Skip to content

Commit a812245

Browse files
bitranoxbitranox
committed
map HKCR Keys to HKCU\Software\Classes to find it in procmon logfiles
1 parent c03b992 commit a812245

File tree

1 file changed

+95
-5
lines changed

1 file changed

+95
-5
lines changed

‎lib_filter_procmon.py

+95-5
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,93 @@ def create_procmon_diff(self):
4444
self.create_filtered_procmon_csv(hashed_dict_files=hashed_dict_files, hashed_dict_reg=hashed_dict_reg)
4545
self.create_filtered_fingerprints(hashed_dict_files=hashed_dict_files, hashed_dict_reg=hashed_dict_reg)
4646

47+
@staticmethod
48+
def is_registry_dict(dict_data:{})->bool:
49+
if 'value_name' in dict_data:
50+
return True
51+
else:
52+
return False
53+
54+
@staticmethod
55+
def add_map_hkcr_to_hkcu_software_classes(dict_key:str, hashed_dict:{}, dict_data:{}):
56+
# https://docs.microsoft.com/en-us/windows/desktop/sysinfo/hkey-classes-root-key
57+
if dict_key.startswith('HKCR\\'):
58+
dict_key_mapped = 'HKCU\\Software\\Classes' + dict_key.split('_Classes',1)[1]
59+
if dict_key_mapped not in hashed_dict:
60+
hashed_dict[dict_key_mapped] = dict_data.copy()
61+
62+
@staticmethod
63+
def add_map_hku_to_hkcu(dict_key:str, hashed_dict:{}, dict_data:{}):
64+
"""
65+
:param dict_key:
66+
:param hashed_dict:
67+
:param dict_data:
68+
:return:
69+
70+
>>> hashed_dict={}
71+
>>> procmon_diff = ProcmonDiff(fingerprint_result_dir='c:/fingerprint', procmon_csv='procmon-logfile.CSV', fingerprint_reg_csv='test_registry.csv', fingerprint_file_csv='test_c_files.csv')
72+
>>> dict_key = "HKU\"
73+
>>> procmon_diff.add_map_hku_to_hkcu(dict_key=dict_key, hashed_dict=hashed_dict, dict_data={'test':'test'} )
74+
>>> hashed_dict
75+
{}
76+
>>> dict_key = "HKU\.DEFAULT"
77+
>>> procmon_diff.add_map_hku_to_hkcu(dict_key=dict_key, hashed_dict=hashed_dict, dict_data={'test':'test'} )
78+
>>> hashed_dict
79+
{}
80+
>>> dict_key = "HKU\.DEFAULT\SYSTEM"
81+
>>> procmon_diff.add_map_hku_to_hkcu(dict_key=dict_key, hashed_dict=hashed_dict, dict_data={'test':'test'} )
82+
>>> hashed_dict
83+
{'HKCU\\\\SYSTEM': {'test': 'test'}}
84+
>>> hashed_dict={}
85+
>>> dict_key = "HKU\S-1-5-18\Control Panel\Accessibility\SoundSentry"
86+
>>> procmon_diff.add_map_hku_to_hkcu(dict_key=dict_key, hashed_dict=hashed_dict, dict_data={'test':'test'} )
87+
>>> hashed_dict
88+
{'HKCU\\\\Control Panel\\\\Accessibility\\\\SoundSentry': {'test': 'test'}}
89+
>>> hashed_dict={}
90+
>>> dict_key = "HKU\S-1-5-19\Console"
91+
>>> procmon_diff.add_map_hku_to_hkcu(dict_key=dict_key, hashed_dict=hashed_dict, dict_data={'test':'test'} )
92+
>>> hashed_dict
93+
{'HKCU\\\\Console': {'test': 'test'}}
94+
95+
>>> hashed_dict={}
96+
>>> dict_key = "HKU\S-1-5-18\"
97+
>>> procmon_diff.add_map_hku_to_hkcu(dict_key=dict_key, hashed_dict=hashed_dict, dict_data={'test':'test'} )
98+
>>> hashed_dict
99+
{}
100+
>>> hashed_dict={}
101+
>>> dict_key = "HKU\S-1-5-21-1580759954-1968686491-2999850105-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\PrivacIE:"
102+
>>> procmon_diff.add_map_hku_to_hkcu(dict_key=dict_key, hashed_dict=hashed_dict, dict_data={'test':'test'} )
103+
>>> hashed_dict
104+
{'HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet Settings\\x05.0\\\\LowCache\\\\Extensible Cache\\\\PrivacIE:': {'test': 'test'}}
105+
106+
>>> hashed_dict={}
107+
>>> dict_key = "HKU\S-1-5-21-1580759954-1968686491-2999850105-1000_Classes\S-1-5-21-1580759954-1968686491-2999850105-1000_Classes\Wow6432Node"
108+
>>> procmon_diff.add_map_hku_to_hkcu(dict_key=dict_key, hashed_dict=hashed_dict, dict_data={'test':'test'} )
109+
>>> hashed_dict
110+
{'HKCU\\\\Software\\\\Classes\\\\Wow6432Node': {'test': 'test'}}
111+
112+
"""
113+
if dict_key.startswith('HKU\\'):
114+
if dict_key.startswith('HKU\\.DEFAULT'): # MAP HKU\\.DEFAULT\\* --> HKCU\\*
115+
l_key_parts = dict_key.split('\\.DEFAULT',1)
116+
if l_key_parts[1]:
117+
dict_key_mapped = 'HKCU' + dict_key.split('\\.DEFAULT')[1]
118+
if dict_key_mapped not in hashed_dict:
119+
hashed_dict[dict_key_mapped] = dict_data.copy()
120+
else:
121+
l_key_parts:[str] = [key_part for key_part in dict_key.split('\\',3) if key_part]
122+
if l_key_parts[1].endswith('_Classes'):
123+
if len(l_key_parts) > 3:
124+
dict_key_mapped = 'HKCU\\Software\\Classes\\' + l_key_parts[3]
125+
if dict_key_mapped not in hashed_dict:
126+
hashed_dict[dict_key_mapped] = dict_data.copy()
127+
else:
128+
if len(l_key_parts) > 2:
129+
dict_key_mapped = '\\'.join(['HKCU'] + l_key_parts[2:])
130+
if dict_key_mapped not in hashed_dict:
131+
hashed_dict[dict_key_mapped] = dict_data.copy()
132+
133+
47134
def get_hashed_dict_fingerprint(self, fingerprint_csv:str)->{}:
48135
"""
49136
:return:
@@ -62,14 +149,17 @@ def get_hashed_dict_fingerprint(self, fingerprint_csv:str)->{}:
62149
with open(fingerprint_reg_fullpath, newline='', encoding='utf-8-sig') as csvfile:
63150
csv_reader = csv.DictReader(csvfile, dialect='excel')
64151
for dict_data in csv_reader:
65-
if 'value_name' in dict_data:
152+
if self.is_registry_dict(dict_data):
66153
if dict_data['value_name']: # avoid trailing '\\'
67154
dict_key:str = '\\'.join([dict_data['path'], dict_data['value_name']])
68155
else:
69156
dict_key: str = dict_data['path']
157+
self.add_map_hkcr_to_hkcu_software_classes(dict_key, hashed_dict, dict_data) # add to dict entry with HKCR\... mapped to HKCU\\Software\\Classes
158+
self.add_map_hku_to_hkcu(dict_key, hashed_dict, dict_data) # add to dict entry with HKU\... mapped to HKCU\\.. or HKCU\\Software\\Classes\\...
70159
else:
71160
dict_key: str = dict_data['path']
72-
hashed_dict[dict_key] = dict_data.copy()
161+
if dict_key not in hashed_dict:
162+
hashed_dict[dict_key] = dict_data.copy()
73163
return hashed_dict
74164

75165
def get_set_paths_procmon_accessed(self)->set:
@@ -83,9 +173,9 @@ def get_set_paths_procmon_accessed(self)->set:
83173

84174
def create_filtered_procmon_csv(self, hashed_dict_reg:{}, hashed_dict_files:{}):
85175
"""
86-
>>> procmon_diff = ProcmonDiff(fingerprint_result_dir='c:/fingerprint', procmon_csv='procmon-logfile.CSV', fingerprint_reg_name='test_registry.csv', fingerprint_files_name='test_c_files.csv')
87-
>>> hashed_dict_reg = procmon_diff.get_hashed_dict_fingerprint(fingerprint_csv=self.fingerprint_reg_csv)
88-
>>> hashed_dict_files = procmon_diff.get_hashed_dict_fingerprint(fingerprint_csv=self.fingerprint_file_csv)
176+
>>> procmon_diff = ProcmonDiff(fingerprint_result_dir='c:/fingerprint', procmon_csv='procmon-logfile.CSV', fingerprint_reg_csv='test_registry.csv', fingerprint_file_csv='test_c_files.csv')
177+
>>> hashed_dict_reg = procmon_diff.get_hashed_dict_fingerprint(fingerprint_csv='test_registry.csv')
178+
>>> hashed_dict_files = procmon_diff.get_hashed_dict_fingerprint(fingerprint_csv='test_c_files.csv')
89179
>>> procmon_diff.create_filtered_procmon_csv(hashed_dict_reg=hashed_dict_reg, hashed_dict_files=hashed_dict_files)
90180
91181
"""

0 commit comments

Comments
 (0)