source: improved_sysmon_client.py@ e4c61dd

Last change on this file since e4c61dd was 640ed89, checked in by istevanoska <ilinastevanoska@…>, 7 months ago

Initial commit
  • Property mode set to 100644
File size: 14.2 KB
Line 
1#!/usr/bin/env python3
2"""
3FIXED SYSMON CLIENT - Sends data in correct format for server
4"""
5
6import socket
7import os
8import platform
9import json
10import requests
11from datetime import datetime, timedelta
12import psutil
13import time
14import re
15import xml.etree.ElementTree as ET
16
17
18class FixedSysmonClient:
19 def __init__(self, server_ip="192.168.1.13", port=5555):
20 self.server_ip = server_ip
21 self.port = port
22 self.computer_name = socket.gethostname()
23 self.user = os.getlogin()
24 self.event_types = self._init_event_types()
25
26 def _init_event_types(self):
27 return {
28 1: "Process Creation",
29 3: "Network Connection",
30 5: "Process Terminated",
31 7: "Image Loaded (DLL)",
32 11: "File Create",
33 12: "Registry Object added/deleted",
34 13: "Registry Value Set",
35 22: "DNS Query",
36 23: "File Delete"
37 }
38
39 def check_sysmon_installed(self):
40 try:
41 import win32evtlog
42 hand = win32evtlog.OpenEventLog("localhost", "Microsoft-Windows-Sysmon/Operational")
43 win32evtlog.CloseEventLog(hand)
44 return True
45 except:
46 return False
47
48 def parse_event_data_advanced(self, event):
49 try:
50 event_data = {}
51
52 if event.StringInserts:
53 for insert in event.StringInserts:
54 if insert:
55 try:
56 xml_string = insert.strip()
57 if not xml_string.startswith('<'):
58 continue
59
60 root = ET.fromstring(f"<root>{xml_string}</root>")
61
62 for data_elem in root.findall('.//Data'):
63 name = data_elem.get('Name')
64 value = data_elem.text
65 if name and value:
66 event_data[name] = value.strip()
67
68 except ET.ParseError:
69 pattern = r'<Data Name=["\']([^"\']+)["\']>([^<]*)</Data>'
70 matches = re.findall(pattern, str(insert))
71 for name, value in matches:
72 if name and value:
73 event_data[name] = value.strip()
74
75 return event_data
76
77 except Exception as e:
78 return {}
79
80 def get_all_sysmon_events(self, max_events=50):
81 events = []
82
83 if not self.check_sysmon_installed():
84 print(" ⚠️ Sysmon not installed")
85 return events
86
87 try:
88 import win32evtlog
89
90 hand = win32evtlog.OpenEventLog("localhost", "Microsoft-Windows-Sysmon/Operational")
91 flags = win32evtlog.EVENTLOG_BACKWARDS_READ | win32evtlog.EVENTLOG_SEQUENTIAL_READ
92
93 events_collected = 0
94
95 while events_collected < max_events:
96 events_batch = win32evtlog.ReadEventLog(hand, flags, 0)
97 if not events_batch:
98 break
99
100 for event in events_batch:
101 try:
102 event_id = event.EventID & 0xFFFF
103 event_type = self.event_types.get(event_id, f"Event {event_id}")
104
105 event_data = self.parse_event_data_advanced(event)
106
107 # Extract fields based on event type
108 event_entry = {
109 "event_id": event_id,
110 "event_type": event_type,
111 "timestamp": event.TimeGenerated.Format() if hasattr(event.TimeGenerated,
112 'Format') else str(
113 event.TimeGenerated),
114 "computer": self.computer_name,
115 "process": event_data.get("Image", ""),
116 "command_line": event_data.get("CommandLine", ""),
117 "user": event_data.get("User", ""),
118 "parent_process": event_data.get("ParentImage", ""),
119 "dns_query": event_data.get("QueryName", ""),
120 "dns_results": event_data.get("QueryResults", ""),
121 "source_ip": event_data.get("SourceIp", ""),
122 "destination_ip": event_data.get("DestinationIp", ""),
123 "destination_port": event_data.get("DestinationPort", ""),
124 "file_path": event_data.get("TargetFilename", ""),
125 "hash": event_data.get("Hashes", ""),
126 "registry_key": event_data.get("TargetObject", ""),
127 "registry_value": event_data.get("Details", ""),
128 "description": self.get_event_description(event_id, event_data),
129 "raw_data": json.dumps(event_data)
130 }
131
132 # Only add if meaningful
133 if any([
134 event_entry["process"],
135 event_entry["dns_query"],
136 event_entry["file_path"],
137 event_entry["destination_ip"]
138 ]):
139 events.append(event_entry)
140 events_collected += 1
141
142 if events_collected >= max_events:
143 break
144
145 except Exception as e:
146 continue
147
148 win32evtlog.CloseEventLog(hand)
149
150 except Exception as e:
151 print(f" ❌ Error reading Sysmon: {e}")
152
153 return events
154
155 def get_event_description(self, event_id, event_data):
156 if event_id == 1:
157 proc = event_data.get("Image", "").split("\\")[-1] if event_data.get("Image") else "Unknown"
158 return f"Process started: {proc}"
159 elif event_id == 22:
160 return f"DNS query: {event_data.get('QueryName', 'Unknown')}"
161 elif event_id == 3:
162 return f"Network: {event_data.get('DestinationIp', 'Unknown')}"
163 elif event_id == 11:
164 file_name = event_data.get("TargetFilename", "").split("\\")[-1] if event_data.get(
165 "TargetFilename") else "Unknown"
166 return f"File created: {file_name}"
167 elif event_id == 23:
168 file_name = event_data.get("TargetFilename", "").split("\\")[-1] if event_data.get(
169 "TargetFilename") else "Unknown"
170 return f"File deleted: {file_name}"
171 else:
172 return f"Event {event_id}"
173
174 def get_system_info(self):
175 try:
176 return {
177 "computer_name": self.computer_name,
178 "user": self.user,
179 "hostname": socket.gethostname(),
180 "ip_address": socket.gethostbyname(self.computer_name) if hasattr(socket, 'gethostbyname') else "N/A",
181 "os": f"{platform.system()} {platform.release()}",
182 "cpu_usage": psutil.cpu_percent(interval=1),
183 "ram_usage": psutil.virtual_memory().percent,
184 "disk_usage": psutil.disk_usage("C:/").percent if os.name == 'nt' else 0,
185 "collection_time": datetime.now().isoformat()
186 }
187 except Exception as e:
188 return {"error": str(e)}
189
190 def get_running_processes(self):
191 processes = []
192 try:
193 for proc in psutil.process_iter(['pid', 'name', 'username']):
194 try:
195 with proc.oneshot():
196 processes.append({
197 "pid": proc.info['pid'],
198 "name": proc.info['name'],
199 "user": proc.info['username'] if proc.info['username'] else "N/A",
200 "cpu_percent": round(proc.cpu_percent(), 2),
201 "memory_mb": round(proc.memory_info().rss / (1024 ** 2), 2),
202 "cmdline": ' '.join(proc.cmdline())[:200] if proc.cmdline() else "",
203 "timestamp": datetime.now().isoformat()
204 })
205 except (psutil.NoSuchProcess, psutil.AccessDenied):
206 continue
207
208 if len(processes) >= 50:
209 break
210 except Exception as e:
211 print(f" ⚠️ Error collecting processes: {e}")
212
213 return processes
214
215 def collect_and_send(self):
216 print(f"\n[{datetime.now().strftime('%H:%M:%S')}] 🔍 Collecting data...")
217
218 try:
219 sysmon_installed = self.check_sysmon_installed()
220 print(f" 🔍 Sysmon: {'✅ Installed' if sysmon_installed else '❌ Not installed'}")
221
222 print(f" 📥 Collecting Sysmon events...")
223 events = self.get_all_sysmon_events(max_events=50)
224
225 print(f" 📥 Collecting system info...")
226 system_info = self.get_system_info()
227
228 print(f" 📥 Collecting processes...")
229 processes = self.get_running_processes()
230
231 # Prepare data in CORRECT format for server
232 data = {
233 "metadata": {
234 "computer": self.computer_name,
235 "user": self.user,
236 "timestamp": datetime.now().isoformat()
237 },
238 "events": events,
239 "system_info": system_info,
240 "processes": processes
241 }
242
243 print(f"\n 📊 STATISTICS:")
244 print(f" • Events: {len(events)}")
245 print(f" • Processes: {len(processes)}")
246
247 # Show samples
248 dns_events = [e for e in events if e.get("dns_query")]
249 file_events = [e for e in events if e.get("file_path")]
250 network_events = [e for e in events if e.get("destination_ip")]
251
252 if dns_events:
253 print(f"\n 🌐 DNS QUERIES ({len(dns_events)}):")
254 for dns in dns_events[:3]:
255 print(f" • {dns.get('dns_query')}")
256
257 if file_events:
258 print(f"\n 📁 FILE OPERATIONS ({len(file_events)}):")
259 for file_ev in file_events[:3]:
260 file_name = os.path.basename(file_ev.get("file_path", ""))
261 print(f" • {file_name}")
262
263 if network_events:
264 print(f"\n 🌍 NETWORK ({len(network_events)}):")
265 for net in network_events[:3]:
266 print(f" • {net.get('destination_ip')}:{net.get('destination_port')}")
267
268 print(f"\n 📤 Sending to server...")
269 return self.send_to_server(data)
270
271 except Exception as e:
272 print(f" ❌ Error: {e}")
273 import traceback
274 traceback.print_exc()
275 return False
276
277 def send_to_server(self, data):
278 try:
279 response = requests.post(
280 f"http://{self.server_ip}:{self.port}/receive_data",
281 json=data,
282 timeout=30,
283 headers={'Content-Type': 'application/json'}
284 )
285
286 if response.status_code == 200:
287 result = response.json()
288 print(f" ✅ Successfully sent!")
289 print(f" 📝 Server response: {result.get('message', 'Success')}")
290 print(f" 📊 Events inserted: {result.get('events_inserted', 0)}")
291 return True
292 else:
293 print(f" ❌ Server error {response.status_code}")
294 print(f" Response: {response.text[:200]}")
295 return False
296
297 except requests.exceptions.ConnectionError:
298 print(f" ❌ Cannot connect to server at {self.server_ip}:{self.port}")
299 return False
300 except Exception as e:
301 print(f" ❌ Error: {e}")
302 return False
303
304
305def main():
306 print("=" * 70)
307 print("🛡️ FIXED SYSMON CLIENT")
308 print("=" * 70)
309 print(f"Computer: {socket.gethostname()}")
310 print(f"User: {os.getlogin()}")
311 print("=" * 70)
312
313 server_ip = input("Enter server IP (default 192.168.1.13): ").strip() or "192.168.1.13"
314
315 client = FixedSysmonClient(server_ip)
316
317 # Test connection
318 print(f"\n🔌 Testing connection to {server_ip}:5555...")
319 try:
320 response = requests.get(f"http://{server_ip}:5555/ping", timeout=5)
321 if response.status_code == 200:
322 print(f" ✅ Server is reachable!")
323 else:
324 print(f" ⚠️ Server responded with status {response.status_code}")
325 except Exception as e:
326 print(f" ⚠️ Cannot connect: {e}")
327
328 # Check pywin32
329 try:
330 import win32evtlog
331 print(f" ✅ pywin32 installed")
332 except ImportError:
333 print(f" ❌ pywin32 not installed - run: pip install pywin32")
334 input("Press ENTER to exit...")
335 return
336
337 interval = input("\nCollection interval in seconds (default 60): ").strip()
338 try:
339 interval = int(interval) if interval else 60
340 except:
341 interval = 60
342
343 try:
344 count = 1
345 while True:
346 print(f"\n" + "=" * 70)
347 print(f"📊 CYCLE #{count} - {datetime.now().strftime('%H:%M:%S')}")
348 print("=" * 70)
349
350 start_time = time.time()
351 client.collect_and_send()
352 elapsed = time.time() - start_time
353
354 print(f"\n ⏱️ Time: {elapsed:.2f} seconds")
355 count += 1
356
357 print(f"\n⏳ Waiting {interval} seconds...")
358 time.sleep(interval)
359
360 except KeyboardInterrupt:
361 print("\n\n🛑 Program stopped.")
362 print(f"📊 Dashboard: http://{server_ip}:5555/")
363 print("=" * 70)
364
365
366if __name__ == "__main__":
367 required_modules = ["psutil", "requests"]
368 missing = []
369
370 for module in required_modules:
371 try:
372 __import__(module)
373 except ImportError:
374 missing.append(module)
375
376 if missing:
377 print(f"❌ Missing: {', '.join(missing)}")
378 print(f"Install: pip install {' '.join(missing)}")
379 if os.name == 'nt':
380 print("Also: pip install pywin32")
381 input("Press ENTER to exit...")
382 exit(1)
383
384 print("✅ All modules installed")
385 main()
Note: See TracBrowser for help on using the repository browser.