Do not analyze processes without VADs #1470

2026-09-20 08:37:39 +02:00 · 2024-12-29 02:13:18 +00:00
parent b1a42d9510
commit e64af61efa
1 changed files with 2 additions and 0 deletions
@@ -433,6 +433,8 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface):
            proc_layer = self.context.layers[proc_layer_name]

            vads = self.get_vad_maps(proc)
+            if not vads:
+                continue

            # for each valid process, look for malicious syscall invocations
            for address, vad_path in self._get_rule_hits(