Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: not output an exception when a PGUID that does not exist in JSONL #55

Merged
merged 3 commits into from
Oct 11, 2023
Merged

fix: not output an exception when a PGUID that does not exist in JSONL #55

merged 3 commits into from
Oct 11, 2023

Conversation

fukusuket
Copy link
Collaborator

@fukusuket fukusuket commented Oct 10, 2023 •
edited
Loading

What Changed

Test

Environment

  • OS: macOS Sonoma version 14.0
% nim -v
Nim Compiler Version 2.0.0 [MacOSX: amd64]
% nimble -v
nimble v0.14.2 compiled at 2023-08-19 16:19:52

Test1(Wrong format Process GUID)

If a Process GUID in the wrong format is specified with -p, the following message will be output:

% ./takajo sysmon-process-tree -t timeline.jsonl -p invalid -q
The format of the Process GUID specified with the -p option is invalid. Please specify a valid Process GUID.

Test2(Not exists Process GUID)

If a Process GUID not exists in JSONL is specified with -p, the following message will be output:

% ./takajo sysmon-process-tree -t timeline.jsonl -p invalid -p 00000000-0000-0000-0000-000000000000 -q

Running the Process Tree module

The process was not found.

Test3(Exists Child Process GUID)

The process tree is displayed as below.

% ./takajo sysmon-process-tree -t timeline.jsonl -p 747F3D96-B7A5-5EA4-0000-0010EAB91300 -q

Running the Process Tree module

C:\Windows\System32\smss.exe (2020-04-26 07:19:20.134 +09:00 / 300 / 747F3D96-B75F-5EA4-0000-0010622C0000 / 747F3D96-B75F-5EA4-0000-0010EB030000)
  └ C:\Windows\System32\smss.exe (2020-04-26 07:19:22.596 +09:00 / 388 / 747F3D96-B763-5EA4-0000-00106A480000 / 747F3D96-B75F-5EA4-0000-0010622C0000)
      └ C:\Windows\System32\wininit.exe (2020-04-26 07:19:23.222 +09:00 / 468 / 747F3D96-B764-5EA4-0000-0010904D0000 / 747F3D96-B763-5EA4-0000-00106A480000)
          └ C:\Windows\System32\services.exe (2020-04-26 07:19:24.049 +09:00 / 584 / 747F3D96-B764-5EA4-0000-00106F550000 / 747F3D96-B764-5EA4-0000-0010904D0000)
              └ C:\Windows\System32\svchost.exe (2020-04-26 07:19:40.692 +09:00 / 6964 / 747F3D96-B776-5EA4-0000-0010A74D0B00 / 747F3D96-B764-5EA4-0000-00106F550000)
                  └ C:\Windows\System32\consent.exe (2020-04-26 07:20:21.263 +09:00 / 7036 / 747F3D96-B7A5-5EA4-0000-0010EAB91300 / 747F3D96-B776-5EA4-0000-0010A74D0B00)

Test4(Exists Parent Process GUID)

The process tree is displayed as below.

% ./takajo sysmon-process-tree -t timeline.jsonl -p 747F3D96-B776-5EA4-0000-0010A74D0B00 -q

Running the Process Tree module

C:\Windows\System32\smss.exe (2020-04-26 07:19:20.134 +09:00 / 300 / 747F3D96-B75F-5EA4-0000-0010622C0000 / 747F3D96-B75F-5EA4-0000-0010EB030000)
  └ C:\Windows\System32\smss.exe (2020-04-26 07:19:22.596 +09:00 / 388 / 747F3D96-B763-5EA4-0000-00106A480000 / 747F3D96-B75F-5EA4-0000-0010622C0000)
      └ C:\Windows\System32\wininit.exe (2020-04-26 07:19:23.222 +09:00 / 468 / 747F3D96-B764-5EA4-0000-0010904D0000 / 747F3D96-B763-5EA4-0000-00106A480000)
          └ C:\Windows\System32\services.exe (2020-04-26 07:19:24.049 +09:00 / 584 / 747F3D96-B764-5EA4-0000-00106F550000 / 747F3D96-B764-5EA4-0000-0010904D0000)
              ├ C:\Windows\System32\svchost.exe (2020-04-26 07:21:19.629 +09:00 / 1396 / 747F3D96-B7DF-5EA4-0000-001080711800 / 747F3D96-B764-5EA4-0000-00106F550000)
              ├ C:\Windows\System32\svchost.exe (2020-04-26 07:19:40.692 +09:00 / 6964 / 747F3D96-B776-5EA4-0000-0010A74D0B00 / 747F3D96-B764-5EA4-0000-00106F550000)
              │  ├ C:\Windows\System32\consent.exe (2020-04-26 07:20:11.402 +09:00 / 6648 / 747F3D96-B79B-5EA4-0000-001075DA0F00 / 747F3D96-B776-5EA4-0000-0010A74D0B00)
              │  └ C:\Windows\System32\consent.exe (2020-04-26 07:20:21.263 +09:00 / 7036 / 747F3D96-B7A5-5EA4-0000-0010EAB91300 / 747F3D96-B776-5EA4-0000-0010A74D0B00)
              ├ C:\Windows\System32\svchost.exe (2020-04-26 07:21:08.564 +09:00 / 2792 / 747F3D96-B7D4-5EA4-0000-0010E09B1700 / 747F3D96-B764-5EA4-0000-00106F550000)
              ├ C:\Windows\System32\svchost.exe (2020-04-26 07:21:19.340 +09:00 / 992 / 747F3D96-B7DF-5EA4-0000-001052671800 / 747F3D96-B764-5EA4-0000-00106F550000)
              ├ C:\Windows\System32\SecurityHealthService.exe (2020-04-26 07:20:16.165 +09:00 / 7088 / 747F3D96-B7A0-5EA4-0000-001027D81000 / 747F3D96-B764-5EA4-0000-00106F550000)
              └ C:\Windows\System32\svchost.exe (2020-04-26 07:21:18.412 +09:00 / 6548 / 747F3D96-B7DE-5EA4-0000-0010FA4E1800 / 747F3D96-B764-5EA4-0000-00106F550000)

I would appreciate it if you could review when you have time🙏

@fukusuket fukusuket added the bug Something isn't working label Oct 10, 2023
@fukusuket fukusuket added this to the v2.1.0 milestone Oct 10, 2023
@fukusuket fukusuket self-assigned this Oct 10, 2023
@fukusuket fukusuket marked this pull request as ready for review October 10, 2023 13:10
@fukusuket fukusuket changed the title fix: not output an exception when a PGUID that does not exist in JSON fix: not output an exception when a PGUID that does not exist in JSONL Oct 10, 2023
hitenkoku
hitenkoku approved these changes Oct 10, 2023
View reviewed changes
Copy link
Collaborator

@hitenkoku hitenkoku left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

YamatoSecurity
YamatoSecurity approved these changes Oct 11, 2023
View reviewed changes
Copy link
Collaborator

@YamatoSecurity YamatoSecurity left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@fukusuket LGTM! Thank you!

@YamatoSecurity YamatoSecurity merged commit c693b0e into main Oct 11, 2023
2 checks passed
@fukusuket fukusuket deleted the 53-fix-error-when-parentpguid-not-exists-in-jsonl branch October 11, 2023 00:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@YamatoSecurity YamatoSecurity YamatoSecurity approved these changes

@hitenkoku hitenkoku hitenkoku approved these changes

Assignees

@fukusuket fukusuket

Labels
bug Something isn't working
Projects
None yet
Milestone
v2.1.0
3 participants
@fukusuket @hitenkoku @YamatoSecurity