Add files via upload
Harley Lebeau
GitHub
parent
5f1773ecf7
commit
4cb0c57e52
|
|
@ -0,0 +1,178 @@
|
||||||
|
#Process Monitor
|
||||||
|
#Author: @r3dQu1nn
|
||||||
|
#Queries the processes at a set interval to see what processes have been started since that interval time
|
||||||
|
#Thanks to @Alyssa (ramen0x3f) for the code snippets! Big thanks to @i_am_excite for the powershell code!
|
||||||
|
#Big thanks to raffi for the on heartbeat help!
|
||||||
|
|
||||||
|
#Global Variables
|
||||||
|
$timer = "";
|
||||||
|
$interval = "5m";
|
||||||
|
include(script_resource("ProcessMonitor.ps1"));
|
||||||
|
|
||||||
|
#Register Alias for Process Monitor
|
||||||
|
beacon_command_register("ProcessMonitor",
|
||||||
|
"Start/Stop and Change the Interval Time for Process Monitor",
|
||||||
|
"Synopsis: ProcessMonitor [Start/Stop] [Time]\n" .
|
||||||
|
"Options: 1m, 5m (default), 10m, 20m, 30m. If no time supplied, default of 5m is used.");
|
||||||
|
|
||||||
|
#Process Monitor alias
|
||||||
|
alias ProcessMonitor {
|
||||||
|
if ( $2 eq 'Start' && $3 eq '1m' ) {
|
||||||
|
if (-exists script_resource("ProcessMonitor.ps1")) {
|
||||||
|
$bid = $1;
|
||||||
|
$timer = "Start";
|
||||||
|
$interval = "1m";
|
||||||
|
blog($1, "\c9Process Monitor Started! Time Interval is set to " . $interval);
|
||||||
|
blog($1, "\c4Run ProcessMonitor [Stop] to stop ProcessMonitor from running continuously.");
|
||||||
|
blog($1, "\cBDepending on your sleep time, results might come before or after checkin.");
|
||||||
|
bpowershell_import!($1, script_resource("ProcessMonitor.ps1"));
|
||||||
|
bpowerpick!($1, 'Get-Proc 1');
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$timer = "";
|
||||||
|
$interval = "5m";
|
||||||
|
berror($1, "\c4ProcessMonitor.ps1 does not exist!");
|
||||||
|
show_message("ProcessMonitor.ps1 does not exist!");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else if ( $2 eq 'Start' && $3 eq '5m' ) {
|
||||||
|
if (-exists script_resource("ProcessMonitor.ps1")) {
|
||||||
|
$bid = $1;
|
||||||
|
$timer = "Start";
|
||||||
|
$interval = "5m";
|
||||||
|
blog($1, "\c9Process Monitor Started! Time Interval is set to " . $interval);
|
||||||
|
blog($1, "\c4Run ProcessMonitor [Stop] to stop ProcessMonitor from running continuously.");
|
||||||
|
blog($1, "\cBDepending on your sleep time, results might come before or after checkin.");
|
||||||
|
bpowershell_import!($1, script_resource("ProcessMonitor.ps1"));
|
||||||
|
bpowerpick!($1, 'Get-Proc 5');
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$timer = "";
|
||||||
|
$interval = "5m";
|
||||||
|
berror($1, "\c4ProcessMonitor.ps1 does not exist!");
|
||||||
|
show_message("ProcessMonitor.ps1 does not exist!");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else if ( $2 eq 'Start' && $3 eq '10m' ) {
|
||||||
|
if (-exists script_resource("ProcessMonitor.ps1")) {
|
||||||
|
$bid = $1;
|
||||||
|
$timer = "Start";
|
||||||
|
$interval = "10m";
|
||||||
|
blog($1, "\c9Process Monitor Started! Time Interval is set to " . $interval);
|
||||||
|
blog($1, "\c4Run ProcessMonitor [Stop] to stop ProcessMonitor from running continuously.");
|
||||||
|
blog($1, "\cBDepending on your sleep time, results might come before or after checkin.");
|
||||||
|
bpowershell_import!($1, script_resource("ProcessMonitor.ps1"));
|
||||||
|
bpowerpick!($1, 'Get-Proc 10');
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$timer = "";
|
||||||
|
$interval = "5m";
|
||||||
|
berror($1, "\c4ProcessMonitor.ps1 does not exist!");
|
||||||
|
show_message("ProcessMonitor.ps1 does not exist!");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else if ( $2 eq 'Start' && $3 eq '20m' ) {
|
||||||
|
if (-exists script_resource("ProcessMonitor.ps1")) {
|
||||||
|
$bid = $1;
|
||||||
|
$timer = "Start";
|
||||||
|
$interval = "20m";
|
||||||
|
blog($1, "\c9Process Monitor Started! Time Interval is set to " . $interval);
|
||||||
|
blog($1, "\c4Run ProcessMonitor [Stop] to stop ProcessMonitor from running continuously.");
|
||||||
|
blog($1, "\cBDepending on your sleep time, results might come before or after checkin.");
|
||||||
|
bpowershell_import!($1, script_resource("ProcessMonitor.ps1"));
|
||||||
|
bpowerpick!($1, 'Get-Proc 20');
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$timer = "";
|
||||||
|
$interval = "5m";
|
||||||
|
berror($1, "\c4ProcessMonitor.ps1 does not exist!");
|
||||||
|
show_message("ProcessMonitor.ps1 does not exist!");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else if ( $2 eq 'Start' && $3 eq '30m' ) {
|
||||||
|
if (-exists script_resource("ProcessMonitor.ps1")) {
|
||||||
|
$bid = $1;
|
||||||
|
$timer = "Start";
|
||||||
|
$interval = "30m";
|
||||||
|
blog($1, "\c9Process Monitor Started! Time Interval is set to " . $interval);
|
||||||
|
blog($1, "\c4Run ProcessMonitor [Stop] to stop ProcessMonitor from running continuously.");
|
||||||
|
blog($1, "\cBDepending on your sleep time, results might come before or after checkin.");
|
||||||
|
bpowershell_import!($1, script_resource("ProcessMonitor.ps1"));
|
||||||
|
bpowerpick!($1, 'Get-Proc 30');
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$timer = "";
|
||||||
|
$interval = "5m";
|
||||||
|
berror($1, "\c4ProcessMonitor.ps1 does not exist!");
|
||||||
|
show_message("ProcessMonitor.ps1 does not exist!");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else if ( $2 eq 'Stop' ) {
|
||||||
|
$timer = "Stop";
|
||||||
|
$interval = "5m";
|
||||||
|
blog($1, "\cBProcess Monitor has Stopped.");
|
||||||
|
}
|
||||||
|
else if ( $2 is $null ) {
|
||||||
|
blog($1, "\c4Please provide 'Start' then a correct time interval to Start Process Monitor.");
|
||||||
|
show_message("Please provide 'Start' then a correct time interval to Start Process Monitor.");
|
||||||
|
}
|
||||||
|
else if ( $3 != '1m' || $3 != '5m' || $3 != '10m' || $3 != '20m' || $3 != '30m' ) {
|
||||||
|
blog($1, "\c4Please provide a correct time interval to Start Process Monitor.");
|
||||||
|
show_message("Please provide a correct time interval to Start Process Monitor.");
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$timer = "";
|
||||||
|
$interval = "5m";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#Process Monitor heartbeat checks
|
||||||
|
on heartbeat_1m {
|
||||||
|
if ( $timer eq 'Start' && $interval eq '1m' ) {
|
||||||
|
bpowerpick!($bid, 'Get-Proc 1');
|
||||||
|
}
|
||||||
|
else if ( $timer eq 'Stop' ) {
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
on heartbeat_5m {
|
||||||
|
if ( $timer eq 'Start' && $interval eq '5m' ) {
|
||||||
|
bpowerpick!($bid, 'Get-Proc 5');
|
||||||
|
}
|
||||||
|
else if ( $timer eq 'Stop' ) {
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
on heartbeat_10m {
|
||||||
|
if ( $timer eq 'Start' && $interval eq '10m' ) {
|
||||||
|
bpowerpick!($bid, 'Get-Proc 10');
|
||||||
|
}
|
||||||
|
else if ( $timer eq 'Stop' ) {
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
on heartbeat_20m {
|
||||||
|
if ( $timer eq 'Start' && $interval eq '20m' ) {
|
||||||
|
bpowerpick!($bid, 'Get-Proc 20');
|
||||||
|
}
|
||||||
|
else if ( $timer eq 'Stop' ) {
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
on heartbeat_30m {
|
||||||
|
if ( $timer eq 'Start' && $interval eq '30m' ) {
|
||||||
|
bpowerpick!($bid, 'Get-Proc 30');
|
||||||
|
}
|
||||||
|
else if ( $timer eq 'Stop' ) {
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,33 @@
|
||||||
|
function Get-Proc {
|
||||||
|
<#
|
||||||
|
.DESCRIPTION
|
||||||
|
Cobaltstrike has a great general function for processes: the 'ps' command. Use that if you need to dump ALL the processes w/ arch.
|
||||||
|
|
||||||
|
This solution will show the running processes that have a creation date within the past 1 hour, giving more SA to the operator/analyst than just looking through an entire process list
|
||||||
|
|
||||||
|
Both solutions have their place. It is up to you to know how to use which when you need it.
|
||||||
|
|
||||||
|
Module info for process list has also been removed because nobody used it in the two years that the survey script was around. If you need to do IR on a box, there are better ways to do so
|
||||||
|
than by clogging up the screen in a survey.
|
||||||
|
#>
|
||||||
|
|
||||||
|
param
|
||||||
|
(
|
||||||
|
[Parameter(Mandatory = $True)]
|
||||||
|
[string]$Time
|
||||||
|
)
|
||||||
|
|
||||||
|
$test3 = gwmi win32_process | sort -Property ProcessID
|
||||||
|
$q = get-date
|
||||||
|
|
||||||
|
"`n[+] Processes created in the past $Time minutes`n"
|
||||||
|
"{0,-8}{1,-8}{2,-20} {3,-20} {4}" -f "PID","PPID","PID Name","PPID Name","Owner"
|
||||||
|
|
||||||
|
foreach ($i in $test3){
|
||||||
|
$qq = [Management.ManagementDateTimeConverter]::ToDateTime($i.creationdate)
|
||||||
|
if ($qq -gt $q.addminutes(-$Time)){
|
||||||
|
$z = $i.ParentProcessId
|
||||||
|
"{0,-8}{1,-8}{2,-20} {3,-20} {4}" -f $i.ProcessId, $i.ParentProcessId, $( if($i.processname.length -gt 20){ $i.processname.substring(0,20)} else{$i.processname}), $($test3 | where {$_.processid -eq $z}).caption , $i.GetOwner().user
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue