#!/usr/bin/env python3
"""Agent for implementing and auditing AppLocker application whitelisting policies."""

import json
import argparse
import re
import xml.etree.ElementTree as ET
from datetime import datetime
from pathlib import Path


APPLOCKER_EVENT_IDS = {
    8002: ("EXE/DLL allowed", "INFO"),
    8003: ("EXE/DLL denied", "HIGH"),
    8004: ("EXE/DLL would be denied (audit)", "MEDIUM"),
    8005: ("Script allowed", "INFO"),
    8006: ("Script denied", "HIGH"),
    8007: ("Script would be denied (audit)", "MEDIUM"),
    8020: ("Packaged app allowed", "INFO"),
    8021: ("Packaged app denied", "HIGH"),
    8022: ("Packaged app would be denied (audit)", "MEDIUM"),
}


def parse_applocker_policy(xml_path):
    """Parse an exported AppLocker policy XML file."""
    tree = ET.parse(xml_path)
    root = tree.getroot()
    ns = {"al": "http://schemas.microsoft.com/windows/2006/applocker"}
    rules = []
    for collection in root.findall(".//al:RuleCollection", ns):
        rule_type = collection.get("Type", "")
        mode = collection.get("EnforcementMode", "NotConfigured")
        for rule in collection:
            rule_data = {
                "collection": rule_type,
                "enforcement_mode": mode,
                "name": rule.get("Name", ""),
                "action": rule.get("Action", ""),
                "user_or_group": rule.get("UserOrGroupSid", ""),
                "type": rule.tag.replace(f"{{{ns.get('al', '')}}}", ""),
            }
            conditions = rule.findall(".//*")
            for cond in conditions:
                if "Path" in cond.tag:
                    rule_data["path"] = cond.get("Path", "")
                elif "Publisher" in cond.tag:
                    rule_data["publisher"] = cond.get("PublisherName", "")
                elif "Hash" in cond.tag:
                    rule_data["hash"] = cond.get("Data", "")
            rules.append(rule_data)
    return rules


def audit_applocker_rules(rules):
    """Audit AppLocker rules for security weaknesses."""
    findings = []
    for rule in rules:
        if rule.get("enforcement_mode") == "AuditOnly":
            findings.append({
                "collection": rule["collection"],
                "issue": "audit_mode_only",
                "severity": "MEDIUM",
                "recommendation": "Switch to Enforce mode after validation",
            })
        if rule.get("enforcement_mode") == "NotConfigured":
            findings.append({
                "collection": rule["collection"],
                "issue": "not_configured",
                "severity": "HIGH",
                "recommendation": "Enable enforcement for this rule collection",
            })
        path = rule.get("path", "")
        if path and rule.get("action") == "Allow":
            risky_paths = [r"\\Users\\", r"\\Temp\\", r"\\Downloads\\",
                          r"\\AppData\\", r"\\ProgramData\\"]
            for rp in risky_paths:
                if re.search(rp, path, re.IGNORECASE):
                    findings.append({
                        "rule_name": rule["name"],
                        "path": path,
                        "issue": "allow_from_user_writable_path",
                        "severity": "CRITICAL",
                    })
                    break
        if rule.get("user_or_group") == "S-1-1-0" and rule.get("action") == "Allow":
            findings.append({
                "rule_name": rule["name"],
                "issue": "allow_for_everyone",
                "severity": "MEDIUM",
            })
    return findings


def analyze_applocker_events(log_path):
    """Analyze AppLocker event logs for blocked and audit events."""
    events = []
    with open(log_path) as f:
        for line in f:
            try:
                entry = json.loads(line)
            except json.JSONDecodeError:
                continue
            event_id = int(entry.get("EventID", entry.get("event_id", 0)))
            if event_id in APPLOCKER_EVENT_IDS:
                desc, severity = APPLOCKER_EVENT_IDS[event_id]
                events.append({
                    "event_id": event_id,
                    "description": desc,
                    "severity": severity,
                    "timestamp": entry.get("TimeCreated", entry.get("timestamp", "")),
                    "computer": entry.get("Computer", entry.get("hostname", "")),
                    "user": entry.get("User", entry.get("user", "")),
                    "file_path": entry.get("FilePath", entry.get("file_path", "")),
                    "publisher": entry.get("Publisher", ""),
                })
    denied = [e for e in events if "denied" in e["description"].lower()]
    audit = [e for e in events if "audit" in e["description"].lower()]
    return {"total_events": len(events), "denied": denied, "audit_blocks": audit}


def generate_baseline_policy():
    """Generate a baseline AppLocker policy recommendation."""
    return {
        "exe_rules": {
            "enforcement_mode": "Enforce",
            "default_rules": [
                {"action": "Allow", "path": "%PROGRAMFILES%\\*", "scope": "Everyone"},
                {"action": "Allow", "path": "%WINDIR%\\*", "scope": "Everyone"},
                {"action": "Allow", "path": "*", "scope": "BUILTIN\\Administrators"},
            ],
        },
        "script_rules": {
            "enforcement_mode": "Enforce",
            "default_rules": [
                {"action": "Allow", "path": "%PROGRAMFILES%\\*", "scope": "Everyone"},
                {"action": "Allow", "path": "%WINDIR%\\*", "scope": "Everyone"},
            ],
        },
        "dll_rules": {
            "enforcement_mode": "AuditOnly",
            "note": "Start with audit mode due to high volume",
        },
    }


def main():
    parser = argparse.ArgumentParser(description="AppLocker Whitelisting Agent")
    parser.add_argument("--policy", help="Exported AppLocker policy XML")
    parser.add_argument("--events", help="AppLocker event log (JSON lines)")
    parser.add_argument("--output", default="applocker_audit_report.json")
    parser.add_argument("--action", choices=["audit", "events", "baseline", "full"],
                        default="full")
    args = parser.parse_args()

    report = {"generated_at": datetime.utcnow().isoformat(), "findings": {}}

    if args.action in ("audit", "full") and args.policy:
        rules = parse_applocker_policy(args.policy)
        findings = audit_applocker_rules(rules)
        report["findings"]["policy_audit"] = findings
        report["findings"]["total_rules"] = len(rules)
        print(f"[+] Policy rules: {len(rules)}, Issues: {len(findings)}")

    if args.action in ("events", "full") and args.events:
        result = analyze_applocker_events(args.events)
        report["findings"]["event_analysis"] = result
        print(f"[+] Events: {result['total_events']}, Denied: {len(result['denied'])}")

    if args.action in ("baseline", "full"):
        baseline = generate_baseline_policy()
        report["findings"]["baseline_policy"] = baseline
        print("[+] Baseline policy generated")

    with open(args.output, "w") as fout:
        json.dump(report, fout, indent=2, default=str)
    print(f"[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
AppLocker Audit Log Analyzer

Parses Windows AppLocker audit event logs to identify blocked applications,
generate rule recommendations, and track policy effectiveness.
"""

import json
import csv
import sys
import os
import xml.etree.ElementTree as ET
from collections import defaultdict, Counter
from datetime import datetime


def parse_applocker_evtx_export(csv_path: str) -> list:
    """
    Parse AppLocker events exported from Event Viewer as CSV.
    Export: Event Viewer → AppLocker/EXE and DLL → Save All Events As → CSV
    """
    events = []

    with open(csv_path, "r", encoding="utf-8-sig") as f:
        reader = csv.DictReader(f)
        for row in reader:
            event = {
                "timestamp": row.get("Date and Time", ""),
                "event_id": row.get("Event ID", ""),
                "level": row.get("Level", ""),
                "source": row.get("Source", ""),
                "message": row.get("Message", ""),
                "user": "",
                "file_path": "",
                "file_hash": "",
                "publisher": "",
                "rule_name": "",
            }

            msg = event["message"]
            if msg:
                if "was allowed to run" in msg:
                    event["action"] = "allowed"
                elif "was prevented from running" in msg:
                    event["action"] = "blocked"
                elif "would have been prevented" in msg:
                    event["action"] = "audit_block"
                else:
                    event["action"] = "unknown"

                lines = msg.split("\n")
                for line in lines:
                    line = line.strip()
                    if line.startswith("File path:") or line.startswith("Filer path:"):
                        event["file_path"] = line.split(":", 1)[1].strip()
                    elif line.startswith("User:"):
                        event["user"] = line.split(":", 1)[1].strip()
                    elif line.startswith("Publisher name:"):
                        event["publisher"] = line.split(":", 1)[1].strip()
                    elif line.startswith("File hash:"):
                        event["file_hash"] = line.split(":", 1)[1].strip()
                    elif line.startswith("Rule name:"):
                        event["rule_name"] = line.split(":", 1)[1].strip()

            events.append(event)

    return events


def analyze_blocked_applications(events: list) -> dict:
    """Analyze which applications are being blocked and why."""
    analysis = {
        "total_events": len(events),
        "blocked_events": 0,
        "allowed_events": 0,
        "audit_block_events": 0,
        "unique_blocked_files": set(),
        "blocked_by_path": defaultdict(int),
        "blocked_by_user": defaultdict(int),
        "blocked_by_publisher": defaultdict(int),
        "top_blocked_files": Counter(),
        "user_writable_blocks": [],
        "potential_legitimate": [],
    }

    user_writable_indicators = [
        "\\users\\", "\\appdata\\", "\\temp\\", "\\downloads\\",
        "\\desktop\\", "\\documents\\", "%temp%", "%appdata%",
    ]

    signed_publishers = set()

    for event in events:
        action = event.get("action", "")
        if action in ("blocked", "audit_block"):
            analysis["blocked_events"] += 1
            file_path = event.get("file_path", "").lower()
            user = event.get("user", "Unknown")
            publisher = event.get("publisher", "Unknown")

            analysis["unique_blocked_files"].add(file_path)
            analysis["blocked_by_path"][file_path] += 1
            analysis["blocked_by_user"][user] += 1
            analysis["top_blocked_files"][file_path] += 1

            if publisher and publisher != "Unknown":
                analysis["blocked_by_publisher"][publisher] += 1
                signed_publishers.add(publisher)

            is_user_writable = any(ind in file_path for ind in user_writable_indicators)
            if is_user_writable:
                analysis["user_writable_blocks"].append({
                    "file": file_path,
                    "user": user,
                    "timestamp": event.get("timestamp", ""),
                })

            if publisher and publisher != "Unknown" and not is_user_writable:
                analysis["potential_legitimate"].append({
                    "file": file_path,
                    "publisher": publisher,
                    "user": user,
                    "recommendation": "Consider creating publisher rule",
                })

        elif action == "allowed":
            analysis["allowed_events"] += 1

        if action == "audit_block":
            analysis["audit_block_events"] += 1

    analysis["unique_blocked_files"] = len(analysis["unique_blocked_files"])
    analysis["signed_publishers_blocked"] = list(signed_publishers)

    return analysis


def generate_rule_recommendations(analysis: dict) -> list:
    """Generate AppLocker rule recommendations based on audit analysis."""
    recommendations = []

    for item in analysis.get("potential_legitimate", []):
        recommendations.append({
            "type": "publisher_rule",
            "action": "allow",
            "publisher": item["publisher"],
            "file": item["file"],
            "reason": f"Signed application blocked for user {item['user']}",
            "priority": "high",
        })

    top_blocked = analysis.get("top_blocked_files", Counter())
    for file_path, count in top_blocked.most_common(20):
        if count >= 10:
            is_in_recommendations = any(
                r["file"] == file_path for r in recommendations
            )
            if not is_in_recommendations:
                recommendations.append({
                    "type": "investigate",
                    "action": "review",
                    "file": file_path,
                    "count": count,
                    "reason": f"Blocked {count} times - determine if legitimate",
                    "priority": "medium",
                })

    return recommendations


def export_analysis_report(analysis: dict, recommendations: list, output_path: str) -> None:
    """Export analysis and recommendations to JSON report."""
    report = {
        "report_generated": datetime.utcnow().isoformat() + "Z",
        "summary": {
            "total_events": analysis["total_events"],
            "blocked": analysis["blocked_events"],
            "audit_blocked": analysis["audit_block_events"],
            "allowed": analysis["allowed_events"],
            "unique_blocked_files": analysis["unique_blocked_files"],
        },
        "top_blocked_files": dict(analysis["top_blocked_files"].most_common(30)),
        "blocked_by_user": dict(analysis["blocked_by_user"]),
        "signed_publishers_blocked": analysis.get("signed_publishers_blocked", []),
        "user_writable_path_blocks": len(analysis.get("user_writable_blocks", [])),
        "rule_recommendations": recommendations,
    }

    with open(output_path, "w", encoding="utf-8") as f:
        json.dump(report, f, indent=2)


def export_blocked_apps_csv(analysis: dict, output_path: str) -> None:
    """Export blocked applications to CSV for review."""
    with open(output_path, "w", newline="", encoding="utf-8") as f:
        writer = csv.writer(f)
        writer.writerow(["File Path", "Block Count", "Action Needed", "Rule Type"])
        for file_path, count in analysis["top_blocked_files"].most_common(100):
            writer.writerow([file_path, count, "Review", "TBD"])


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python process.py <applocker_events.csv>")
        print()
        print("Analyzes AppLocker audit events exported from Windows Event Viewer.")
        print("Export events from: Event Viewer → AppLocker/EXE and DLL → Save All Events As CSV")
        sys.exit(1)

    csv_path = sys.argv[1]
    if not os.path.exists(csv_path):
        print(f"Error: File not found: {csv_path}")
        sys.exit(1)

    print("Parsing AppLocker audit events...")
    events = parse_applocker_evtx_export(csv_path)
    print(f"Parsed {len(events)} events")

    print("Analyzing blocked applications...")
    analysis = analyze_blocked_applications(events)

    print("Generating rule recommendations...")
    recommendations = generate_rule_recommendations(analysis)

    base_name = os.path.splitext(os.path.basename(csv_path))[0]
    output_dir = os.path.dirname(csv_path) or "."

    report_path = os.path.join(output_dir, f"{base_name}_analysis.json")
    export_analysis_report(analysis, recommendations, report_path)
    print(f"Analysis report: {report_path}")

    blocked_csv = os.path.join(output_dir, f"{base_name}_blocked_apps.csv")
    export_blocked_apps_csv(analysis, blocked_csv)
    print(f"Blocked apps CSV: {blocked_csv}")

    print(f"\n--- AppLocker Audit Summary ---")
    print(f"Total events: {analysis['total_events']}")
    print(f"Blocked: {analysis['blocked_events']}")
    print(f"Audit-blocked: {analysis['audit_block_events']}")
    print(f"Unique blocked files: {analysis['unique_blocked_files']}")
    print(f"Rule recommendations: {len(recommendations)}")