atomicshop 2.14.1__py3-none-any.whl → 2.14.2__py3-none-any.whl

atomicshop/__init__.py

@@ -1,4 +1,4 @@
 """Atomic Basic functions and classes to make developer life easier"""
 
 __author__ = "Den Kras"
-__version__ = '2.14.1'
+__version__ = '2.14.2'

atomicshop/process_poller.py

@@ -5,7 +5,7 @@ from typing import Literal, Union
 from pathlib import Path
 
 from .wrappers.pywin32w import wmi_win32process
-from .wrappers.pywin32w.win_event_log.subscribes import subscribe_to_process_create
+from .wrappers.pywin32w.win_event_log.subscribes import process_create
 from .wrappers.psutilw import psutilw
 from .etws.traces import trace_sysmon_process_creation
 from .basics import dicts
@@ -279,7 +279,7 @@ def _worker(
         processes = GetProcessList(get_method='pywin32', connect_on_init=True).get_processes(as_dict=True)
         process_queue.put(processes)
     elif poller_method == 'event_log':
-        poller_instance = subscribe_to_process_create.ProcessCreateSubscriber()
+        poller_instance = process_create.ProcessCreateSubscriber()
         poller_instance.start()
 
         processes = GetProcessList(get_method='pywin32', connect_on_init=True).get_processes(as_dict=True)
@@ -290,7 +290,6 @@ def _worker(
         processes = {}
 
     exception = None
-    list_of_processes: list = list()
     while running_state:
         try:
             if poller_method == 'sysmon_etw':
@@ -330,8 +329,8 @@ def _worker(
 
             process_queue.put(processes)
 
-            # Since ETW is a blocking operation, we don't need to sleep.
-            if poller_method != 'sysmon_etw':
+            # Since ETW is a blocking operation, we don't need to sleep in tracing pollers [sysmon_etw, event_log].
+            if poller_method not in ['sysmon_etw', 'event_log']:
                 time.sleep(interval_seconds)
         except KeyboardInterrupt as e:
             running_state = False

atomicshop/wrappers/pywin32w/win_event_log/subscribe.py

@@ -4,6 +4,7 @@ import time
 import threading
 import queue
 from typing import Union
+import binascii
 
 
 class EventLogSubscriber:
@@ -20,15 +21,29 @@ class EventLogSubscriber:
             event = event_log_subscriber.emit()
             print(event)
     """
-    def __init__(self, log_channel: str, event_id: int):
+    def __init__(self, log_channel: str, event_id: int = None, provider: str = None):
         """
         :param log_channel: The name of the event log channel to subscribe to. Examples:
             Security, System, Application, etc.
         :param event_id: The ID of the event to subscribe to.
             Example: 4688 for process creation events in "Security" channel.
+            You can only subscribe by event ID or provider, not both.
+        :param provider: The name of the provider to subscribe to.
+            You can only subscribe by event ID or provider, not both.
         """
+
+        if event_id is None and provider is None:
+            raise ValueError("You must specify either an event ID or provider name to subscribe to.")
+        elif event_id and provider:
+            raise ValueError("You can only subscribe by event ID or provider, not both.")
+
         self.log_channel: str = log_channel
-        self.event_id: str = str(event_id)
+        self.provider: str = provider
+
+        if event_id:
+            self.event_id: str = str(event_id)
+        else:
+            self.event_id = event_id
 
         self._event_queue = queue.Queue()
         self._subscription_thread = None
@@ -36,7 +51,7 @@ class EventLogSubscriber:
     def start(self):
         """Start the subscription process."""
         self._subscription_thread = threading.Thread(
-            target=start_subscription, args=(self.log_channel, self.event_id, self._event_queue)
+            target=start_subscription, args=(self.log_channel, self._event_queue, self.event_id, self.provider)
         )
         self._subscription_thread.daemon = True
         self._subscription_thread.start()
@@ -64,51 +79,83 @@ class EventLogSubscriber:
 def _parse_event_xml(event_xml):
     root = Et.fromstring(event_xml)
     data = {}
+
+    # Helper function to strip namespace
+    def strip_namespace(tag):
+        return tag.split('}')[-1]  # Remove namespace
+
+    # Iterate over all elements
     for elem in root.iter():
-        if 'Name' in elem.attrib:
-            data[elem.attrib['Name']] = elem.text
+        # Extract elements with text content
+        if elem.text and elem.text.strip():
+            tag = elem.tag.split('}')[-1]  # Remove namespace
+            data[tag] = elem.text.strip()
+
+        # Extract elements with attributes
+        for attr_name, attr_value in elem.attrib.items():
+            tag = elem.tag.split('}')[-1]  # Remove namespace
+            data[f"{tag}_{attr_name}"] = attr_value
+
+        # Handle Binary data
+        if elem.tag.split('}')[-1] == 'Binary':
+            try:
+                data['BinaryReadable'] = binascii.unhexlify(elem.text.strip())
+            except (TypeError, binascii.Error) as e:
+                print(f"Error decoding binary data: {e}")
+                data['BinaryReadable'] = elem.text.strip()
+
+    # Extract system-specific data
+    system_data = root.find(".//{http://schemas.microsoft.com/win/2004/08/events/event}System")
+    if system_data is not None:
+        for system_elem in system_data:
+            tag = strip_namespace(system_elem.tag)
+            if system_elem.attrib:
+                for attr_name, attr_value in system_elem.attrib.items():
+                    data[f"{tag}_{attr_name}"] = attr_value
+            if system_elem.text and system_elem.text.strip():
+                data[tag] = system_elem.text.strip()
+
+    # Extract event-specific data
+    event_data = root.find(".//{http://schemas.microsoft.com/win/2004/08/events/event}EventData")
+    if event_data is not None:
+        for data_elem in event_data:
+            if strip_namespace(data_elem.tag) == 'Data' and 'Name' in data_elem.attrib:
+                data[data_elem.attrib['Name']] = data_elem.text.strip()
+
+    # Extract user data if available
+    user_data = root.find(".//{http://schemas.microsoft.com/win/2004/08/events/event}UserData")
+    if user_data is not None:
+        for user_elem in user_data:
+            tag = strip_namespace(user_elem.tag)
+            if user_elem.attrib:
+                for attr_name, attr_value in user_elem.attrib.items():
+                    data[f"{tag}_{attr_name}"] = attr_value
+            if user_elem.text and user_elem.text.strip():
+                data[tag] = user_elem.text.strip()
+
+    # Extract rendering info (additional details like the message)
+    rendering_info = root.find(".//{http://schemas.microsoft.com/win/2004/08/events/event}RenderingInfo")
+    if rendering_info is not None:
+        for info_elem in rendering_info:
+            tag = strip_namespace(info_elem.tag)
+            if info_elem.text and info_elem.text.strip():
+                data[f"RenderingInfo_{tag}"] = info_elem.text.strip()
+
     return data
 
 
 def _handle_event(event, event_queue):
+    # Render event as XML
     event_xml = win32evtlog.EvtRender(event, win32evtlog.EvtRenderEventXml)
+    data = None
     try:
         data = _parse_event_xml(event_xml)
     except Et.ParseError as e:
         print(f"Error parsing event XML: {e}")
-        return
-
-    event_dict: dict = {
-        'user_sid': data.get("SubjectUserSid", "Unknown"),
-        'user_name': data.get("SubjectUserName", "Unknown"),
-        'domain': data.get("SubjectDomainName", "Unknown"),
-        'pid_hex': data.get("NewProcessId", "0"),
-        'process_name': data.get("NewProcessName", "Unknown"),
-        'command_line': data.get("CommandLine", None),
-        'parent_pid_hex': data.get("ProcessId", "0"),
-        'parent_process_name': data.get("ParentProcessName", "Unknown")
-    }
-
-    try:
-        process_id = int(event_dict['pid_hex'], 16)
-    except ValueError:
-        process_id = "Unknown"
+    except Exception as e:
+        print(f"Error getting rendered message: {e}")
 
-    try:
-        parent_pid = int(event_dict['parent_pid_hex'], 16)
-    except ValueError:
-        parent_pid = "Unknown"
-
-    event_dict['pid'] = process_id
-    event_dict['parent_pid'] = parent_pid
-
-    # if user_sid != "Unknown":
-    #     try:
-    #         user_name, domain, type = win32security.LookupAccountSid(None, user_sid)
-    #     except Exception as e:
-    #         print(f"Error looking up account SID: {e}")
-
-    event_queue.put(event_dict)
+    event_queue.put(data)
 
 
 def _event_callback(action, context, event):
@@ -117,25 +164,43 @@ def _event_callback(action, context, event):
         _handle_event(event, event_queue)
 
 
-def start_subscription(log_channel: str, event_id: int, event_queue):
+def start_subscription(
+        log_channel: str,
+        event_queue,
+        event_id: str = None,
+        provider: str = None
+):
     """
     Start listening for events in the specified log channel with the given event ID.
 
     :param log_channel: The name of the event log channel to subscribe to. Examples:
         Security, System, Application, etc.
+    :param event_queue: A queue to store the received events
     :param event_id: The ID of the event to subscribe to.
         Example: 4688 for process creation events in "Security" channel.
-    :param event_queue: A queue to store the received events
+        You can only subscribe by event ID or provider, not both.
+    :param provider: The name of the provider to subscribe to.
+        You can only subscribe by event ID or provider, not both.
     """
+
+    if event_id is None and provider is None:
+        raise ValueError("You must specify either an event ID or provider name to subscribe to.")
+    elif event_id and provider:
+        raise ValueError("You can only subscribe by event ID or provider, not both.")
+
     # This selects the System node within each event.
     # The System node contains metadata about the event, such as the event ID, provider name, timestamp, and more.
-    query = f"*[System/EventID={str(event_id)}]"
+    xpath_query = None
+    if provider:
+        xpath_query = f"*[System/Provider[@Name='{provider}']]"
+    elif event_id:
+        xpath_query = f"*[System/EventID={event_id}]"
 
     subscription = win32evtlog.EvtSubscribe(
         log_channel,
         win32evtlog.EvtSubscribeToFutureEvents,
         SignalEvent=None,
-        Query=query,
+        Query=xpath_query,
         Callback=_event_callback,
         Context={'event_queue': event_queue}
     )

atomicshop/wrappers/pywin32w/win_event_log/subscribes/{subscribe_to_process_create.py → process_create.py}

@@ -7,6 +7,8 @@ from .....print_api import print_api
 
 AUDITING_REG_PATH: str = r"Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit"
 PROCESS_CREATION_INCLUDE_CMDLINE_VALUE: str = "ProcessCreationIncludeCmdLine_Enabled"
+LOG_CHANNEL: str = 'Security'
+EVENT_ID: int = 4688
 
 
 class ProcessCreateSubscriber(subscribe.EventLogSubscriber):
@@ -14,9 +16,9 @@ class ProcessCreateSubscriber(subscribe.EventLogSubscriber):
     Class for subscribing to Windows Event Log events related to process creation.
 
     Usage:
-        from atomicshop.wrappers.pywin32w.win_event_log.subscribes import subscribe_to_process_create
+        from atomicshop.wrappers.pywin32w.win_event_log.subscribes import process_create
 
-        process_create_subscriber = subscribe_to_process_create.ProcessCreateSubscriber()
+        process_create_subscriber = process_create.ProcessCreateSubscriber()
         process_create_subscriber.start()
 
         while True:
@@ -24,7 +26,7 @@ class ProcessCreateSubscriber(subscribe.EventLogSubscriber):
             print(event)
     """
     def __init__(self):
-        super().__init__('Security', 4688)
+        super().__init__(log_channel=LOG_CHANNEL, event_id=EVENT_ID)
 
     def start(self):
         """Start the subscription process."""
@@ -45,7 +47,40 @@ class ProcessCreateSubscriber(subscribe.EventLogSubscriber):
             If None, the function will block until an event is available.
         :return: A dictionary containing the event data.
         """
-        return super().emit(timeout=timeout)
+
+        data = super().emit(timeout=timeout)
+
+        event_dict: dict = {
+            'user_sid': data.get("SubjectUserSid", "Unknown"),
+            'user_name': data.get("SubjectUserName", "Unknown"),
+            'domain': data.get("SubjectDomainName", "Unknown"),
+            'pid_hex': data.get("NewProcessId", "0"),
+            'process_name': data.get("NewProcessName", "Unknown"),
+            'command_line': data.get("CommandLine", None),
+            'parent_pid_hex': data.get("ProcessId", "0"),
+            'parent_process_name': data.get("ParentProcessName", "Unknown")
+        }
+
+        try:
+            process_id = int(event_dict['pid_hex'], 16)
+        except ValueError:
+            process_id = "Unknown"
+
+        try:
+            parent_pid = int(event_dict['parent_pid_hex'], 16)
+        except ValueError:
+            parent_pid = "Unknown"
+
+        event_dict['pid'] = process_id
+        event_dict['parent_pid'] = parent_pid
+
+        # if user_sid != "Unknown":
+        #     try:
+        #         user_name, domain, type = win32security.LookupAccountSid(None, user_sid)
+        #     except Exception as e:
+        #         print(f"Error looking up account SID: {e}")
+
+        return event_dict
 
 
 def enable_audit_process_creation(print_kwargs: dict = None):

atomicshop/wrappers/pywin32w/win_event_log/subscribes/schannel_logging.py

@@ -0,0 +1,97 @@
+import winreg
+import sys
+
+from .. import subscribe
+from .....print_api import print_api
+
+
+SCHANNEL_LOGGING_REG_PATH: str = r'SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL'
+SCHANNEL_EVENT_LOGGING_KEY: str = 'EventLogging'
+LOG_CHANNEL: str = 'System'
+PROVIDER: str = 'Schannel'
+
+
+class SchannelLoggingSubscriber(subscribe.EventLogSubscriber):
+    """
+    Class for subscribing to Windows Event Log events related to process creation.
+
+    Usage:
+        from atomicshop.wrappers.pywin32w.win_event_log.subscribes import schannel_logging
+
+        process_create_subscriber = schannel_logging.SchannelLoggingSubscriber()
+        process_create_subscriber.start()
+
+        while True:
+            event = process_create_subscriber.emit()
+            print(event)
+    """
+    def __init__(self):
+        super().__init__(log_channel=LOG_CHANNEL, provider=PROVIDER)
+
+    def start(self):
+        """Start the subscription process."""
+        enable_schannel_logging()
+
+        super().start()
+
+    def stop(self):
+        """Stop the subscription process."""
+        super().stop()
+
+    def emit(self, timeout: float = None) -> dict:
+        """
+        Get the next event from the event queue.
+
+        :param timeout: The maximum time (in seconds) to wait for an event.
+            If None, the function will block until an event is available.
+        :return: A dictionary containing the event data.
+        """
+        return super().emit(timeout=timeout)
+
+
+def enable_schannel_logging(logging_value: int = 1, print_kwargs: dict = None):
+    """
+    Value 	Description
+    0x0000 	Do not log
+    0x0001 	Log error messages
+    0x0002 	Log warnings
+    0x0003 	Log warnings and error messages
+    0x0004 	Log informational and success events
+    0x0005 	Log informational, success events and error messages
+    0x0006 	Log informational, success events and warnings
+    0x0007 	Log informational, success events, warnings, and error messages (all log levels)
+    """
+
+    if is_schannel_logging_enabled(logging_value):
+        print_api(
+            "Schannel event logging is already enabled.", color='yellow',
+            **(print_kwargs or {}))
+        return
+
+    try:
+        with winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, SCHANNEL_LOGGING_REG_PATH, 0, winreg.KEY_ALL_ACCESS) as key:
+            winreg.SetValueEx(key, SCHANNEL_EVENT_LOGGING_KEY, 0, winreg.REG_DWORD, logging_value)
+
+        print_api(
+            "Successfully enabled Schannel logging.",
+            color='green', **(print_kwargs or {}))
+        print_api(
+            "Please restart the computer for the changes to take effect.",
+            color='yellow', **(print_kwargs or {}))
+        sys.exit()
+    except WindowsError as e:
+        print_api(
+            f"Failed to enable Schannel event logging: {e}", error_type=True,
+            color='red', **(print_kwargs or {}))
+
+
+def is_schannel_logging_enabled(logging_value: int) -> bool:
+    try:
+        with winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, SCHANNEL_LOGGING_REG_PATH, 0, winreg.KEY_READ) as key:
+            value, regtype = winreg.QueryValueEx(key, SCHANNEL_EVENT_LOGGING_KEY)
+            return value == logging_value
+    except FileNotFoundError:
+        return False
+    except WindowsError as e:
+        print(f"Failed to read the Schannel event logging setting: {e}")
+        return False

{atomicshop-2.14.1.dist-info → atomicshop-2.14.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: atomicshop
-Version: 2.14.1
+Version: 2.14.2
 Summary: Atomic functions and classes to make developer life easier
 Author: Denis Kras
 License: MIT License

{atomicshop-2.14.1.dist-info → atomicshop-2.14.2.dist-info}/RECORD

@@ -1,4 +1,4 @@
-atomicshop/__init__.py,sha256=w-I1vM1vpc9PJDvoRTt804j2SwPM8mjp6n5FOtCdutg,123
+atomicshop/__init__.py,sha256=z4rThLLSu1i3Wlh2xQO9kTZiAnom3boVcidQ2m4F8V0,123
 atomicshop/_basics_temp.py,sha256=6cu2dd6r2dLrd1BRNcVDKTHlsHs_26Gpw8QS6v32lQ0,3699
 atomicshop/_create_pdf_demo.py,sha256=Yi-PGZuMg0RKvQmLqVeLIZYadqEZwUm-4A9JxBl_vYA,3713
 atomicshop/_patch_import.py,sha256=ENp55sKVJ0e6-4lBvZnpz9PQCt3Otbur7F6aXDlyje4,6334
@@ -27,7 +27,7 @@ atomicshop/permissions.py,sha256=P6tiUKV-Gw-c3ePEVsst9bqWaHJbB4ZlJB4xbDYVpEs,443
 atomicshop/print_api.py,sha256=DhbCQd0MWZZ5GYEk4oTu1opRFC-b31g1VWZgTGewG2Y,11568
 atomicshop/process.py,sha256=R1BtXWjG2g2Q3WlsyhbIlXZz0UkQeagY7fQyBOIX_DM,15951
 atomicshop/process_name_cmd.py,sha256=CtaSp3mgxxJKCCVW8BLx6BJNx4giCklU_T7USiCEwfc,5162
-atomicshop/process_poller.py,sha256=B91ugFIo84IMFXbWJeW8P7TsIkzYxMXBVWuvYqRXS-c,16107
+atomicshop/process_poller.py,sha256=17sc332AcTfSVPorjYsgRwNm75rLCqvpOQsieMwLMKU,16105
 atomicshop/python_file_patcher.py,sha256=kd3rBWvTcosLEk-7TycNdfKW9fZbe161iVwmH4niUo0,5515
 atomicshop/python_functions.py,sha256=zJg4ogUwECxrDD7xdDN5JikIUctITM5lsyabr_ZNsRw,4435
 atomicshop/question_answer_engine.py,sha256=DuOn7QEgKKfqZu2cR8mVeFIfFgayfBHiW-jY2VPq_Fo,841
@@ -251,9 +251,10 @@ atomicshop/wrappers/pywin32w/console.py,sha256=LstHajPLgXp9qQxFNR44QfH10nOnNp3bC
 atomicshop/wrappers/pywin32w/winshell.py,sha256=i2bKiMldPU7_azsD5xGQDdMwjaM7suKJd3k0Szmcs6c,723
 atomicshop/wrappers/pywin32w/wmi_win32process.py,sha256=qMzXtJ5hBZ5ydAyqpDbSx0nO2RJQL95HdmV5SzNKMhk,6826
 atomicshop/wrappers/pywin32w/win_event_log/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-atomicshop/wrappers/pywin32w/win_event_log/subscribe.py,sha256=UztWltQPK_fQ3EWyY6tGfhAqwxDjK7RVIAZppu97rKI,5104
+atomicshop/wrappers/pywin32w/win_event_log/subscribe.py,sha256=a0SqjtUfo-fVR5jlsoygFlDrjHelOKgCBvia3suyzW8,8217
 atomicshop/wrappers/pywin32w/win_event_log/subscribes/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-atomicshop/wrappers/pywin32w/win_event_log/subscribes/subscribe_to_process_create.py,sha256=Cviy1n3NSCGswQ4TxAyeDh7d21u8Vt3UOjnLmYYU2fQ,5602
+atomicshop/wrappers/pywin32w/win_event_log/subscribes/process_create.py,sha256=_no1MnXjhLgOi9Y7xc7HHgTe6sjZkHIIhcVCd5BKZgM,6865
+atomicshop/wrappers/pywin32w/win_event_log/subscribes/schannel_logging.py,sha256=8nxIcNcbeEuvoBwhujgh7-oIpL9A6J-gg1NM8hOGAVA,3442
 atomicshop/wrappers/socketw/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 atomicshop/wrappers/socketw/accepter.py,sha256=HQC1EyZmyUtVEfFbaBkHCE-VZp6RWyd9mEqAkgsE1fk,1749
 atomicshop/wrappers/socketw/base.py,sha256=1vvg8EhRGvnxdrRAm1VJSLCXkm2SZDHRjdpTuhkH3Mg,1844
@@ -270,8 +271,8 @@ atomicshop/wrappers/socketw/socket_server_tester.py,sha256=AhpurHJmP2kgzHaUbq5ey
 atomicshop/wrappers/socketw/socket_wrapper.py,sha256=aXBwlEIJhFT0-c4i8iNlFx2It9VpCEpsv--5Oqcpxao,11624
 atomicshop/wrappers/socketw/ssl_base.py,sha256=k4V3gwkbq10MvOH4btU4onLX2GNOsSfUAdcHmL1rpVE,2274
 atomicshop/wrappers/socketw/statistics_csv.py,sha256=t3dtDEfN47CfYVi0CW6Kc2QHTEeZVyYhc57IYYh5nmA,826
-atomicshop-2.14.1.dist-info/LICENSE.txt,sha256=lLU7EYycfYcK2NR_1gfnhnRC8b8ccOTElACYplgZN88,1094
-atomicshop-2.14.1.dist-info/METADATA,sha256=rZNM503plkk4O9jvmeQTuAHA-7JS24mxM3k7bHNo0SA,10478
-atomicshop-2.14.1.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
-atomicshop-2.14.1.dist-info/top_level.txt,sha256=EgKJB-7xcrAPeqTRF2laD_Np2gNGYkJkd4OyXqpJphA,11
-atomicshop-2.14.1.dist-info/RECORD,,
+atomicshop-2.14.2.dist-info/LICENSE.txt,sha256=lLU7EYycfYcK2NR_1gfnhnRC8b8ccOTElACYplgZN88,1094
+atomicshop-2.14.2.dist-info/METADATA,sha256=VIgp-Go_u3KNgCb_tRAE6XcD9IyNa2lHdn0C2WFmscY,10478
+atomicshop-2.14.2.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
+atomicshop-2.14.2.dist-info/top_level.txt,sha256=EgKJB-7xcrAPeqTRF2laD_Np2gNGYkJkd4OyXqpJphA,11
+atomicshop-2.14.2.dist-info/RECORD,,