search_proc_injection.py

# coding: utf-8
# https://www.iwsec.org/mws/2017/20171201/20171201_MWSCup2017_c3.pdf P.8

import json
from glob import glob
import os.path
import csv


def main():
    jpath = glob("*.json")
    header = ["PID", "ProcessName", "Category", "APIName&RetVal", "Arg"]  # csv header
    for path in jpath:
        print(path)
        with open(path) as f:
            jdata = json.load(f)
        logf = open(os.path.splitext(path)[0] + ".csv", 'w')
        csvw = csv.writer(logf)
        csvw.writerow(header)
        
        for proc in jdata["behavior"]["processes"]:
            print("%s, %s" % (proc["pid"], proc["command_line"]))
            for c in proc["calls"]:  # procのAPIコール列
                tag = ""
                if c["api"] in ["CreateProcessInternalW", "NtCreateUserProcess"]:
                    tag = "[PROC]"
                elif c["api"] in ["NtAllocateVirtualMemory", "NtProtectVirtualMemory", "NtMapViewOfSection"] and c["arguments"]["process_handle"] != "0xffffffff":
                    tag = "[MEM]"
                elif c["api"] in ["WriteProcessMemory", "NtWriteVirtualMemory"] and c["arguments"]["process_handle"] != "0xffffffff":
                    tag = "[WRITE]"
                elif c["api"] in ["CreateRemoteThread", "NtSetContextThread", "NtQueueApcThread", "NtResumeThread"]:
                    tag = "[EXEC]"
                
                if tag:
                    payload = [str(proc["pid"]), proc["command_line"], tag, c["api"], str(c["return_value"]), str(c["arguments"])]
                    print(", ".join(payload))
                    csvw.writerow(payload)
            print("-" * 100)
        print("")
        
        logf.close()

if __name__ == "__main__":
    main()