From ac7cecf231e98c7f104d4c2b8fb569cafb977409 Mon Sep 17 00:00:00 2001 From: KevTheHermit Date: Tue, 18 Jan 2022 20:42:38 +0000 Subject: [PATCH] add timeliner output to windows.sessions --- volatility3/framework/plugins/windows/sessions.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/sessions.py b/volatility3/framework/plugins/windows/sessions.py index 66a54c3f0..6745e95ec 100644 --- a/volatility3/framework/plugins/windows/sessions.py +++ b/volatility3/framework/plugins/windows/sessions.py @@ -9,11 +9,12 @@ from volatility3.framework import renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.plugins.windows import pslist +from volatility3.plugins import timeliner vollog = logging.getLogger(__name__) -class Sessions(interfaces.plugins.PluginInterface): +class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """lists Processes with Session information extracted from Environmental Variables""" _required_framework_version = (2, 0, 0) @@ -87,6 +88,15 @@ class Sessions(interfaces.plugins.PluginInterface): yield 0, (row.get('session_id'), row.get('session_type'), row.get('process_id'), row.get('process_name'), row.get('user_name'), row.get('process_start')) + def generate_timeline(self): + for row in self._generator(): + _depth, row_data = row + # Only add to timeline if we have the username + # Without the user context PSList output is identical + if isinstance(row_data[4], str): + description = f"Process: {row_data[2]} {row_data[3]} started by user {row_data[4]}" + yield (description, timeliner.TimeLinerType.CREATED, row_data[5]) + def run(self): return renderers.TreeGrid([("Session ID", int), ('Session Type', str), ("Process ID", int), ("Process", str),