WMI程式碼執行與檢測防禦策略

import wmi
import subprocess

def WMIProcessCreation(command):
    c = wmi.WMI()
    process = c.Win32_Process.Create(CommandLine=command)
    print("Process %s created with PID %s" % (command, process[0].ProcessId))

def PSProcessCreation(command):
    ps_command = f"powershell invoke-wmimethod win32_process -name create -argumentlist '{command}' | select ProcessId | %{{$_.ProcessId}}"
    p = subprocess.run(ps_command, shell=True, stdout=subprocess.PIPE)
    print("Process %s created with PowerShell, PID %s" % (command, p.stdout.decode("utf-8")))

command = "notepad.exe"
WMIProcessCreation(command)
PSProcessCreation(command)

import win32evtlog
import xml.etree.ElementTree as ET

server = "localhost"
logtype = "Microsoft-Windows-WMI-Activity/Trace"
flags = win32evtlog.EvtQueryForwardDirection
query = "*[System[EventID=23]]"

def GetEventLogs():
    q = win32evtlog.EvtQuery(logtype, flags, query)
    events = ()
    while True:
        e = win32evtlog.EvtNext(q, 100, -1, 0)
        if e:
            events = events + e
        else:
            break
    return events

def ParseEvents(events):
    for event in events:
        xml = win32evtlog.EvtRender(event, 1)
        root = ET.fromstring(xml)
        path = './{*}UserData/{*}ProcessCreate/{*}'
        name = root.findall(path+'Commandline')[0].text
        pid = root.findall(path+'CreatedProcessId')[0].text
        print("Process %s launched with PID %s" % (name, pid))

events = GetEventLogs()
ParseEvents(events)

import win32evtlog
import xml.etree.ElementTree as ET

# 定義查詢引數
path = 'Microsoft-Windows-WMI-Activity/Trace'
flags = win32evtlog.EvtQueryForwardDirection
query = '*[System[EventID=23]]'
session = None

# 執行查詢
query_handle = win32evtlog.EvtQuery(path, flags, query, session)

# 存取查詢結果
while True:
    events = win32evtlog.EvtNext(query_handle, 100, -1, 0)
    if len(events) == 0:
        break
    for event in events:
        # 將事件轉換為XML
        xml = win32evtlog.EvtRender(event, win32evtlog.EvtRenderEventXml)
        root = ET.fromstring(xml)
        
        # 解析XML以取得Commandline和CreatedProcessId
        command_line_nodes = root.findall('./{*}UserData/{*}ProcessCreate/{*}Commandline')
        process_id_nodes = root.findall('./{*}UserData/{*}ProcessCreate/{*}CreatedProcessId')
        
        if command_line_nodes and process_id_nodes:
            command_line = command_line_nodes[0].text
            process_id = process_id_nodes[0].text
            print(f"執行的命令：{command_line}，PID：{process_id}")

import os, random
from datetime import datetime, timedelta

if os.system("schtasks /query /tn SecurityScan") == 0:
    os.system("schtasks /delete /f /tn SecurityScan")

print("I am doing malicious things")
filedir = os.path.join(os.getcwd(), "TaskScheduler.py")
maxInterval = 1
interval = 1 + (random.random() * (maxInterval - 1))
dt = datetime.now() + timedelta(minutes=interval)
# 繼續執行排程任務相關程式碼...

import os
import random
from datetime import datetime, timedelta

# 計算下一次執行的時間和日期
dt = datetime.now() + timedelta(minutes=1+(random.random()*(1-1)))
t = "%s:%s" % (str(dt.hour).zfill(2), str(dt.minute).zfill(2))
d = "%s/%s/%s" % (str(dt.month).zfill(2), str(dt.day).zfill(2), dt.year)

# 建立排程任務
filedir = "惡意程式路徑"
os.system('schtasks /create /tn SecurityScan /tr \"%s\" /sc once /st %s /sd %s' % (filedir, t, d))

os.system('schtasks /query /tn SecurityScan')
os.system('schtasks /delete /f /tn SecurityScan')

import os
import pathlib
import subprocess

def CheckValidTask(creator, task):
    allowlist = ["Microsoft", "Mozilla", "Adobe Systems Incorporated"]
    extensions = [".exe", ".py", ".dll"]
    trusted = [creator for x in allowlist if creator.startswith(x)]
    executable = [task for ext in extensions if ext in task]
    
    if executable:
        exe = task.split(" ")[0]
        p = os.path.expandvars(exe).lower()
        if p.startswith(r"c:\\windows\\system32") or p.startswith(r"c:\windows\system32"):
            return True
        else:
            return trusted