[Autogenerated] once all of these are installed,
we will next move into our demonstration environment.
Since this is a module where we will need to walk
through a good amount of python code.
We will be cutting this initial section short and moving
into an extended demonstration section.
So now let's move into the demonstration environment and in this case
we're going to move a little bit faster because there's a lot of
script to go over and not a lot of time.
So we're going to begin by importing three different modules.
In this case we are going back to using the PS Util module specifically looking
at the process lists that it returns as well as the cysts and the p p print
modules both for the control of the script and to print out stuff in a prettier
way that it's easy to take a look at.
And the first thing we're going to look at is we're going to look at
this little function that we created just called.
Create Process list and the name is pretty self explanatory.
We use the process underscore iter method of the PS util module
and we form a list out of the return results.
In this case, that list is going to include the process I D.
And the name.
So the result of this is going to be a list of the
processes that exist on this system.
So if we move down through here,
we're going to see we have a number of different functions and
we're going to look at them individually.
The script itself will start here with the if name
and that runs the main function.
And the first thing that we're going to show here is this little
part where we're just going to display what the results are of
the create process list function.
So if we run this as it is,
this is going to return process list that's going to look very
familiar from what we saw in one of the earlier modules as it is
just a raw list of all of the processes that are currently being
used on this specific system.
In this case,
the only thing that we're returning is a more limited set
of information from the process Util, there are the PS util module.
So this is why we move a little bit further in this module.
Let me just get rid of this top part of the code here.
And we're going to walk through this starting with this
little section of the code and in this case,
what we're going to be doing is we're going to be creating a
dictionary and this dictionary is going to be a nested list of
all of the processes on the system in order that's nested in the
way that they were called.
So if process one,
called process to then two would be on the second tier of the dictionary.
If process to called Process three,
then that third process would be on the third tier of the dictionary and so on.
How we do this is initially we will see that we return that create process list,
output that we showed earlier here and we're going to bank that into
another function which is the generate process dict function.
And as you would imagine that just generates the process dictionary.
So if we move up into that function, this function is actually shown here.
So we move in,
we we start up with a new variable called processes and then we move into
a for loop So for each of the different items that exist in that process
list that we are pushing into this function,
we're going to perform all these additional commands.
So in this case the first thing we're going to do is
we're gonna exclude process I.
D0 which is the root process for everything on windows that just
sort of needs things up because most of the time,
whenever you're looking for processes that are doing something the suspect
you're not talking about the route process because if the root processes doing
something bad then you have a bigger problem next.
If the P I.
D.
Exists in that table.
And the reason that we put this little if in here is while this is
processing and it's running through this for loop it is possible
obviously the system is ongoing and doing its thing in the background
while I'm creating this new dictionary.
And if one of those processes happens to be terminated in the time
between we ran that initial process list command and the time this
iterator into that list while it's creating if one of those was
terminated and we didn't have this line in here,
then this would raise an exception that we would have to handle in this case.
We prevent that from happening by putting this here
and ensuring that whatever P.
I.
D.
That exists inside that is existing.
If it doesn't, it'll just walk over it.
The next thing to start is we're going to say,
what we want to do is we want to find all of the different
processes that currently don't have any parents.
So if there are any processes in this process list as of
right this second that have parents, then they aren't root processes or not.
Secondary root processes, they would be Children of other processes.
So for the purposes of this part of the module,
what we're going to be doing is creating a list of the main parents
of all the processes that exist on this system.
So that's why we're saying,
I just want a list of the processes that don't have any
parents and then we move on again.
And if we have somebody who's doesn't have any parents
and also doesn't have any Children,
then we don't need to move any further into that process tree,
because there is no process tree.
It's in and of itself it's its own process.
It doesn't have any parents and it doesn't have any Children that's normal
for a number of different processes on a Windows system,
but there's a couple of them that exists like that and then for everybody else.
So the normal like the chrome's and the codes and all the different
normal processes that run that would be caught here.
And what we do here is we are starting to build with
these last two little code segments here,
the dictionary that we're talking about where we say
processes and we have the P I.
D.
Being put in as the key or the index and then the P and then the lin this piece
of it is being put in as the value of that specific entry.
And what you'll notice here at the end here is that we are putting an
additional dictionary or an empty dictionary right here at the end of
that first tier part of the dictionary.
And that's saying, I know you have Children.
So we're going to put one here as a placeholder and we'll use that in a minute.
Next what we do is we set the parent process that we're talking about now.
So this would be one of the processes that has Children.
And it's also a parent process.
I mean, primary parent process, we're setting the two different iterations.
And then what we're doing is we're going to call
another function which is right here.
This is a recursive function that will automatically call itself.
However many times it needs to in order to build out
that process list from the parent down.
So if it sees Children on Children and Children have spawned other Children,
it will walk through that whole different process tree
and create that dictionary for us.
And it does this recursive lee for each one of those
process those parent processes that we are four looping
through in the primary function here.
We're not going to walk through that logic because
it's a little cross the icy stuff.
But trust that this is going to return a list of nested processes.
So at this point, once it runs through all those different iterations,
you're going to have one primary dictionary that exists that's going to
return as we've noted here into the this dictionary variable and we're going
to take a look at just that variable with this line,
the P P P print line now,
depending on how many processes are running on the
target system and how fast it is,
etc this could take a couple seconds to complete.
Now if we see if we go up through this thing,
you'll see all of these different processes that we
had printed out on the initial list,
but they're in this little nested architecture that we it's
pretty obvious who called who and if anybody is familiar with
the process manager or process monitor application that is
released by Microsoft these days, uh it looks something similar to this,
we'll see that the first one is 4 80 it's one of those processes
that it's apparent and it's also a childless one.
So it only has itself.
But if we look at this second one We'll see the process i.
556 which in this case is winning it.
It has three different direct Children.
And the first one of those direct Children is the 700 P.
I.
D.
Which is services.
And that services has 74 different Children under it,
starting with 446 and then so on.
These are all third tier Children.
Under 700 under 556.
And then if we walk down this line we'll see there's another four tear
off this third tier 8 44 process which is the S.
V.
C.
Host.
We have 16 additional processes that are spawned off of that one.
And these are just some of the ones that are there,
including the photos and runtime broker and the search app and so on.
All of these are run on top of the 8 44 parents.
On top of the 700 parents.
And on top of the 556 parents.
So it's pretty clear visually who's spawning who?
So why is this important?
From a security standpoint if you're trying to figure out if any one
of the services on your target machine or machines are running
processes that are one unexpected or two spawning processes that are
unexpected and or they're not supposed to be running processes or
spawning them in this way.
A quick visual list of these processes that are running on a
system is one of the ways that you can view what's going on on a
system live at that point in time.
So if you could use something similar to this and of course you can further
parses command and we're going to show that in a later module,
if we're focused on a specific process and what it's doing,
we can walk down through all of these,
we know that each one of these processes where they are,
what they're named, what their current state is.
If they spawned any Children and who their parents all were.
So like in this case, if we look which were just running through these,
we'll see that Explorer was the parent of code and then code
spawned off each one of these different processes.
So in this case I ran the script inside a terminal running inside visual code.
So what we're actually looking at right here is this process right here,
which is Python being run inside a power shell script,
which its parents was spawned by this process,
which was a code process which was from here,
which the parent was here.
So you can sort of walk through each one of these and how each one of the
processes stacked up in what the spawn orders were now.
In this case, these are processes that we know about.
But if we were trying to focus or figure out if there was a process
doing that that we didn't know about or we were not sure about who
it was or where it was coming from.
You could use something like this in your security duties.
Now if we back out here,
the last two functions that I added to the script were the
total processes and parent processes,
functions that return a simple number what the total
counterweights in the dictionary And the second one here is the
parent processes and this will get the total parent process
count as referenced in that dictionary.
And both of these rely on that dictionary that we're reviewing.
But if we take And um comment those out and run this now real quick.
Just focus on this.
We're going to take a look at this parent process.
We're gonna look at the process idea of 56-92.
Now that that's completed that first total count number is coming
here where we printed it out a little bit nicer.
We say there are a total of 123 processes that exist
inside the dictionary as a total.
And then the second part is there were five processes under the parent I.
D.
Of the parent process I.
D.
56 92.
So in this case I used one that was sort of down this list and that's this
little segment of the tree that we're saying from 56 92 down.
So 56-92 spawned five different processes total not directly.
So in this case it spawned this process and this process directly.
And then they spawned this process and this process from 54 92.
And then this process was spawned from 51 88.
But how many total we have here as Children.
So we have 1234 and five.
So why is this useful if you're trying to keep an eye on a
specific executable or a specific process I.
D.
In this case that's linked in with it this would be an easy way to,
Okay he's currently has five.
Let's run it again.
Do we have any more than five?
Do we have you know,
did it spawn any additional ones since we last paid attention to it?
And of course you don't have to be displaying this whole dictionary every time
you're running it you could just return that just if you want to look at it or
maybe you wanted it to run in the background on the loop and you wanted it to
automatically alert you or notify you in some way if a specific process spawned
additional things and then especially if that process was a suspect one at that
point that would sort of draw your attention and you could focus and further
investigate it