PROCSCAN
Procscan is a quick and dirty python script used to look for potentially dangerous api call patterns in a Procmon PML file.
Installation
git clone https://github.com/bananabr/procscan.git
cd procscan
python3 -m pip install -r requirements.txt
Usage
usage: procscan.py [-h] [--log LOG] [--verbose] --pml PML --ac AC
optional arguments:
-h, --help show this help message and exit
--log LOG log file path
--verbose, -v increase verbosity
--pml PML procscan PML file
--ac AC accesschk output file
Todo
- (Registry symbolic link patterns)
- (Filesystem symbolic link patterns)
- (DLL hijack)
- (Writable DLL loaded by privileged process)
- (Writable PE loaded by privileged process)
14 Feb 20, 2022
95 Dec 21, 2022
24 Sep 20, 2022
5.9k Dec 31, 2022
1 Jan 10, 2022
85 Dec 09, 2022
34 Dec 11, 2022
36 Nov 10, 2022
767 Dec 16, 2022
1 Dec 10, 2022
3 Dec 12, 2021
134 Dec 30, 2022
3 Jan 09, 2022
1 Nov 17, 2021
1 Oct 21, 2022
10 Nov 28, 2021
16 Dec 13, 2021
155 Dec 28, 2022
2 Jan 02, 2022
96 Jan 02, 2023