//Parse the CSVfile to a class public static List <CSVfileHandler> CSVparser(string path) { List <CSVfileHandler> output = new List <CSVfileHandler>(); StreamReader sr = new StreamReader(path); string line; string[] row = new string[7]; line = sr.ReadLine(); while ((line = sr.ReadLine()) != null) { row = line.Split(new string[] { "\",\"" }, StringSplitOptions.None); CSVfileHandler temp = new CSVfileHandler(); for (int i = 0; i < row.Length; i++) { switch (i) { case 0: temp.timeOfDay = row[i].Substring(1); break; case 1: temp.processName = row[i]; break; case 2: int x = 0; Int32.TryParse(row[i], out x); temp.PID = x; break; case 3: temp.operation = row[i]; break; case 4: temp.path = row[i]; break; case 5: temp.result = row[i]; break; case 6: temp.detail = row[i]; break; default: break; } } output.Add(temp); } return(output); }
//A change has been registered to a honeypot public static void honeypotChange(string path) { //Shut down procmon in order to get logfile ProcMon.procmonTerminator(pathToBackingFile, BACKINGNAME + INDEXER); INDEXER++; //Start up procmon with a new backingfile var cpmbf = new Thread(() => ProcMon.createProcmonBackingFile(pathToBackingFile, BACKINGNAME + INDEXER)); cpmbf.Start(); Thread.Sleep(3000); //Convert the PMLfile to CSV ProcMon.convertPMLfileToCSV(pathToBackingFile, BACKINGNAME + (INDEXER - 1) + ".PML", "convertedFile" + (INDEXER - 1) + ".CSV"); bool hasCSVbeenWritten = false; Console.WriteLine("Path to CSV file: " + pathToBackingFile + "\\" + "convertedFile" + (INDEXER - 1) + ".CSV"); //Wait for the conversion to be completed while (hasCSVbeenWritten == false) { try { using (Stream stream = new FileStream(pathToBackingFile + "\\" + "convertedFile" + (INDEXER - 1) + ".CSV", FileMode.Open)) { hasCSVbeenWritten = true; stream.Dispose(); } } catch (IOException) { } Thread.Sleep(50); } //Parse the CSVfile List <CSVfileHandler> parsedData = CSVfileHandler.CSVparser(pathToBackingFile + "\\" + "convertedFile" + (INDEXER - 1) + ".CSV"); //Kill every process that has touched a honeypot foreach (var item in parsedData) { if (!item.processName.Equals("Explorer.EXE") || !item.processName.Equals("HoneyPotFilemon.exe")) { try { pID.Add(item.PID); killedProcesses.Add(Process.GetProcessById(item.PID).ProcessName); try { Console.WriteLine("Process: " + Process.GetProcessById(item.PID).ProcessName + " is killed due to suspicious behaviour"); killProcess(item.PID); } catch (Exception) { //Save processname as a temp Console.WriteLine("Killing of the process failed"); } } catch { } } } if (!killedFirstProcess) { firstKilledProcessTime = DateTime.Now; killedFirstProcess = true; } }