Documentation
¶
Overview ¶
Package avkit is the AV/EDR identification fingerprint database (docs §4.12, phase P3 — "杀软识别指纹库").
It is identification only. The kit runs read-only enumeration over a capkit.Session (processes, services, drivers, registry keys) and matches what it finds against a static fingerprint database of well-known AV/EDR products. It returns the identified products, their defensive categories, and the signatures that matched — decision support for the operator. It builds or downloads no bypass, no AMSI/ETW patch, no BYOVD artifact; those stay out of the library ("识别与决策在库内，成品载荷在库外").
A second tool, av_list, returns the fingerprint database's known products so an operator can review coverage without touching a target.
Everything runs THROUGH a capkit.Session resolved from capkit.Deps.Sessions.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewCapability ¶
func NewCapability(deps capkit.Deps) (capkit.Capability, error)
NewCapability builds the capability. An empty database falls back to the built-in default so the tool always has something to match against.
Types ¶
type Capability ¶
type Capability struct {
// contains filtered or unexported fields
}
Capability exposes the AV/EDR identification tools.
func (*Capability) Manifest ¶
func (c *Capability) Manifest() capkit.Manifest
Manifest implements capkit.Capability.
type Category ¶
type Category string
Category groups the defensive role a product plays, so an operator can reason about what coverage exists rather than the brand name.
const ( CatEDR Category = "edr" // behavioral EDR / endpoint detection CatAV Category = "av" // traditional antivirus CatNGAV Category = "ngav" // next-gen AV (cloud + ML) CatEPP Category = "epp" // endpoint protection platform CatLogging Category = "logging" // audit/log forwarding (sysmon, etc.) CatFW Category = "firewall" // host firewall )
type Database ¶
type Database struct {
Products []Product `json:"products"`
}
Database is the static fingerprint set.
func DefaultDatabase ¶
func DefaultDatabase() Database
DefaultDatabase is the built-in AV/EDR fingerprint set.
type Detection ¶
type Detection struct {
ProductID string `json:"product_id"`
Name string `json:"name"`
Category Category `json:"category"`
Platform string `json:"platform"`
Matches []Match `json:"matches"`
}
Detection is one identified product and the signatures that matched.
type Match ¶
type Match struct {
Kind string `json:"kind"` // process | service | driver | registry | file
Value string `json:"value"`
Sample string `json:"sample,omitempty"` // trimmed evidence line
}
Match is one signature that fired for a detected product.
type Product ¶
type Product struct {
ID string `json:"id"`
Name string `json:"name"`
Vendor string `json:"vendor"`
Category Category `json:"category"`
Platform string `json:"platform"` // linux | windows
Processes []string `json:"processes,omitempty"` // process image names
Services []string `json:"services,omitempty"` // service names
Drivers []string `json:"drivers,omitempty"` // loaded kernel driver names
Registry []string `json:"registry,omitempty"` // registry key/prefix (windows)
Files []string `json:"files,omitempty"` // on-disk file paths
// Notes are operator-facing decision support (what the product watches for),
// NOT bypass instructions.
Notes string `json:"notes,omitempty"`
}
Product is one known AV/EDR product and the signatures that identify it on a host. Only one signature needs to match for detection.
Source Files