DllList & Handles

noname1007 · Jul 12, 2022 · fe2834d · fe2834d
1 parent 30f711c
commit fe2834d
Show file tree

Hide file tree

Showing 25 changed files with 331 additions and 190 deletions.
diff --git a/dashboard/static/js/windows.js b/dashboard/static/js/windows.js
@@ -1,163 +1,3 @@
-/* highlight functionnality */
-$('#processCacheTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-
-
-$('#processTreeTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-$('#processScanTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-
-$('#UserAssistTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-$('#processEnvTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-$('#processCmdTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-$('#processPrivilegesTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-
-$('#processNetworkTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-
-$('#TimelineTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-
-$('#FileScanTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-$('#IOCTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-$('#processHashTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-
-$('#processCacheTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-$('#processLsaTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
-$('#processNetworkStatTable').on('click', 'tbody tr', function(event) {
-  var table = $(this);
-  if (table.hasClass("highlight")){
-    table.removeClass("highlight");
-  }
-  else{
-    table.addClass("highlight");
-  }
-});
-
 $(document).ready(function(){
   $('.container').show();
   $('.container-fluid').show();
@@ -169,6 +9,17 @@ $(document).ready(function(){
   $('#main').show();
   $('#loading').hide();
 
+  /* highlight functionnality */
+  $('.artifacts').on('click', 'tbody tr', function(event) {
+    var table = $(this);
+    if (table.hasClass("highlight")){
+      table.removeClass("highlight");
+    }
+    else{
+      table.addClass("highlight");
+    }
+  });
+
   /* Search bar Functionnality for each plugin */
   $("#searchProcess").on("keyup", function() {
     var value = $(this).val().toLowerCase();
@@ -380,3 +231,13 @@ $(document).ready(function(){
     $('.Case').show();
   });
 });
+
+$("#DllListLink").on("click", function(){
+  $('.plugin').hide();
+  $('.DllList').show();
+});
+
+$("#HandlesLink").on("click", function(){
+  $('.plugin').hide();
+  $('.Handles').show();
+});
diff --git a/investigations/templates/investigations/reviewinvest.html b/investigations/templates/investigations/reviewinvest.html
@@ -52,6 +52,9 @@
             {% include "investigations/windows/process_artifacts/process_privileges.html" %}
             {% include "investigations/windows/process_artifacts/process_cmdline.html" %}
             {% include "investigations/windows/process_artifacts/process_env.html" %}
+            {% include "investigations/windows/process_artifacts/process_handles.html" %}
+            {% include "investigations/windows/process_artifacts/process_dlllist.html" %}
+
 
             <!-- Network Artifacts -->
             {% include "investigations/windows/network_artifacts/network_scan.html" %}

diff --git a/investigations/templates/investigations/windows/ma_artifacts/ma_filescan.html b/investigations/templates/investigations/windows/ma_artifacts/ma_filescan.html
@@ -3,7 +3,7 @@
   <div class="d-inline">
     <input class="form-control mb-3" id="searchFileScan" type="text" placeholder="Search..">
   </div>
-  <table style="table-layout:fixed;" id="FileScanTable" class="table table-light card-font table-condensed filescan">
+  <table style="table-layout:fixed;" class="table artifacts table-light card-font table-condensed filescan">
     <thead>
       <tr>
         <th scope="col">Offset</th>

diff --git a/investigations/templates/investigations/windows/ma_artifacts/ma_iocs.html b/investigations/templates/investigations/windows/ma_artifacts/ma_iocs.html
@@ -3,7 +3,7 @@
   <div class="d-inline">
     <input class="form-control mb-3" id="searchIOC" type="text" placeholder="Search..">
   </div>
-  <table id="IOCTable" class="table  table-light card-font ioc">
+  <table class="table artifacts table-light card-font ioc">
     <thead>
       <tr>
         <th scope="col">Physical Address</th>

diff --git a/investigations/templates/investigations/windows/ma_artifacts/ma_skeleton.html b/investigations/templates/investigations/windows/ma_artifacts/ma_skeleton.html
@@ -1,6 +1,6 @@
 <!-- Investigation malware_analysis_skeleton_key_check -->
 <div class="collapse mt-5 SkeletonKeyCheck plugin">
-  <table id="SkeletonTable" class="table table-light  card-font skeleton">
+  <table class="table artifacts table-light card-font skeleton">
     <thead>
       <tr>
         <th scope="col">PID</th>

diff --git a/investigations/templates/investigations/windows/ma_artifacts/ma_timeline.html b/investigations/templates/investigations/windows/ma_artifacts/ma_timeline.html
@@ -4,7 +4,7 @@
   <div class="d-inline">
     <input class="form-control mb-3" id="searchTimeline" type="text" placeholder="Search..">
   </div>
-  <table id="TimelineTable" class="table table-light  card-font timeline">
+  <table class="table table-light artifacts card-font timeline">
     <thead>
       <tr>
         <th scope="col">Accessed Date</th>

diff --git a/investigations/templates/investigations/windows/network_artifacts/network_scan.html b/investigations/templates/investigations/windows/network_artifacts/network_scan.html
@@ -3,7 +3,7 @@
   <div class="d-inline">
     <input class="form-control mb-3" id="searchNetwork" type="text" placeholder="Search..">
   </div>
-  <table id="processNetworkTable" class="table table-light  card-font netscan">
+  <table class="table table-light artifacts card-font netscan">
     <thead>
       <tr>
         <th scope="col">Created</th>

diff --git a/investigations/templates/investigations/windows/network_artifacts/network_stat.html b/investigations/templates/investigations/windows/network_artifacts/network_stat.html
@@ -3,7 +3,7 @@
   <div class="d-inline">
     <input class="form-control mb-3" id="searchNetworkStat" type="text" placeholder="Search..">
   </div>
-  <table id="processNetworkStatTable" class="table table-light  card-font netstat">
+  <table class="table artifacts table-light  card-font netstat">
     <thead>
       <tr>
         <th scope="col">Created</th>

diff --git a/investigations/templates/investigations/windows/process_artifacts/process_cmdline.html b/investigations/templates/investigations/windows/process_artifacts/process_cmdline.html
@@ -4,7 +4,7 @@ <h6 class="h6 text-dark">Process Command Line</h6>
   <div class="d-inline">
     <input class="form-control mb-3" id="searchCmdLine" type="text" placeholder="Search..">
   </div>
-  <table id="processCmdTable" class="table table-light  card-font processcmdline">
+  <table class="table table-light artifacts card-font processcmdline">
     <thead>
       <tr>
         <th scope="col">PID</th>

diff --git a/investigations/templates/investigations/windows/process_artifacts/process_dlllist.html b/investigations/templates/investigations/windows/process_artifacts/process_dlllist.html
@@ -0,0 +1,35 @@
+<!-- Investigation process_dlllist artifacts -->
+<div class="mt-5 DllList plugin text-white">
+  <h6 class="h6">dll list</h6>
+  <div class="d-inline">
+    <input class="form-control mb-3" id="searchdll" type="text" placeholder="Search..">
+  </div>
+  <table class="table table-light artifacts card-font dlllist">
+    <thead>
+      <tr>
+        <th scope="col">Process</th>
+        <th scope="col">PID</th>
+        <th scope="col">Base</th>
+        <th scope="col">Name</th>
+        <th scope="col">Path</th>
+        <th scope="col">Size</th>
+        <th scope="col">LoadTime</th>
+        <th scope="col">Fileoutput</th>
+      </tr>
+    </thead>
+    <tbody id="dlllist">
+      {% for process in DllList %}
+      <tr>
+        <td>{{process.Process}}</td>
+        <td>{{process.PID}}</td>
+        <td>{{process.Base}}</td>
+        <td>{{process.Name}}</td>
+        <td>{{process.Path}}</td>
+        <td>{{process.Size}}</td>
+        <td>{{process.LoadTime}}</td>
+        <td>{{process.Fileoutput}}</td>
+      </tr>
+      {% endfor %}
+    </tbody>
+  </table>
+</div>
diff --git a/investigations/templates/investigations/windows/process_artifacts/process_env.html b/investigations/templates/investigations/windows/process_artifacts/process_env.html
@@ -4,7 +4,7 @@ <h6 class="h6">Process Environnement Variables</h6>
   <div class="d-inline">
     <input class="form-control mb-3" id="searchEnv" type="text" placeholder="Search..">
   </div>
-  <table id="processEnvTable" class="table table-light  card-font processenv">
+  <table class="table table-light artifacts card-font processenv">
     <thead>
       <tr>
         <th scope="col">Block</th>

diff --git a/investigations/templates/investigations/windows/process_artifacts/process_handles.html b/investigations/templates/investigations/windows/process_artifacts/process_handles.html
@@ -0,0 +1,33 @@
+<!-- Investigation process_handles artifacts -->
+<div class="mt-5 Handles plugin text-white">
+  <h6 class="h6">Process Handles</h6>
+  <div class="d-inline">
+    <input class="form-control mb-3" id="searchHandles" type="text" placeholder="Search..">
+  </div>
+  <table class="table table-light card-font handles artifacts">
+    <thead>
+      <tr>
+        <th scope="col">Process</th>
+        <th scope="col">PID</th>
+        <th scope="col">Offset</th>
+        <th scope="col">Name</th>
+        <th scope="col">HandleValue</th>
+        <th scope="col">GrantedAccess</th>
+        <th scope="col">Type</th>
+      </tr>
+    </thead>
+    <tbody id="processHandles">
+      {% for entry in Handles %}
+      <tr>
+        <td>{{entry.Process}}</td>
+        <td>{{entry.PID}}</td>
+        <td>{{entry.Offset}}</td>
+        <td>{{entry.Name}}</td>
+        <td>{{entry.HandleValue}}</td>
+        <td>{{entry.GrantedAccess}}</td>
+        <td>{{entry.Type}}</td>
+      </tr>
+      {% endfor %}
+    </tbody>
+  </table>
+</div>
diff --git a/investigations/templates/investigations/windows/process_artifacts/process_privileges.html b/investigations/templates/investigations/windows/process_artifacts/process_privileges.html
@@ -4,7 +4,7 @@ <h6 class="h6">Process Privileges</h6>
   <div class="d-inline">
     <input class="form-control mb-3" id="searchPriv" type="text" placeholder="Search..">
   </div>
-  <table id="processPrivilegesTable" class="table table-light  card-font processpriv">
+  <table class="table table-light artifacts card-font processpriv">
     <thead>
       <tr>
         <th scope="col">PID</th>

diff --git a/investigations/templates/investigations/windows/process_artifacts/process_scan.html b/investigations/templates/investigations/windows/process_artifacts/process_scan.html
@@ -3,7 +3,7 @@ <h6 class="h6">Process Scan</h6>
   <div class="d-inline">
     <input class="form-control mb-3" id="searchProcessScan" type="text" placeholder="Search..">
   </div>
-  <table id="processScanTable" class="table table-light  card-font processcan">
+  <table class="table table-light artifacts card-font processcan">
     <thead>
       <tr>
         <th scope="col">PID</th>

diff --git a/investigations/templates/investigations/windows/reg_artifacts/reg_hivelist.html b/investigations/templates/investigations/windows/reg_artifacts/reg_hivelist.html
@@ -1,6 +1,6 @@
 <!-- Investigation registry_hivelist artifacts -->
 <div class="text-white mt-5 plugin HiveList">
-  <table id="hivelistTable" class="table table-light  card-font hivelist">
+  <table class="table artifacts table-light  card-font hivelist">
     <thead>
       <tr>
         <th scope="col">FileFullPath</th>

diff --git a/investigations/templates/investigations/windows/reg_artifacts/reg_userassist.html b/investigations/templates/investigations/windows/reg_artifacts/reg_userassist.html
@@ -4,7 +4,7 @@ <h6 class="h6 text-dark">User Assist</h6>
   <div class="d-inline">
     <input class="form-control mb-3" id="searchUserAssist" type="text" placeholder="Search..">
   </div>
-  <table id="UserAssistTable" class="table table-light  card-font userassist">
+  <table class="table artifacts table-light card-font userassist">
     <thead>
       <tr>
         <th scope="col">HiveOffset</th>