atomicshop 2.14.0__py3-none-any.whl → 2.14.1__py3-none-any.whl

atomicshop/__init__.py

@@ -1,4 +1,4 @@
 """Atomic Basic functions and classes to make developer life easier"""
 
 __author__ = "Den Kras"
-__version__ = '2.14.0'
+__version__ = '2.14.1'

atomicshop/etws/trace.py

@@ -27,8 +27,7 @@ class EventTrace(etw.ETW):
             session_name: str = None,
             close_existing_session_name: bool = True,
             enable_process_poller: bool = False,
-            process_poller_etw_session_name: str = None,
-            process_poller_method: Literal['psutil', 'pywin32', 'process_dll', 'sysmon_etw'] = 'sysmon_etw'
+            process_poller_method: Literal['psutil', 'pywin32', 'process_dll', 'sysmon_etw', 'event_log'] = 'event_log'
     ):
         """
         :param providers: List of tuples with provider name and provider GUID.
@@ -42,13 +41,13 @@ class EventTrace(etw.ETW):
         :param enable_process_poller: Boolean to enable process poller. Gets the process PID, Name and CommandLine.
             Since the DNS events doesn't contain the process name and command line, only PID.
             Then DNS events will be enriched with the process name and command line from the process poller.
-        :param process_poller_etw_session_name: The name of the ETW session for tracing process creation.
         :param process_poller_method: The method to get the process information. For more information, see the
             'process_poller.ProcessPollerPool' class. Summary:
                 'psutil': Uses 'psutil' library to get the process information.
                 'pywin32': Uses 'pywin32' library to get the process information.
                 'process_dll': Uses 'process' custom DLL to get the process information.
                 'sysmon_etw': Uses 'sysmon_etw' uses sysmon and ETW to get the process information.
+                'event_log': Uses Security Windows EVent Log channel (event id 4688) to get the process information.
 
         ------------------------------------------
 
@@ -72,7 +71,6 @@ class EventTrace(etw.ETW):
         self.event_queue = queue.Queue()
         self.close_existing_session_name: bool = close_existing_session_name
         self.enable_process_poller: bool = enable_process_poller
-        self.process_poller_etw_session_name: str = process_poller_etw_session_name
 
         # If no callback function is provided, we will use the default one, which will put the event in the queue.
         if not event_callback:
@@ -86,7 +84,8 @@ class EventTrace(etw.ETW):
         for provider in providers:
             etw_format_providers.append(etw.ProviderInfo(provider[0], etw.GUID(provider[1])))
 
-        if not process_poller_etw_session_name:
+        process_poller_etw_session_name = None
+        if process_poller_method == 'sysmon_etw':
             process_poller_etw_session_name = PROCESS_POLLER_ETW_DEFAULT_SESSION_NAME
 
         if self.enable_process_poller:

atomicshop/etws/traces/trace_dns.py

@@ -24,8 +24,7 @@ class DnsRequestResponseTrace:
             self,
             attrs: list = None,
             session_name: str = None,
-            close_existing_session_name: bool = True,
-            process_poller_etw_session_name: str = None
+            close_existing_session_name: bool = True
     ):
         """
         :param attrs: List of attributes to return. If None, all attributes will be returned.
@@ -36,7 +35,6 @@ class DnsRequestResponseTrace:
             False: if ETW session with 'session_name' exists, you will be notified and the new session will not be
                 created. Instead, the existing session will be used. If there is a buffer from the previous session,
                 you will get the events from the buffer.
-        :param process_poller_etw_session_name: The name of the ETW session for tracing process creation.
 
         -------------------------------------------------
 
@@ -48,8 +46,7 @@ class DnsRequestResponseTrace:
                 attrs=['pid', 'name', 'cmdline', 'domain', 'query_type'],
                 session_name='MyDnsTrace',
                 close_existing_session_name=True,
-                enable_process_poller=True,
-                process_poller_etw_session_name='MyProcessTrace'
+                enable_process_poller=True
             )
             dns_trace_w.start()
             while True:
@@ -69,8 +66,7 @@ class DnsRequestResponseTrace:
             event_id_filters=[REQUEST_RESP_EVENT_ID],
             session_name=session_name,
             close_existing_session_name=close_existing_session_name,
-            enable_process_poller=True,
-            process_poller_etw_session_name=process_poller_etw_session_name
+            enable_process_poller=True
         )
 
     def start(self):

atomicshop/monitor/change_monitor.py

@@ -41,8 +41,7 @@ class ChangeMonitor:
                     'url_playwright_jpeg'],
                 None] = None,
             object_type_settings: dict = None,
-            etw_session_name: str = None,
-            etw_process_session_name: str = None
+            etw_session_name: str = None
     ):
         """
         :param object_type: string, type of object to check. The type must be one of the following:
@@ -89,8 +88,6 @@ class ChangeMonitor:
             with logman and other tools: logman query -ets
             If not provided, a default name will be generated.
             'dns': 'AtomicShopDnsTrace'
-        :param etw_process_session_name: string, the name of the ETW session for tracing process creation.
-            This is needed to correlate the process cmd with the DNS requests PIDs.
 
         If 'input_directory' is not specified, the 'input_file_name' is not specified, and
         'generate_input_file_name' is False, then the input file will not be used and the object will be stored
@@ -107,7 +104,6 @@ class ChangeMonitor:
         self.object_type = object_type
         self.object_type_settings: dict = object_type_settings
         self.etw_session_name: str = etw_session_name
-        self.etw_process_session_name: str = etw_process_session_name
 
         # === Additional variables ========================================
 

atomicshop/monitor/checks/dns.py

@@ -27,8 +27,7 @@ class DnsCheck:
             trace_dns.DnsRequestResponseTrace(
                 attrs=['name', 'cmdline', 'domain', 'query_type'],
                 session_name=self.etw_session_name,
-                close_existing_session_name=True,
-                process_poller_etw_session_name=change_monitor_instance.etw_process_session_name
+                close_existing_session_name=True
             )
         )
 

atomicshop/process_poller.py

@@ -2,8 +2,10 @@ import threading
 import multiprocessing
 import time
 from typing import Literal, Union
+from pathlib import Path
 
 from .wrappers.pywin32w import wmi_win32process
+from .wrappers.pywin32w.win_event_log.subscribes import subscribe_to_process_create
 from .wrappers.psutilw import psutilw
 from .etws.traces import trace_sysmon_process_creation
 from .basics import dicts
@@ -52,7 +54,7 @@ class GetProcessList:
     """
     def __init__(
             self,
-            get_method: Literal['psutil', 'pywin32', 'process_dll', 'sysmon_etw'] = 'process_dll',
+            get_method: Literal['psutil', 'pywin32', 'process_dll'] = 'process_dll',
             connect_on_init: bool = False
     ):
         """
@@ -145,7 +147,7 @@ class ProcessPollerPool:
             self,
             interval_seconds: Union[int, float] = 0,
             operation: Literal['thread', 'process'] = 'thread',
-            poller_method: Literal['psutil', 'pywin32', 'process_dll', 'sysmon_etw'] = 'sysmon_etw',
+            poller_method: Literal['psutil', 'pywin32', 'process_dll', 'sysmon_etw', 'event_log'] = 'event_log',
             sysmon_etw_session_name: str = None,
             sysmon_directory: str = None
     ):
@@ -175,6 +177,9 @@ class ProcessPollerPool:
                     2. Start the "Microsoft-Windows-Sysmon" ETW session.
                     3. Take a snapshot of current processes and their CMDs with psutil and store it in a dict.
                     4. Each new process creation from ETW updates the dict.
+            'event_log': Get the list of processes by subscribing to the Windows Event Log.
+                Log Channel: Security, Event ID: 4688.
+                We enable the necessary prerequisites in registry and subscribe to the event.
         :param sysmon_etw_session_name: str, only for 'sysmon_etw' get_method.
             The name of the ETW session for tracing process creation.
         :param sysmon_directory: str, only for 'sysmon_etw' get_method.
@@ -271,6 +276,12 @@ def _worker(
         # We must initiate the connection inside the thread/process, because it is not thread-safe.
         poller_instance.start()
 
+        processes = GetProcessList(get_method='pywin32', connect_on_init=True).get_processes(as_dict=True)
+        process_queue.put(processes)
+    elif poller_method == 'event_log':
+        poller_instance = subscribe_to_process_create.ProcessCreateSubscriber()
+        poller_instance.start()
+
         processes = GetProcessList(get_method='pywin32', connect_on_init=True).get_processes(as_dict=True)
         process_queue.put(processes)
     else:
@@ -289,6 +300,13 @@ def _worker(
                     'name': current_cycle['original_file_name'],
                     'cmdline': current_cycle['command_line']}
                 }
+            elif poller_method == 'event_log':
+                # Get the current processes and reinitialize the instance of the dict.
+                current_cycle: dict = poller_instance.emit()
+                current_processes: dict = {current_cycle['pid']: {
+                    'name': Path(current_cycle['process_name']).name,
+                    'cmdline': current_cycle['command_line']}
+                }
             else:
                 # Get the current processes and reinitialize the instance of the dict.
                 current_processes: dict = dict(poller_instance.get_processes())

atomicshop/wrappers/pywin32w/win_event_log/subscribes/subscribe_to_process_create.py

@@ -91,10 +91,10 @@ def is_audit_process_creation_enabled(print_kwargs: dict = None) -> bool:
             #     color='green', **(print_kwargs or {}))
             return True
         else:
-            print_api(output, **(print_kwargs or {}))
-            print_api(
-                "'Audit Process Creation' is not fully enabled. Check the output above for details.",
-                color='yellow', **(print_kwargs or {}))
+            # print_api(output, **(print_kwargs or {}))
+            # print_api(
+            #     "'Audit Process Creation' is not fully enabled. Check the output above for details.",
+            #     color='yellow', **(print_kwargs or {}))
             return False
     except subprocess.CalledProcessError as e:
         print_api(f"Failed to check 'Audit Process Creation': {e}", color='red', error_type=True, **(print_kwargs or {}))

{atomicshop-2.14.0.dist-info → atomicshop-2.14.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: atomicshop
-Version: 2.14.0
+Version: 2.14.1
 Summary: Atomic functions and classes to make developer life easier
 Author: Denis Kras
 License: MIT License

{atomicshop-2.14.0.dist-info → atomicshop-2.14.1.dist-info}/RECORD

@@ -1,4 +1,4 @@
-atomicshop/__init__.py,sha256=LlDA7S0dPFwG14ZFuGv5tyUVyow2__rgMRanlcYHT88,123
+atomicshop/__init__.py,sha256=w-I1vM1vpc9PJDvoRTt804j2SwPM8mjp6n5FOtCdutg,123
 atomicshop/_basics_temp.py,sha256=6cu2dd6r2dLrd1BRNcVDKTHlsHs_26Gpw8QS6v32lQ0,3699
 atomicshop/_create_pdf_demo.py,sha256=Yi-PGZuMg0RKvQmLqVeLIZYadqEZwUm-4A9JxBl_vYA,3713
 atomicshop/_patch_import.py,sha256=ENp55sKVJ0e6-4lBvZnpz9PQCt3Otbur7F6aXDlyje4,6334
@@ -27,7 +27,7 @@ atomicshop/permissions.py,sha256=P6tiUKV-Gw-c3ePEVsst9bqWaHJbB4ZlJB4xbDYVpEs,443
 atomicshop/print_api.py,sha256=DhbCQd0MWZZ5GYEk4oTu1opRFC-b31g1VWZgTGewG2Y,11568
 atomicshop/process.py,sha256=R1BtXWjG2g2Q3WlsyhbIlXZz0UkQeagY7fQyBOIX_DM,15951
 atomicshop/process_name_cmd.py,sha256=CtaSp3mgxxJKCCVW8BLx6BJNx4giCklU_T7USiCEwfc,5162
-atomicshop/process_poller.py,sha256=sGIiLNdYdyxdER7hKP8QcbYg1esKe5ymCfh5qUATpJM,15033
+atomicshop/process_poller.py,sha256=B91ugFIo84IMFXbWJeW8P7TsIkzYxMXBVWuvYqRXS-c,16107
 atomicshop/python_file_patcher.py,sha256=kd3rBWvTcosLEk-7TycNdfKW9fZbe161iVwmH4niUo0,5515
 atomicshop/python_functions.py,sha256=zJg4ogUwECxrDD7xdDN5JikIUctITM5lsyabr_ZNsRw,4435
 atomicshop/question_answer_engine.py,sha256=DuOn7QEgKKfqZu2cR8mVeFIfFgayfBHiW-jY2VPq_Fo,841
@@ -106,9 +106,9 @@ atomicshop/etws/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 atomicshop/etws/const.py,sha256=v3x_IdCYeSKbCGywiZFOZln80ldpwKW5nuMDuUe51Jg,1257
 atomicshop/etws/providers.py,sha256=fVmWi-uGdtnsQTDpu_ty6dzx0GMhGokiST73LNBEJ38,129
 atomicshop/etws/sessions.py,sha256=k3miewU278xn829cqDbsuH_bmZHPQE9-Zn-hINbxUSE,1330
-atomicshop/etws/trace.py,sha256=H0uDB6I86UoNyijE5HCukp_paJNHTjKL6eAzBRGSI50,8509
+atomicshop/etws/trace.py,sha256=v2yA3FicR9WIg5n5KlZEuYbLAzTTjiDk7avWxcEjwp8,8439
 atomicshop/etws/traces/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-atomicshop/etws/traces/trace_dns.py,sha256=8Fl5UW4An3SE8tGXGTufTgOcWa574YZ6zQbU7x5DYrs,6270
+atomicshop/etws/traces/trace_dns.py,sha256=-bw7JGDeAl2UtNGoSPeD_gh6ij4IGAbPdB8VWip8fXc,5960
 atomicshop/etws/traces/trace_sysmon_process_creation.py,sha256=WdlQiOfRZC-_PpuE6BkOw5zB0DLc3fhVrANyLrgfCac,4833
 atomicshop/file_io/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 atomicshop/file_io/csvs.py,sha256=y8cJtnlN-NNxNupzJgSeGq9aQ4wNxYLFPX9vNNlUiIc,5830
@@ -139,9 +139,9 @@ atomicshop/mitm/engines/__reference_general/parser___reference_general.py,sha256
 atomicshop/mitm/engines/__reference_general/recorder___reference_general.py,sha256=KENDVf9OwXD9gwSh4B1XxACCe7iHYjrvnW1t6F64wdE,695
 atomicshop/mitm/engines/__reference_general/responder___reference_general.py,sha256=1AM49UaFTKA0AHw-k3SV3uH3QbG-o6ux0c-GoWkKNU0,6993
 atomicshop/monitor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-atomicshop/monitor/change_monitor.py,sha256=eJRP7NBnA-Y_n6Ofm_jKrR5XguJV6gEmxFdtdGMBF3k,7866
+atomicshop/monitor/change_monitor.py,sha256=dGhk5bJPxLCHa2FOVkort99E7vjVojra9GlvhpcKSqE,7551
 atomicshop/monitor/checks/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-atomicshop/monitor/checks/dns.py,sha256=OJWvMKl0zNtvBTYVYHSK_tfH0cNxCJ1kc_O-2Ob_5fc,7137
+atomicshop/monitor/checks/dns.py,sha256=clslElMi2HZaO3G1nXt2t0O2Yj0vFsJd6CXRdIXCGJM,7038
 atomicshop/monitor/checks/file.py,sha256=2tIDSlX2KZNc_9i9ji1tcOqupbFTIOj7cKXLyBEDWMk,3263
 atomicshop/monitor/checks/network.py,sha256=CGZWl4WlQrxayZeVF9JspJXwYA-zWx8ECWTVGSlXc98,3825
 atomicshop/monitor/checks/process_running.py,sha256=x66wd6-l466r8sbRQaIli0yswyGt1dH2DVXkGDL6O0Q,1891
@@ -253,7 +253,7 @@ atomicshop/wrappers/pywin32w/wmi_win32process.py,sha256=qMzXtJ5hBZ5ydAyqpDbSx0nO
 atomicshop/wrappers/pywin32w/win_event_log/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 atomicshop/wrappers/pywin32w/win_event_log/subscribe.py,sha256=UztWltQPK_fQ3EWyY6tGfhAqwxDjK7RVIAZppu97rKI,5104
 atomicshop/wrappers/pywin32w/win_event_log/subscribes/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-atomicshop/wrappers/pywin32w/win_event_log/subscribes/subscribe_to_process_create.py,sha256=_rMCTaREi_PJxAPP4gAB0IW9F0XO-suUXLf97tboKSc,5594
+atomicshop/wrappers/pywin32w/win_event_log/subscribes/subscribe_to_process_create.py,sha256=Cviy1n3NSCGswQ4TxAyeDh7d21u8Vt3UOjnLmYYU2fQ,5602
 atomicshop/wrappers/socketw/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 atomicshop/wrappers/socketw/accepter.py,sha256=HQC1EyZmyUtVEfFbaBkHCE-VZp6RWyd9mEqAkgsE1fk,1749
 atomicshop/wrappers/socketw/base.py,sha256=1vvg8EhRGvnxdrRAm1VJSLCXkm2SZDHRjdpTuhkH3Mg,1844
@@ -270,8 +270,8 @@ atomicshop/wrappers/socketw/socket_server_tester.py,sha256=AhpurHJmP2kgzHaUbq5ey
 atomicshop/wrappers/socketw/socket_wrapper.py,sha256=aXBwlEIJhFT0-c4i8iNlFx2It9VpCEpsv--5Oqcpxao,11624
 atomicshop/wrappers/socketw/ssl_base.py,sha256=k4V3gwkbq10MvOH4btU4onLX2GNOsSfUAdcHmL1rpVE,2274
 atomicshop/wrappers/socketw/statistics_csv.py,sha256=t3dtDEfN47CfYVi0CW6Kc2QHTEeZVyYhc57IYYh5nmA,826
-atomicshop-2.14.0.dist-info/LICENSE.txt,sha256=lLU7EYycfYcK2NR_1gfnhnRC8b8ccOTElACYplgZN88,1094
-atomicshop-2.14.0.dist-info/METADATA,sha256=M4vV-yH5er5NVOQJMUtIPqdgh6IHzINAY1frKcRF9oU,10478
-atomicshop-2.14.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
-atomicshop-2.14.0.dist-info/top_level.txt,sha256=EgKJB-7xcrAPeqTRF2laD_Np2gNGYkJkd4OyXqpJphA,11
-atomicshop-2.14.0.dist-info/RECORD,,
+atomicshop-2.14.1.dist-info/LICENSE.txt,sha256=lLU7EYycfYcK2NR_1gfnhnRC8b8ccOTElACYplgZN88,1094
+atomicshop-2.14.1.dist-info/METADATA,sha256=rZNM503plkk4O9jvmeQTuAHA-7JS24mxM3k7bHNo0SA,10478
+atomicshop-2.14.1.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
+atomicshop-2.14.1.dist-info/top_level.txt,sha256=EgKJB-7xcrAPeqTRF2laD_Np2gNGYkJkd4OyXqpJphA,11
+atomicshop-2.14.1.dist-info/RECORD,,