
	Kind        Kind
	Severity    Severity
	Description string
	Path        string
	// Layer is the layer index the file came from, or -1 for a flattened/dir scan.
	Layer int
	// Deleted is true when the file existed only in a lower layer and was removed
	// by a later whiteout — recoverable but not in the final image.
	Deleted bool
	// Evidence is the concrete matched token (filename, pattern, or "sha256").
	Evidence string
}

type Pack struct {
	Version    string      `json:"version"`
	Signatures []Signature `json:"signatures"`
}

type Scanner struct {
	// contains filtered or unexported fields
}

type Severity string

type Signature struct {
	ID          string   `json:"id"`   // stable id, e.g. MAL-MINER-XMRIG
	Name        string   `json:"name"` // human label
	Kind        Kind     `json:"kind"`
	Severity    Severity `json:"severity"`
	Description string   `json:"description,omitempty"`
	// Hash is a lowercase hex sha256 of the whole file (KindHash).
	Hash string `json:"hash,omitempty"`
	// Filenames are basenames matched case-insensitively (KindFilename).
	Filenames []string `json:"filenames,omitempty"`
	// Patterns are substrings searched within file contents (KindContent /
	// KindPersistence). Matching is literal (not regexp) so it is O(n) and
	// deterministic; a match on any pattern fires the signature.
	Patterns []string `json:"patterns,omitempty"`
	// PathHints, when set, limits KindContent/KindPersistence matching to files
	// whose path contains one of these substrings (e.g. "cron", "ld.so"), cutting
	// false positives. Empty = match anywhere.
	PathHints []string `json:"path_hints,omitempty"`
}