81 lines
2.4 KiB
C#
81 lines
2.4 KiB
C#
|
using System;
|
||
|
|
using System.Collections.Generic;
|
||
|
|
|
||
|
|
namespace MemScanEDR.Models;
|
||
|
|
|
||
|
|
public class ProcessInfo
|
||
|
|
{
|
||
|
|
public int Pid { get; set; }
|
||
|
|
public string Name { get; set; } = "";
|
||
|
|
public string ExePath { get; set; } = "";
|
||
|
|
public int Ppid { get; set; }
|
||
|
|
public string ParentName { get; set; } = "";
|
||
|
|
public string CmdLine { get; set; } = "";
|
||
|
|
public string User { get; set; } = "";
|
||
|
|
public int ThreadCount { get; set; }
|
||
|
|
public long WorkingSetMB { get; set; }
|
||
|
|
public bool IsSigned { get; set; }
|
||
|
|
public string Signer { get; set; } = "";
|
||
|
|
public bool IsSystemPath { get; set; }
|
||
|
|
public bool IsTempPath { get; set; }
|
||
|
|
public List<NetworkConnection> Connections { get; set; } = new();
|
||
|
|
public List<MemoryRegion> MemoryRegions { get; set; } = new();
|
||
|
|
}
|
||
|
|
|
||
|
|
public class NetworkConnection
|
||
|
|
{
|
||
|
|
public string Protocol { get; set; } = "";
|
||
|
|
public string LocalAddr { get; set; } = "";
|
||
|
|
public string RemoteAddr { get; set; } = "";
|
||
|
|
public string State { get; set; } = "";
|
||
|
|
}
|
||
|
|
|
||
|
|
public class MemoryRegion
|
||
|
|
{
|
||
|
|
public ulong BaseAddress { get; set; }
|
||
|
|
public ulong Size { get; set; }
|
||
|
|
public string Protect { get; set; } = "";
|
||
|
|
public string Type { get; set; } = "";
|
||
|
|
public string State { get; set; } = "";
|
||
|
|
}
|
||
|
|
|
||
|
|
public class ScanResult
|
||
|
|
{
|
||
|
|
public int Pid { get; set; }
|
||
|
|
public string ProcessName { get; set; } = "";
|
||
|
|
public RiskLevel RiskLevel { get; set; } = RiskLevel.Safe;
|
||
|
|
public double RiskScore { get; set; }
|
||
|
|
public List<string> Indicators { get; set; } = new();
|
||
|
|
public string Reasoning { get; set; } = "";
|
||
|
|
public List<SignatureMatch> Matches { get; set; } = new();
|
||
|
|
public string AIProvider { get; set; } = "";
|
||
|
|
public DateTime ScanTime { get; set; } = DateTime.Now;
|
||
|
|
}
|
||
|
|
|
||
|
|
public enum RiskLevel
|
||
|
|
{
|
||
|
|
Safe,
|
||
|
|
Suspicious,
|
||
|
|
High
|
||
|
|
}
|
||
|
|
|
||
|
|
public class SignatureMatch
|
||
|
|
{
|
||
|
|
public string SigId { get; set; } = "";
|
||
|
|
public string Category { get; set; } = "";
|
||
|
|
public string Severity { get; set; } = "";
|
||
|
|
public string Description { get; set; } = "";
|
||
|
|
public string Address { get; set; } = "";
|
||
|
|
public string Protect { get; set; } = "";
|
||
|
|
}
|
||
|
|
|
||
|
|
public class Signature
|
||
|
|
{
|
||
|
|
public string SigId { get; set; } = "";
|
||
|
|
public string Value { get; set; } = "";
|
||
|
|
public string DataType { get; set; } = "string";
|
||
|
|
public string Category { get; set; } = "";
|
||
|
|
public string Severity { get; set; } = "medium";
|
||
|
|
public string Description { get; set; } = "";
|
||
|
|
}
|