[Autogenerated] for this section.
We will be moving back into our demonstration environment first we will show
how we can reuse the functionality of the script shown in the previous module
but with a focused look at a specific process tree.
We will then move on and discuss the creation of a script that is used to
monitor for process networking activity and the tracking of it.
Now let's move into the demonstration environment and show how we
can focus on these different low been processes.
The first script we're going to take a look at is a derivative of the
script that we showed in the previous module where we were generating a
dictionary from all of the different processes that exist on the
running system or the target system.
In this case we're going to use that similar logic.
But instead of viewing all of the processes that
exist on a specific target machine,
we're going to be looking at all of the different
processes on a specific process tree.
So much of the logic that we showed up to this point in the
previous module is repeated but where we differ a little bit
is inside this specific function.
And what we did was in the previous version.
In the all version we just had taking one variable which was the
process list and we had it iterating through that process list
based on the secondary route processes.
And then the trees from that point forward.
In this case we have mildly modified that and added a parent
process idea that we can have pushed into that function and what
it does is it will only be generating a dictionary based on that
specific parent process I.
D.
As the root and then fill out the dictionary based on that being the
root and then iterate through and generate all of the different
processes that have spawned off of that parent.
So if we move down in all of the logic up to this point is
the same as it was in the previous module.
But the example we're going to show first is we're going to show
we're gonna show right here what we're going to be doing is still
running the same generate process dict function that we just had with
the modifications we highlighted.
We're still pushing in the main whole process list but we're going
to base the output based on the parent process I.
D.
In this case of 56 92.
Now obviously this number can be whatever number you want
based on what the current ideas are on your target system
that you're using this on.
Once we have generated this dictionary we are going
to again printed out with the P.
P.
Print module.
So it's pretty but that's what we're going to initially show.
So what we see now is the 56 92 process has a number of
different processes that exist under it.
It has personally spawned off to 54 92 98 64.
And then 54 92 itself has spawned two additional ones and
then one of those has spawned another one.
So in total there are five different processes that are spawned
Children that route from the 56 92 process.
So so why do you care about this?
If we wanted to focus on a specific lobe in process.
So what we're talking about a low been processes,
we're talking about a process that is normally part of the operating system.
So in this case we have chosen this specific process I.
D.
Because it had a number of different spawn processes under it,
that showed the functionality of this script.
So if we wanted to take a look at One of the examples of a low been,
let's look at six six, we look over here,
we'll see that 6116 is explorer,
we'll see that currently The explorer process 6 116 has four different Children.
And those are indicated here and then those kids have these kids
and then those kids have those kids and so on.
Now if this executable Explorer dot E X E was being
used by a toll that was unexpected.
You should be able to use a display similar to this or this one in order to
find it where it spawned from and what its process idea is.
So this is half of the module that we wanted to cover,
which references how we can monitor forward the spawning of processes
unexpectedly off of specific little bit executable