#!/usr/bin/env python3
"""Agent for hunting registry-based persistence mechanisms on Windows."""

import json
import argparse
import subprocess
import re
from datetime import datetime

PERSISTENCE_KEYS = {
    "run_keys": [
        r"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
        r"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
        r"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
        r"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
        r"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx",
    ],
    "winlogon": [
        r"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",
    ],
    "ifeo": [
        r"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options",
    ],
    "appinit": [
        r"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows",
    ],
    "shell_extensions": [
        r"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks",
        r"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad",
    ],
    "browser_helpers": [
        r"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects",
    ],
    "com_hijack": [
        r"HKCU\SOFTWARE\Classes\CLSID",
    ],
    "boot_execute": [
        r"HKLM\SYSTEM\CurrentControlSet\Control\Session Manager",
    ],
}

SUSPICIOUS_PATTERNS = [
    r"\\temp\\", r"\\tmp\\", r"\\appdata\\local\\temp",
    r"powershell.*-enc", r"powershell.*-nop",
    r"cmd\.exe\s+/c\s+", r"mshta\.exe", r"rundll32\.exe.*javascript",
    r"regsvr32\.exe.*/s\s+/n\s+/u\s+/i:",
    r"\\users\\public\\", r"\\programdata\\[^m]",
    r"certutil.*-decode", r"bitsadmin.*transfer",
    r"base64", r"downloadstring", r"iex\s*\(",
]


def scan_persistence_keys(categories=None):
    """Scan specified registry persistence key categories."""
    if categories is None:
        categories = list(PERSISTENCE_KEYS.keys())
    results = {"timestamp": datetime.utcnow().isoformat(), "categories": {}, "all_suspicious": []}
    for category in categories:
        keys = PERSISTENCE_KEYS.get(category, [])
        category_findings = []
        for key in keys:
            try:
                proc = subprocess.run(
                    ["reg", "query", key, "/s"], capture_output=True, text=True, timeout=10
                )
                if proc.returncode == 0:
                    entries = _parse_reg(proc.stdout, key)
                    for entry in entries:
                        entry["suspicious"] = _check_suspicious(entry.get("value", ""))
                        entry["category"] = category
                        if entry["suspicious"]:
                            results["all_suspicious"].append(entry)
                    category_findings.extend(entries)
            except (subprocess.TimeoutExpired, FileNotFoundError):
                continue
        results["categories"][category] = {
            "total": len(category_findings),
            "suspicious": sum(1 for f in category_findings if f.get("suspicious")),
            "entries": category_findings,
        }
    results["total_suspicious"] = len(results["all_suspicious"])
    return results


def _parse_reg(output, default_key):
    entries = []
    current_key = default_key
    for line in output.strip().split("\n"):
        line = line.strip()
        if not line:
            continue
        if line.startswith("HK"):
            current_key = line
            continue
        parts = re.split(r"\s{2,}", line, maxsplit=2)
        if len(parts) >= 3:
            entries.append({"key": current_key, "name": parts[0], "type": parts[1], "value": parts[2]})
    return entries


def _check_suspicious(value):
    return any(re.search(p, value, re.I) for p in SUSPICIOUS_PATTERNS)


def compare_baseline(baseline_file, current_scan=None):
    """Compare current registry state against a known-good baseline."""
    with open(baseline_file, "r") as f:
        baseline = json.load(f)
    if current_scan is None:
        current_scan = scan_persistence_keys()
    baseline_set = set()
    for cat_data in baseline.get("categories", {}).values():
        for entry in cat_data.get("entries", []):
            baseline_set.add((entry.get("key", ""), entry.get("name", ""), entry.get("value", "")))
    new_entries = []
    for cat_name, cat_data in current_scan["categories"].items():
        for entry in cat_data.get("entries", []):
            key_tuple = (entry.get("key", ""), entry.get("name", ""), entry.get("value", ""))
            if key_tuple not in baseline_set:
                entry["status"] = "NEW"
                new_entries.append(entry)
    return {
        "baseline_entries": len(baseline_set),
        "new_entries": len(new_entries),
        "findings": new_entries,
    }


def main():
    parser = argparse.ArgumentParser(description="Hunt for registry persistence mechanisms")
    sub = parser.add_subparsers(dest="command")
    s = sub.add_parser("scan", help="Scan registry persistence keys")
    s.add_argument("--categories", nargs="*", choices=list(PERSISTENCE_KEYS.keys()),
                   help="Categories to scan (default: all)")
    s.add_argument("--save-baseline", help="Save scan as baseline JSON file")
    c = sub.add_parser("compare", help="Compare against baseline")
    c.add_argument("--baseline", required=True, help="Baseline JSON file")
    args = parser.parse_args()
    if args.command == "scan":
        result = scan_persistence_keys(args.categories)
        if args.save_baseline:
            with open(args.save_baseline, "w") as f:
                json.dump(result, f, indent=2)
    elif args.command == "compare":
        result = compare_baseline(args.baseline)
    else:
        parser.print_help()
        return
    print(json.dumps(result, indent=2, default=str))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Registry Persistence Detection - Analyzes logs for T1547.001 indicators."""

import json, csv, argparse, datetime, re
from collections import defaultdict
from pathlib import Path

DETECTION_PATTERNS = [
    r'CurrentVersion\\\\Run',
    r'Winlogon\\\\Shell',
    r'Image File Execution Options',
    r'AppInit_DLLs',
    r'InprocServer32',
    r'Active Setup',
]

def parse_logs(path):
    p = Path(path)
    if p.suffix == ".json":
        with open(p, encoding="utf-8") as f:
            data = json.load(f)
            return data if isinstance(data, list) else data.get("events", [])
    elif p.suffix == ".csv":
        with open(p, encoding="utf-8-sig") as f:
            return [dict(r) for r in csv.DictReader(f)]
    return []

def analyze_event(event):
    cmd = event.get("CommandLine", event.get("command_line", event.get("ProcessCommandLine", "")))
    content = event.get("Task_Content", event.get("Parameters", event.get("RawEventData", "")))
    search_text = f"{cmd} {content}"
    risk = 0
    indicators = []
    for pattern in DETECTION_PATTERNS:
        if re.search(pattern, search_text, re.IGNORECASE):
            risk += 25
            indicators.append(f"Pattern match: {pattern}")
    if not indicators:
        return None
    risk = min(risk, 100)
    return {
        "technique": "T1547.001",
        "command_line": cmd[:500] if cmd else content[:500],
        "hostname": event.get("Computer", event.get("DeviceName", event.get("hostname", "unknown"))),
        "user": event.get("User", event.get("AccountName", event.get("UserId", "unknown"))),
        "timestamp": event.get("_time", event.get("timestamp", event.get("UtcTime", event.get("Timestamp", "")))),
        "risk_score": risk,
        "risk_level": "CRITICAL" if risk >= 75 else "HIGH" if risk >= 50 else "MEDIUM" if risk >= 25 else "LOW",
        "indicators": indicators,
    }

def run_hunt(input_path, output_dir):
    print(f"[*] Registry Persistence Hunt - {datetime.datetime.now().isoformat()}")
    events = parse_logs(input_path)
    findings = [f for f in (analyze_event(e) for e in events) if f]
    Path(output_dir).mkdir(parents=True, exist_ok=True)
    slug = "hunting_for_registry"
    with open(Path(output_dir) / f"{slug}_findings.json", "w", encoding="utf-8") as f:
        json.dump({"hunt_id": f"TH-{datetime.date.today()}", "total_events": len(events), "findings": findings}, f, indent=2)
    with open(Path(output_dir) / "hunt_report.md", "w", encoding="utf-8") as f:
        f.write(f"# Registry Persistence Hunt Report\n\n")
        f.write(f"**Date**: {datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")
        f.write(f"**Findings**: {len(findings)}\n\n")
        for finding in sorted(findings, key=lambda x: x["risk_score"], reverse=True)[:20]:
            f.write(f"### [{finding['risk_level']}] {finding['technique']}\n")
            f.write(f"- **Host**: {finding['hostname']}\n")
            f.write(f"- **Indicators**: {', '.join(finding['indicators'])}\n\n")
    print(f"[+] {len(findings)} findings written to {output_dir}")

def main():
    p = argparse.ArgumentParser(description="Registry Persistence Detection")
    sp = p.add_subparsers(dest="cmd")
    h = sp.add_parser("hunt"); h.add_argument("--input", "-i", required=True); h.add_argument("--output", "-o", default="./hunting_for_reg_output")
    sp.add_parser("queries")
    args = p.parse_args()
    if args.cmd == "hunt": run_hunt(args.input, args.output)
    elif args.cmd == "queries":
        print("=== Detection Queries ===")
        print("See references/workflows.md for platform-specific queries")
    else: p.print_help()

if __name__ == "__main__": main()