DescribeReverseShellDetail

Download PDF

Last updated: 2024-12-06 15:47:39

Last updated: 2024-12-06 15:47:39

Download PDF

1. API Description

Domain name for API request: tcss.intl.tencentcloudapi.com.

This API is used to query the details of a reverse shell event at runtime.

A maximum of 20 requests can be initiated per second for this API.

We recommend you to use API Explorer

Try it

API Explorer provides a range of capabilities, including online call, signature authentication, SDK code generation, and API quick search. It enables you to view the request, response, and auto-generated examples.

2. Input Parameters

The following request parameter list only provides API request parameters and some common parameters. For the complete common parameter list, see Common Request Parameters.

Parameter Name	Required	Type	Description
Action	Yes	String	Common Params. The value used for this API: DescribeReverseShellDetail.
Version	Yes	String	Common Params. The value used for this API: 2020-11-01.
Region	No	String	Common Params. This parameter is not required.
EventId	Yes	String	Unique event ID

3. Output Parameters

Parameter Name	Type	Description
EventBaseInfo	RunTimeEventBaseInfo	Basic information of the event
ProcessInfo	ProcessDetailInfo	Process information
ParentProcessInfo	ProcessDetailBaseInfo	Parent process information
EventDetail	ReverseShellEventDescription	Event description
AncestorProcessInfo	ProcessBaseInfo	Ancestor process information Note: This field may return null, indicating that no valid values can be obtained.
RequestId	String	The unique request ID, generated by the server, will be returned for every request (if the request fails to reach the server for other reasons, the request will not obtain a RequestId). RequestId is required for locating a problem.

4. Example

Example1 Querying the details of a reverse shell event at runtime

Input Example

https://tcss.intl.tencentcloudapi.com/?Action=DescribeReverseShellDetail
&EventId=xxx
&<Common request parameters>

Output Example

{
    "Response": {
        "EventBaseInfo": {
            "EventId": "xx",
            "ContainerName": "xx",
            "ContainerId": "xx",
            "EventCount": 0,
            "EventType": "xx",
            "HostIP": "xx",
            "FoundTime": "2020-09-22 00:00:00",
            "Status": "xx",
            "EventName": "xx",
            "ImageId": "xx",
            "ImageName": "xx",
            "PodName": "xx",
            "ClientIP": "xx",
            "LatestFoundTime": "xx",
            "NodeName": "xx",
            "ContainerNetStatus": "xx",
            "ContainerNetSubStatus": "xx",
            "ContainerIsolateOperationSrc": "xx"
        },
        "ProcessInfo": {
            "ProcessPath": "xx",
            "ProcessTree": "xx",
            "ProcessId": 1,
            "ProcessAuthority": "xx",
            "ProcessUserGroup": "xx",
            "ProcessName": "xx",
            "ProcessParam": "xx",
            "ProcessMd5": "xx",
            "ProcessStartUser": "xx"
        },
        "EventDetail": {
            "DstAddress": "xx",
            "Remark": "xx",
            "Description": "xx",
            "Solution": "xx",
            "OperationTime": "xx"
        },
        "AncestorProcessInfo": {
            "ProcessPath": "xx",
            "ProcessParam": "xx",
            "ProcessStartUser": "xx",
            "ProcessUserGroup": "xx"
        },
        "RequestId": "xx",
        "ParentProcessInfo": {
            "ProcessPath": "xx",
            "ProcessId": 1,
            "ProcessUserGroup": "xx",
            "ProcessName": "xx",
            "ProcessParam": "xx",
            "ProcessStartUser": "xx"
        }
    }
}

5. Developer Resources

SDK

TencentCloud API 3.0 integrates SDKs that support various programming languages to make it easier for you to call APIs.

Command Line Interface

Tencent Cloud CLI 3.0

6. Error Code

The following only lists the error codes related to the API business logic. For other error codes, see Common Error Codes.

Error Code	Description
AuthFailure	A CAM signature/authentication error occurred.
FailedOperation.DataValueNotCorrect	The response data value is incorrect.
InternalError	An internal error occurred.
InvalidParameter	The parameter is incorrect.
InvalidParameter.InvalidFormat	The parameter format is incorrect.
InvalidParameter.MissingParameter	The required parameter is missing.
InvalidParameterValue	The parameter value is incorrect.
InvalidParameterValue.DataNotFound	The current data was not found.

Was this page helpful?

You can also Contact Sales or Submit a Ticket for help.

Yes

tencent cloud