PROCSCAN
Procscan is a quick and dirty python script used to look for potentially dangerous api call patterns in a Procmon PML file.
Installation
git clone https://github.com/bananabr/procscan.git
cd procscan
python3 -m pip install -r requirements.txt
Usage
usage: procscan.py [-h] [--log LOG] [--verbose] --pml PML --ac AC
optional arguments:
-h, --help show this help message and exit
--log LOG log file path
--verbose, -v increase verbosity
--pml PML procscan PML file
--ac AC accesschk output file
Todo
- (Registry symbolic link patterns)
- (Filesystem symbolic link patterns)
- (DLL hijack)
- (Writable DLL loaded by privileged process)
- (Writable PE loaded by privileged process)
2 Dec 23, 2021
7 Dec 14, 2022
16 Oct 06, 2022
21 Jun 14, 2021
71 Jan 09, 2023
2 Dec 26, 2021
2 Nov 19, 2022
529 Dec 31, 2022
41 Jan 22, 2021
2 Nov 28, 2022
90 Jan 01, 2023
2 Jun 27, 2022
22 Jan 11, 2022
6 Sep 18, 2022
82 Dec 12, 2022
62 Sep 19, 2022
16 Aug 18, 2022
1 May 25, 2022
21 Jul 13, 2022
2 Jul 26, 2022