-
Notifications
You must be signed in to change notification settings - Fork 1
/
process_monitor1.py
40 lines (34 loc) · 1.13 KB
/
process_monitor1.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
import os
import sys
import win32api
import win32con
import win32security
import wmi
def log_to_file(message):
with open('process_monitor_log.csv', 'a') as fd:
fd.write(f'{message}\r\n')
def monitor():
log_to_file('CommandLine, Time, Executable, Parent PID, PID, User, Privileges')
c = wmi.WMI()
process_watcher = c.Win32_Process.watch_for('creation')
while True:
try:
new_process = process_watcher()
cmdline = new_process.CommandLine
create_date = new_process.CreationDate
executable = new_process.ExecutablePath
parent_pid = new_process.ParentProcessId
pid = new_process.ProcessId
proc_owner = new_process.GetOwner()
privileges = 'N/A'
process_log_message = (
f'{cmdline} , {create_date} , {executable},'
f'{parent_pid} , {pid} , {proc_owner} , {privileges}'
)
print(process_log_message)
print()
log_to_file(process_log_message)
except Exception:
pass
if __name__ == '__main__':
monitor()