PROCSCAN
Procscan is a quick and dirty python script used to look for potentially dangerous api call patterns in a Procmon PML file.
Installation
git clone https://github.com/bananabr/procscan.git
cd procscan
python3 -m pip install -r requirements.txt
Usage
usage: procscan.py [-h] [--log LOG] [--verbose] --pml PML --ac AC
optional arguments:
-h, --help show this help message and exit
--log LOG log file path
--verbose, -v increase verbosity
--pml PML procscan PML file
--ac AC accesschk output file
Todo
- (Registry symbolic link patterns)
- (Filesystem symbolic link patterns)
- (DLL hijack)
- (Writable DLL loaded by privileged process)
- (Writable PE loaded by privileged process)
82 Dec 27, 2022
4 Aug 13, 2022
37 Dec 20, 2022
8 Jun 13, 2022
1 Feb 14, 2022
3 Feb 15, 2022
1 Feb 15, 2022
43 Nov 23, 2022
19.9k Dec 27, 2022
1 Jan 18, 2022
41 Nov 30, 2022
75 Dec 26, 2022
2 May 06, 2022
5 Nov 27, 2022
6 Jul 15, 2022
16 Dec 05, 2022
15 Aug 26, 2022
1 Apr 08, 2022
1 Oct 24, 2021
4 May 14, 2022