mysticmomba/AirlockTools
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

ALL AT PATHS TOOL

Browse Source
This commit is contained in:
=
2025-09-18 15:19:19 -04:00
parent 3eae73150f
commit f4d27b4e64
3 changed files with 242 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AirlockTools.py
+75 -18
View File
@@ -35,11 +35,34 @@ dotenv.load_dotenv()
url = os.getenv('url')
bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"]
pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"]
badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"]
badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3
path_exclusion_constant = 4
min_files_for_path = 4
threat_tolerance_constant = 4
"""
Execution Types
0 = "Trusted Execution",
1 = "Blocked Execution",
2 = "Untrusted Execution [Audit]",
3 = "Untrusted Execution [OTP]",
4 = "Trusted Path Execution",
5 = "Trusted Publisher Execution",
6 = "Blocklist Execution",
7 = "Blocklist Execution [Audit]",
8 = "Trusted Process Execution",
9 = "Constrained Execution",
10 = "Trusted Metadata Execution",
11 = "Trusted Browser Execution",
12 = "Blocked Browser Execution",
13 = "Untrusted Browser Execution [Audit]",
14 = "Untrusted Browser Execution [OTP]",
15 = "Blocklist Browser Execution [Audit]",
16 = "Blocklist Browser Execution",
17 = "Trusted Installer Execution",
18 = "Trusted Browser Metadata Execution"
"""
def main():
parser = argparse.ArgumentParser(description="Your script description")
@@ -149,22 +172,56 @@ def menu_otp():
print("Invalid choice. Please try again.")
def menu_feature2():
while True:
print("\n--- Submenu ---")
print("1. Sub-option A")
print("2. Sub-option B")
print("3. Return to Main Menu")
choice = input("Enter your choice: ")
while True:
print("\n--- Submenu ---")
print("1. Pull last 24 horus execution for all ATPolicys")
print("2. Generate Paths")
print("3 Merge")
print("Q. Exit")
choice = input("Enter your choice: ")
if choice == "1":
print("You selected Sub-option A")
elif choice == "2":
print("You selected Sub-option B")
elif choice == "3":
print("Returning to Main Menu...")
break
else:
print("Invalid choice. Please try again.")
if choice == "1":
# Get the AT policies dictionary
atpolicies = utils.policyfunctions.listATPolicies(url)
# List to hold each policy's DataFrame
all_dfs = []
# Loop through each policy name
for policy_name in atpolicies:
try:
# Get the policy info DataFrame
df = utils.policyfunctions.getPolicyInfo(url, policy_name, [1, 2, 6, 7], 1, False)
# Add a column to indicate the policy name
df['PolicyName'] = policy_name
# Append to the list
all_dfs.append(df)
except Exception as e:
print(f"Error processing policy '{policy_name}': {e}")
# Combine all DataFrames into one
if all_dfs:
combined_df = pd.concat(all_dfs, ignore_index=True)
print("✅ Combined DataFrame created.")
else:
combined_df = pd.DataFrame()
print("⚠️ No data was retrieved.")
combined_df.to_csv("allATPolicyExecs.csv", index=False)
elif choice == "2":
utils.pathfunctions.allATpaths(url,pups, bad_publisher_list, badpathparts, threat_tolerance_constant, 3, min_files_for_path)
elif choice == "3":
utils.pathfunctions.mergeTesting()
elif choice == "Q":
break
else:
print("Invalid choice. Please try again.")
def menu_prepare_to_enforce():
@@ -222,10 +279,10 @@ def menu_prepare_to_enforce():
if not os.path.exists(f"parquet\\execution_history_{first_policy}.parquet"):
utils.policyfunctions.getPolicyInfo(url, first_policy, history_days)
utils.policyfunctions.getPolicyInfo(url, first_policy, [1,2,6,7], history_days)
if not os.path.exists(f"parquet\\execution_history_{second_policy}.parquet"):
utils.policyfunctions.getPolicyInfo(url, second_policy, history_days)
utils.policyfunctions.getPolicyInfo(url, second_policy, [1,2,6,7], history_days)
if not os.path.exists(f"parquet\\combined_hashlist_{first_policy}_{second_policy}.parquet"):
utils.hashfunctions.combineHashes(url, first_policy, second_policy)