PROCSCAN
Procscan is a quick and dirty python script used to look for potentially dangerous api call patterns in a Procmon PML file.
Installation
git clone https://github.com/bananabr/procscan.git
cd procscan
python3 -m pip install -r requirements.txt
Usage
usage: procscan.py [-h] [--log LOG] [--verbose] --pml PML --ac AC
optional arguments:
-h, --help show this help message and exit
--log LOG log file path
--verbose, -v increase verbosity
--pml PML procscan PML file
--ac AC accesschk output file
Todo
- (Registry symbolic link patterns)
- (Filesystem symbolic link patterns)
- (DLL hijack)
- (Writable DLL loaded by privileged process)
- (Writable PE loaded by privileged process)
28 Jun 26, 2022
10 Nov 02, 2022
21 Jan 06, 2023
53 Sep 25, 2022
1 Jan 14, 2022
96 Dec 26, 2022
4 Sep 26, 2022
2 Feb 20, 2022
6 Aug 22, 2021
2 May 07, 2022
42 May 28, 2021
43 Nov 22, 2022
2 Nov 28, 2022
2 May 04, 2022
1 Jan 30, 2022
1 Nov 22, 2021
1 Dec 15, 2021
1 Dec 31, 2021
1 Nov 08, 2021
45 Dec 30, 2022