mirror of
https://github.com/OTRF/OSSEM-DD
synced 2026-06-08 12:05:33 +00:00
Swann Legras
66 lines
1.5 KiB
YAML
66 lines
1.5 KiB
YAML
name: Process_memory_map Table
|
|
description: Process memory mapped files and pseudo device/regions.
|
|
platform: linux
|
|
log_source: osquery
|
|
event_id: process_memory_map
|
|
event_version: 4.4.2
|
|
event_fields:
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: pid
|
|
type: INTEGER
|
|
description: Process (or thread) ID
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: start
|
|
type: TEXT
|
|
description: Virtual start address (hex)
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: end
|
|
type: TEXT
|
|
description: Virtual end address (hex)
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: permissions
|
|
type: TEXT
|
|
description: r=read, w=write, x=execute, p=private (cow)
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: offset
|
|
type: BIGINT
|
|
description: Offset into mapped path
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: device
|
|
type: TEXT
|
|
description: MA:MI Major/minor device ID
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: inode
|
|
type: INTEGER
|
|
description: Mapped path inode, 0 means uninitialized (BSS)
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: path
|
|
type: TEXT
|
|
description: Path to mapped file or mapped type
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: pseudo
|
|
type: INTEGER
|
|
description: 1 If path is a pseudo path, else 0
|
|
sample_value: TBD
|
|
references:
|
|
- text: OSQuery table documentation
|
|
link: https://osquery.io/schema/current#process_memory_map
|
|
tags: []
|