运行时查询木马文件信息

1. 接口描述

接口请求域名： tcss.tencentcloudapi.com 。

运行时查询木马文件信息

默认接口请求频率限制：20次/秒。

2. 输入参数

以下请求参数列表仅列出了接口请求参数和部分公共参数，完整公共参数列表见 公共请求参数。

3. 输出参数

4. 示例

示例1 运行时查询木马文件信息

运行时查询木马文件信息

输入示例

POST / HTTP/1.1
Host: tcss.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeVirusDetail
<公共请求参数>

{
    "Id": "10021"
}

输出示例

{
    "Response": {
        "AncestorProcessParam": "/usr/local/bin/containerd-shim-runc-v2 -namespace k8s.io -id 7b4ed805844e07bd15663e4f778acf9bf388719cbcdf794290b9637a550a21d6 -address /run/containerd/containerd.****",
        "AncestorProcessPath": "/usr/local/bin/containerd-shim-run****",
        "AncestorProcessStartUser": "0",
        "AncestorProcessUserGroup": "0",
        "CheckPlatform": [
            "VDC",
            "TAV"
        ],
        "ClientIP": "10.*.*.1",
        "ClusterID": "cls-dfw3e***",
        "ClusterName": "clsfoo***",
        "ContainerId": "d4c43f9268ecea2aa75b26632299df8aaf496a*******",
        "ContainerIsolateOperationSrc": "运行时安全/文件查杀",
        "ContainerName": "/container_name",
        "ContainerNetStatus": "ISOLATED",
        "ContainerNetSubStatus": "NONE",
        "CreateTime": "2024-08-27T03:30:37Z",
        "EventType": "恶意文件告警",
        "FileAccessTime": "2018-02-28T07:45:34Z",
        "FileMd5": "81a7701a194c3a******",
        "FileModifyTime": "2018-02-28T07:45:34Z",
        "FileName": "specimen_*******",
        "FilePath": "/home/virus/specimen_******",
        "HarmDescribe": "蠕虫病毒Ramnit最早出现在2010年，至今已有8年之久，因传播力强而“闻名于世”。",
        "HostIP": "10.0.0.1",
        "HostId": "dc56fda9-58c8-4c4f-9e8c-abb0cd4f92aa",
        "HostName": "hostname",
        "ImageId": "sha256:80beff5ff34259ceb7fbe9cd*******",
        "ImageName": "centos:7",
        "Mark": "mark reason",
        "ModifyTime": "2024-10-21T06:42:49Z",
        "Namespace": "tcss",
        "NodeID": "mix-GOmf****",
        "NodeSubNetCIDR": "10.*.*.1/24",
        "NodeSubNetID": "subnet-aau2***",
        "NodeSubNetName": "subnet***",
        "NodeType": "NORMAL",
        "NodeUniqueID": "wer41324-18a1-4775-9e3f-**",
        "OperationTime": "2024-08-27T03:30:37Z",
        "PProcessParam": "node dist/inde****",
        "PProcessPath": "/usr/bin/****",
        "PProcessStartUser": "root",
        "PProcessUserGroup": "root",
        "PodIP": "10.0.*.*",
        "PodName": "PodName",
        "PodStatus": "Running",
        "ProcessAccountGroup": "root",
        "ProcessArgv": "git clone --depth=1 https://github.com/busi",
        "ProcessChan": "git(433802)|node(280016)|containerd-shim-runc-v2(176637)|system****",
        "ProcessFileAuthority": "-rwxr-****",
        "ProcessId": 0,
        "ProcessMd5": "472c65af3f43136472d1a383f5******",
        "ProcessName": "/bin/a***",
        "ProcessPath": "/usr/bin****",
        "ProcessStartAccount": "root",
        "RequestId": "dc56fda9-58c8-4c4f-9e8c-b7296836*****",
        "RiskLevel": "RISK_CRITICAL",
        "Size": 332155,
        "SourceType": 0,
        "Status": "DEAL_NONE",
        "SubStatus": "FILE_NOT_FOUND",
        "SuggestScheme": "1.在病毒尚未完全清理干净之前，暂时关闭系统文件共享功能 ，防止感染范围进一步扩大；\n2.检查恶意进程及非法端口，删除可疑的启动项和定时任务；\n3.隔离或者删除相关的木马文件；\n4.对系统进行风险排查，并进行安全加固，详情可参考如下链接： \n【Linux】https://cloud.tencent.com/document/product/296/9604 \n【Windows】https://cloud.tencent.com/document/product/296/9605",
        "Tags": [
            "ramnit",
            "Worm",
            "窃取用户信息，感染用户本地所有的html、exe、dll等格式的文件。"
        ],
        "VirusName": "Win32.Virus.Ramnit.Qwhl",
        "WorkloadType": "DaemonSet",
        "ContainerStatus": "RUNNING"
    }
}

5. 开发者资源

腾讯云 API 平台

腾讯云 API 平台 是综合 API 文档、错误码、API Explorer 及 SDK 等资源的统一查询平台，方便您从同一入口查询及使用腾讯云提供的所有 API 服务。

API Inspector

用户可通过 API Inspector 查看控制台每一步操作关联的 API 调用情况，并自动生成各语言版本的 API 代码，也可前往 API Explorer 进行在线调试。

SDK

云 API 3.0 提供了配套的开发工具集（SDK），支持多种编程语言，能更方便的调用 API。

• Tencent Cloud SDK 3.0 for Python: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Java: GitHub, Gitee
• Tencent Cloud SDK 3.0 for PHP: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Go: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Node.js: GitHub, Gitee
• Tencent Cloud SDK 3.0 for .NET: GitHub, Gitee
• Tencent Cloud SDK 3.0 for C++: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Ruby: GitHub, Gitee

命令行工具

• Tencent Cloud CLI 3.0

6. 错误码

以下仅列出了接口业务逻辑相关的错误码，其他错误码详见 公共错误码。