| Name | Type | Description | Notes |
|---|---|---|---|
| category | CategoryEnum | Execution category of the match | |
| how | HowEnum | Detection tier that produced the match | |
| matchedName | String | Name or token that matched | |
| source | SourceEnum | Execution source the match belongs to |
| Name | Value |
|---|---|
| DYNAMIC_RESOLVE | "dynamic-resolve" |
| HOOKING | "hooking" |
| INJECTION | "injection" |
| MEMORY_EXEC | "memory-exec" |
| MODULE_LOAD | "module-load" |
| PROCESS_CONTROL | "process-control" |
| PROCESS_CREATE | "process-create" |
| SCRIPT_EXEC | "script-exec" |
| SHELLCODE | "shellcode" |
| THREAD_CREATE | "thread-create" |
| UNKNOWN_DEFAULT_OPEN_API | "unknown_default_open_api" |
| Name | Value |
|---|---|
| API | "api" |
| CPP_CLASS_TOKEN | "cpp-class-token" |
| GENERIC_KEYWORD | "generic-keyword" |
| UNKNOWN_DEFAULT_OPEN_API | "unknown_default_open_api" |
| Name | Value |
|---|---|
| BOOST | "boost" |
| CPP | "cpp" |
| CPP_STDLIB | "cpp-stdlib" |
| GENERIC | "generic" |
| LIBC | "libc" |
| QT | "qt" |
| SCRIPT_ENGINE | "script-engine" |
| WINDOWS | "windows" |
| UNKNOWN_DEFAULT_OPEN_API | "unknown_default_open_api" |