#!/usr/bin/env python3
"""Agent for detecting T1055 process injection via Sysmon event analysis."""

import argparse
import json
import subprocess
import sys
from datetime import datetime, timezone


INJECTION_ACCESS_MASKS = {
    "0x1F0FFF": "PROCESS_ALL_ACCESS",
    "0x001F0FFF": "PROCESS_ALL_ACCESS (full)",
    "0x0800": "PROCESS_SUSPEND_RESUME",
    "0x0020": "PROCESS_VM_WRITE",
    "0x0008": "PROCESS_VM_OPERATION",
    "0x0010": "PROCESS_VM_READ",
}

INJECTION_DLLS = [
    "ntdll.dll", "kernel32.dll", "kernelbase.dll",
]

SUSPICIOUS_API_CALLS = [
    "VirtualAllocEx", "WriteProcessMemory", "CreateRemoteThread",
    "NtMapViewOfSection", "QueueUserAPC", "SetWindowsHookEx",
    "RtlCreateUserThread", "NtQueueApcThread",
]


def query_sysmon_events(event_id, max_events=500):
    """Query Sysmon operational log for specific event ID."""
    if sys.platform != "win32":
        return []
    ps_cmd = (
        f"Get-WinEvent -FilterHashtable @{{LogName='Microsoft-Windows-Sysmon/Operational';"
        f"Id={event_id}}} -MaxEvents {max_events} "
        "| ForEach-Object { @{"
        "TimeCreated=$_.TimeCreated.ToString('o');"
        "Properties=@($_.Properties | ForEach-Object {$_.Value})"
        "}} | ConvertTo-Json -Depth 3"
    )
    try:
        result = subprocess.check_output(
            ["powershell", "-NoProfile", "-Command", ps_cmd],
            text=True, errors="replace", timeout=30
        )
        data = json.loads(result) if result.strip() else []
        return data if isinstance(data, list) else [data]
    except (subprocess.SubprocessError, json.JSONDecodeError):
        return []


def analyze_process_access():
    """Analyze Sysmon Event ID 10 for injection-related process access."""
    findings = []
    events = query_sysmon_events(10)
    for evt in events:
        props = evt.get("Properties", [])
        if len(props) < 11:
            continue
        source_img = str(props[4]) if len(props) > 4 else ""
        target_img = str(props[8]) if len(props) > 8 else ""
        access = str(props[10]) if len(props) > 10 else ""
        safe_sources = ["csrss.exe", "svchost.exe", "lsass.exe", "services.exe", "smss.exe"]
        if any(s in source_img.lower() for s in safe_sources):
            continue
        if access in INJECTION_ACCESS_MASKS:
            findings.append({
                "event": "ProcessAccess",
                "time": evt.get("TimeCreated", ""),
                "source": source_img,
                "target": target_img,
                "access_mask": access,
                "mask_meaning": INJECTION_ACCESS_MASKS.get(access, "Unknown"),
            })
    return findings


def analyze_create_remote_thread():
    """Analyze Sysmon Event ID 8 for CreateRemoteThread injection."""
    findings = []
    events = query_sysmon_events(8)
    for evt in events:
        props = evt.get("Properties", [])
        if len(props) < 8:
            continue
        source_img = str(props[4]) if len(props) > 4 else ""
        target_img = str(props[7]) if len(props) > 7 else ""
        findings.append({
            "event": "CreateRemoteThread",
            "time": evt.get("TimeCreated", ""),
            "source": source_img,
            "target": target_img,
            "severity": "HIGH",
        })
    return findings


def analyze_image_loads():
    """Analyze Sysmon Event ID 7 for suspicious DLL loads in unusual processes."""
    findings = []
    events = query_sysmon_events(7, max_events=200)
    for evt in events:
        props = evt.get("Properties", [])
        if len(props) < 6:
            continue
        image = str(props[3]) if len(props) > 3 else ""
        loaded = str(props[5]) if len(props) > 5 else ""
        if loaded.lower().endswith("amsi.dll") and "powershell" not in image.lower():
            findings.append({
                "event": "SuspiciousImageLoad",
                "time": evt.get("TimeCreated", ""),
                "process": image,
                "loaded_image": loaded,
                "note": "AMSI DLL loaded by non-PowerShell process",
            })
    return findings


def main():
    parser = argparse.ArgumentParser(
        description="Detect T1055 process injection via Sysmon telemetry"
    )
    parser.add_argument("--output", "-o", help="Output JSON report")
    parser.add_argument("--max-events", type=int, default=500)
    parser.add_argument("--verbose", "-v", action="store_true")
    args = parser.parse_args()

    print("[*] T1055 Process Injection Detection Agent (Sysmon)")
    report = {"timestamp": datetime.now(timezone.utc).isoformat(), "findings": {}}

    access = analyze_process_access()
    report["findings"]["process_access"] = access
    print(f"[*] Suspicious process access: {len(access)}")

    threads = analyze_create_remote_thread()
    report["findings"]["remote_threads"] = threads
    print(f"[*] Remote thread creation: {len(threads)}")

    loads = analyze_image_loads()
    report["findings"]["suspicious_loads"] = loads
    print(f"[*] Suspicious image loads: {len(loads)}")

    total = len(access) + len(threads) + len(loads)
    report["risk_level"] = "CRITICAL" if total >= 5 else "HIGH" if total >= 2 else "MEDIUM" if total > 0 else "LOW"

    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2)
        print(f"[*] Report saved to {args.output}")
    else:
        print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
T1055 Process Injection Detection Script
Analyzes Sysmon Event 8 (CreateRemoteThread), Event 10 (ProcessAccess),
and Event 25 (ProcessTampering) to identify process injection activity.
"""

import json
import csv
import argparse
import datetime
import re
from pathlib import Path

HIGH_VALUE_TARGETS = {
    "svchost.exe", "explorer.exe", "lsass.exe", "winlogon.exe",
    "csrss.exe", "services.exe", "spoolsv.exe", "dllhost.exe",
    "runtimebroker.exe", "dwm.exe", "smss.exe",
}

LEGITIMATE_SOURCES = {
    "csrss.exe", "lsass.exe", "services.exe", "svchost.exe",
    "msmpe ng.exe", "securityhealthservice.exe", "vmtoolsd.exe",
    "taskmgr.exe", "procexp64.exe", "procexp.exe", "procmon.exe",
}

SUSPICIOUS_ACCESS_MASKS = {
    "0x1fffff": "PROCESS_ALL_ACCESS",
    "0x1f3fff": "Nearly full access",
    "0x143a": "Mimikatz-style access",
    "0x1f0fff": "High privilege access",
    "0x0040": "PROCESS_VM_READ (credential access)",
}


def parse_events(input_path: str) -> list[dict]:
    """Parse Sysmon event logs."""
    path = Path(input_path)
    events = []
    if path.suffix == ".json":
        with open(path, "r", encoding="utf-8") as f:
            data = json.load(f)
            events = data if isinstance(data, list) else data.get("events", [])
    elif path.suffix == ".csv":
        with open(path, "r", encoding="utf-8-sig") as f:
            events = [dict(row) for row in csv.DictReader(f)]
    return events


def detect_injection(events: list[dict]) -> list[dict]:
    """Detect process injection from Sysmon events."""
    findings = []

    for event in events:
        event_code = str(event.get("EventCode", event.get("EventID", event.get("event_id", ""))))
        computer = event.get("Computer", event.get("host", ""))
        timestamp = event.get("UtcTime", event.get("_time", event.get("timestamp", "")))
        user = event.get("User", event.get("user", ""))

        if event_code == "8":
            source = event.get("SourceImage", "")
            target = event.get("TargetImage", "")
            source_name = source.split("\\")[-1].lower() if source else ""
            target_name = target.split("\\")[-1].lower() if target else ""

            if source_name in LEGITIMATE_SOURCES:
                continue
            if source == target:
                continue

            severity = "CRITICAL" if target_name in HIGH_VALUE_TARGETS else "HIGH"
            findings.append({
                "timestamp": timestamp,
                "computer": computer,
                "event_type": "CreateRemoteThread",
                "sysmon_event": 8,
                "source_image": source,
                "target_image": target,
                "severity": severity,
                "technique": "T1055.001",
                "description": f"Remote thread created by {source_name} in {target_name}",
            })

        elif event_code == "10":
            source = event.get("SourceImage", "")
            target = event.get("TargetImage", "")
            access = event.get("GrantedAccess", "").lower()
            source_name = source.split("\\")[-1].lower() if source else ""
            target_name = target.split("\\")[-1].lower() if target else ""

            if source_name in LEGITIMATE_SOURCES:
                continue
            if source == target:
                continue
            if access not in SUSPICIOUS_ACCESS_MASKS:
                continue

            severity = "CRITICAL" if target_name == "lsass.exe" else "HIGH"
            findings.append({
                "timestamp": timestamp,
                "computer": computer,
                "event_type": "ProcessAccess",
                "sysmon_event": 10,
                "source_image": source,
                "target_image": target,
                "granted_access": access,
                "access_description": SUSPICIOUS_ACCESS_MASKS.get(access, "Unknown"),
                "severity": severity,
                "technique": "T1055",
                "description": f"{source_name} accessed {target_name} with {access} ({SUSPICIOUS_ACCESS_MASKS.get(access, '')})",
            })

        elif event_code == "25":
            image = event.get("Image", "")
            tampering_type = event.get("Type", "")
            findings.append({
                "timestamp": timestamp,
                "computer": computer,
                "event_type": "ProcessTampering",
                "sysmon_event": 25,
                "image": image,
                "tampering_type": tampering_type,
                "severity": "CRITICAL",
                "technique": "T1055.012",
                "description": f"Process tampering detected: {image} - {tampering_type}",
            })

    return sorted(findings, key=lambda x: {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2}.get(x["severity"], 3))


def run_hunt(input_path: str, output_dir: str) -> None:
    """Execute process injection detection hunt."""
    print(f"[*] T1055 Process Injection Hunt - {datetime.datetime.now().isoformat()}")
    events = parse_events(input_path)
    print(f"[*] Loaded {len(events)} Sysmon events")

    findings = detect_injection(events)
    print(f"[!] Injection detections: {len(findings)}")

    output_path = Path(output_dir)
    output_path.mkdir(parents=True, exist_ok=True)

    with open(output_path / "injection_findings.json", "w", encoding="utf-8") as f:
        json.dump({
            "hunt_id": f"TH-INJECT-{datetime.date.today().isoformat()}",
            "total_events": len(events),
            "findings_count": len(findings),
            "findings": findings,
        }, f, indent=2)

    print(f"[+] Results written to {output_dir}")


def main():
    parser = argparse.ArgumentParser(description="T1055 Process Injection Detection")
    parser.add_argument("--input", "-i", required=True)
    parser.add_argument("--output", "-o", default="./injection_hunt_output")
    args = parser.parse_args()
    run_hunt(args.input, args.output)


if __name__ == "__main__":
    main()