WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 10:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

add timeliner output to windows.sessions

Browse Source
This commit is contained in:
KevTheHermit
2022-01-18 20:42:38 +00:00
parent be0dd49d31
commit ac7cecf231
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/sessions.py
+11 -1
View File
@@ -9,11 +9,12 @@ from volatility3.framework import renderers, interfaces
from volatility3.framework.configuration import requirements
from volatility3.framework.objects import utility
from volatility3.plugins.windows import pslist
from volatility3.plugins import timeliner
vollog = logging.getLogger(__name__)
class Sessions(interfaces.plugins.PluginInterface):
class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
"""lists Processes with Session information extracted from Environmental Variables"""
_required_framework_version = (2, 0, 0)
@@ -87,6 +88,15 @@ class Sessions(interfaces.plugins.PluginInterface):
yield 0, (row.get('session_id'), row.get('session_type'), row.get('process_id'),
row.get('process_name'), row.get('user_name'), row.get('process_start'))
def generate_timeline(self):
for row in self._generator():
_depth, row_data = row
# Only add to timeline if we have the username
# Without the user context PSList output is identical
if isinstance(row_data[4], str):
description = f"Process: {row_data[2]} {row_data[3]} started by user {row_data[4]}"
yield (description, timeliner.TimeLinerType.CREATED, row_data[5])
def run(self):
return renderers.TreeGrid([("Session ID", int), ('Session Type', str), ("Process ID", int), ("Process", str),