CuckooSanbox自定义规则 - self.mark_ioc() 、self.mark()用法

签名如下：

from lib.cuckoo.common.abstracts import Signature
class TestWriteFile(Signature):
    name = "test_write_file"
    description = "test file api calls"
    severity = 40
    categories = ["test"]
    authors = ["Danyang.Wang"]
    minimum = "2.0"

    filter_apinames = set(["NtWriteFile","NtOpenFile","NtCreateFile"])

    def on_call(self, call, process):
        if call["api"] in ["NtOpenFile","NtCreateFile"] and call["status"]:
            if "1.txt" in call["arguments"]["filepath"]:
                self.mark_ioc("file222",call["arguments"]["filepath"])
        elif call["api"] == "NtWriteFile" and call["status"]:
            self.mark(buffer_test=call["arguments"]["buffer"],test=123456)

    def on_complete(self):
        return self.has_marks()

看图说话，命中规则后，沙箱报告显示如下：

可以看到这俩函数其实没啥区别，mark_ioc每次只能标记一项显示

self.mark_ioc("file_name","1.txt") 

self.mark可以同时显示多个数据在一项，而且传参方式不同,注意，这里file_name，不能用字符串表示了

self.mark(file_name="1.txt",file_size=1024)