Skip to content

An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree view.

License

Notifications You must be signed in to change notification settings

IllusiveNetworks-Labs/HistoricProcessTree

Repository files navigation

HistoricProcessTree

HistoricProcessTree receives a Security Event Log file (evtx) and visualizes historic process execution evidence (based on 4688 events) in a tree view.

Analyzing processes execution, their time and their ancestors, provides researchers an initial understanding of what happened on an investigated machine.

Additional reading material on the tool, can be found in our blog Visualising Historic Process Execution Events.

Requirements

pip install anytree jinja2

How to use

Usage: HistoricProcessTree.py [-h] [-s START_TIME] [-e END_TIME] [--hours NUM_OF_HOURS] input_file output_file

positional arguments:
  input_file            Path to evtx file
  output_file           Final name of the generated HTML

optional arguments:
  -h, --help               Show this help message and exit
  -s START_TIME 		   Start date filter- Format: "MM/DD/YYYY HH:MM:SS"
  -e END_TIME       	   End date filter- Format: "MM/DD/YYYY HH:MM:SS"
  --hours HOURS            Number of hours to go back since last event

Examples

HistoricProcessTree.py c:\work\Security.evtx -s “01/10/2018 15:45:00” -e “01/10/2017 16:00” output_file.html Note: Run this from the tool's working directory

will generate the following HTML page:

alt tag

Authors

License

This project is licensed under the BSD 3-clause license - see the LICENSE file for details

Contributors

  • Illusive Networks Research & Dev team members:
    • Tom Sela
    • Dolev Ben Shushan
    • Hadar Yudovich
    • Yair Fried
  • Jonathan Miles for JQuery Plugin bootstrap-treeview.js

About

An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree view.

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages