does anybody know a good tool for analyzation of process tracking event
log messages (id 592 and 593) in windows 2000/2003? but please do not tell
me about:
since it is very lame (parsing the resulted file in Excel for example is
very problematic). I would like to have the report, which would display:
1) the names of all the processes ever run in the system.
2) for each process form point 1, I would like to see *how* it was
created, i.e. by which parent processes. this is IMO extremely important
for discovering things like cmd.exe started by sqlserv.exe for example,
which is the obvious sign of some simple shellcodes.
I have spent some time researching process hiding techniques (aka
rootkits), some smart ways of discovering these hidden processes, and
another methods of better hiding, etc... however, I realized, that maybe
this all hide and seek game is not necessary, since windows admins seem to
not have any good tool for accounting even unhidden processes...
Protect your network against hackers, viruses, spam and other risks with
Astaro Security Linux, the comprehensive security solution that combines six
applications in one software solution for ease of use and lower total cost
of ownership.
Download your free trial at
http://www.securityfocus.com/sponsor/Astaro_focus-ms_040301
------------------------------------------------------------------------
---
does anybody know a good tool for analyzation of process tracking event
log messages (id 592 and 593) in windows 2000/2003? but please do not tell
me about:
dumpel -f procs.txt -e 592 593 -m security -l security
since it is very lame (parsing the resulted file in Excel for example is
very problematic). I would like to have the report, which would display:
1) the names of all the processes ever run in the system.
2) for each process form point 1, I would like to see *how* it was
created, i.e. by which parent processes. this is IMO extremely important
for discovering things like cmd.exe started by sqlserv.exe for example,
which is the obvious sign of some simple shellcodes.
I have spent some time researching process hiding techniques (aka
rootkits), some smart ways of discovering these hidden processes, and
another methods of better hiding, etc... however, I realized, that maybe
this all hide and seek game is not necessary, since windows admins seem to
not have any good tool for accounting even unhidden processes...
regards,
joanna.
------------------------------------------------------------------------
---
Free 30-day trial: firewall with virus/spam protection, URL filtering, VPN,
wireless security
Protect your network against hackers, viruses, spam and other risks with
Astaro Security Linux, the comprehensive security solution that combines six
applications in one software solution for ease of use and lower total cost
of ownership.
Download your free trial at
http://www.securityfocus.com/sponsor/Astaro_focus-ms_040301
------------------------------------------------------------------------
---
[ reply ]