#!/usr/bin/env python3
"""
procmon_summary.py - condense a Procmon CSV export into a behavior summary.

Runs on the host against evidence exported from the analysis VM
(Procmon: File -> Save -> All events -> CSV). Stdlib only.

Usage:
    python3 procmon_summary.py procmon.csv --process sample.exe
    python3 procmon_summary.py procmon.csv --all          # no process filter
    python3 procmon_summary.py --self-test

--process takes a comma list of image names (case-insensitive). The summary
covers those processes plus every descendant found via "Process Create".
Without --process (or with --all) every process in the log is included.

Output sections: process tree, files written/renamed/deleted, registry writes
(persistence keys flagged), network endpoints, non-system image loads.
Pipe the output through scripts/ioc_extract.py to get defanged IOCs.
"""

import argparse
import csv
import io
import re
import sys
from collections import defaultdict, OrderedDict

PERSISTENCE_RE = re.compile(
    r"CurrentVersion\\(Run|RunOnce|RunServices|Explorer\\(Shell Folders|User Shell Folders))"
    r"|CurrentControlSet\\Services\\"
    r"|Winlogon\\(Shell|Userinit|Notify)"
    r"|Image File Execution Options"
    r"|Windows\\CurrentVersion\\Policies\\Explorer\\Run"
    r"|Schedule\\TaskCache"
    r"|Office\\.*\\Security"
    r"|AppInit_DLLs"
    r"|Start Menu\\Programs\\Startup",
    re.IGNORECASE,
)
SYSTEM_DIR_RE = re.compile(r"^[A-Z]:\\Windows\\", re.IGNORECASE)
PID_RE = re.compile(r"PID:\s*(\d+)")
CMD_RE = re.compile(r"Command line:\s*(.*?)(?:,\s*Current directory:|$)", re.DOTALL)
NEWFILE_RE = re.compile(r"OpenResult:\s*(Created|Overwritten|Superseded)")


def read_text(path):
    """Read exported evidence regardless of PowerShell's default encoding (UTF-16LE with BOM)."""
    raw = open(path, "rb").read()
    if raw.startswith((b"\xff\xfe", b"\xfe\xff")):
        return raw.decode("utf-16", errors="replace")
    return raw.decode("utf-8-sig", errors="replace")


def load(path):
    return list(csv.DictReader(io.StringIO(read_text(path))))


def field(row, *names):
    for n in names:
        if n in row and row[n] is not None:
            return row[n]
    return ""


def build_tree(rows):
    """Return (children: pid -> [pid], info: pid -> (name, cmdline))."""
    children = defaultdict(list)
    info = {}
    for r in rows:
        op = field(r, "Operation")
        if op == "Process Create":
            m = PID_RE.search(field(r, "Detail"))
            if not m:
                continue
            child = m.group(1)
            parent = field(r, "PID")
            children[parent].append(child)
            cmd = CMD_RE.search(field(r, "Detail"))
            # name the child from the created image path (the actor row's name is the parent)
            created = field(r, "Path")
            child_name = created.rsplit("\\", 1)[-1] if created else "?"
            info.setdefault(child, [child_name or "?", cmd.group(1).strip() if cmd else ""])
        elif op == "Process Start":
            pid = field(r, "PID")
            cmd = CMD_RE.search(field(r, "Detail"))
            info[pid] = [field(r, "Process Name"), cmd.group(1).strip() if cmd else ""]
    for r in rows:  # fill names for processes seen only as actors
        pid = field(r, "PID")
        if pid and pid not in info:
            info[pid] = [field(r, "Process Name"), ""]
        elif pid in info and info[pid][0] == "?":
            info[pid][0] = field(r, "Process Name")
    return children, info


def descendants(seeds, children):
    seen, stack = set(), list(seeds)
    while stack:
        p = stack.pop()
        if p in seen:
            continue
        seen.add(p)
        stack.extend(children.get(p, []))
    return seen


def print_tree(pid, children, info, depth, out):
    name, cmd = info.get(pid, ("?", ""))
    out.append(f"{'  ' * depth}{name} (PID {pid})" + (f"  {cmd}" if cmd else ""))
    for c in children.get(pid, []):
        print_tree(c, children, info, depth + 1, out)


def summarize(rows, process_names=None):
    children, info = build_tree(rows)
    if process_names:
        wanted = {n.lower() for n in process_names}
        seeds = [pid for pid, (name, _) in info.items() if name.lower() in wanted]
        scope = descendants(seeds, children)
        roots = seeds
    else:
        scope = set(info)
        all_children = {c for cs in children.values() for c in cs}
        roots = [p for p in info if p not in all_children]

    files = OrderedDict()
    renames, deletes = OrderedDict(), OrderedDict()
    reg = OrderedDict()
    net = OrderedDict()
    loads = OrderedDict()
    counts = defaultdict(int)

    for r in rows:
        pid = field(r, "PID")
        if pid not in scope:
            continue
        op, path, detail = field(r, "Operation"), field(r, "Path"), field(r, "Detail")
        who = f"{field(r, 'Process Name')}:{pid}"
        counts[who] += 1
        if op == "CreateFile" and NEWFILE_RE.search(detail):
            files.setdefault(path, who)
        elif op == "WriteFile":
            files.setdefault(path, who)
        elif op == "SetRenameInformationFile":
            m = re.search(r"FileName:\s*(.*)$", detail)
            renames.setdefault(f"{path} -> {m.group(1) if m else '?'}", who)
        elif op in ("SetDispositionInformationFile", "SetDispositionInformationEx") and "True" in detail:
            deletes.setdefault(path, who)
        elif op in ("RegSetValue", "RegDeleteValue", "RegDeleteKey") or (
            op == "RegCreateKey" and "REG_CREATED_NEW_KEY" in detail
        ):
            data = ""
            m = re.search(r"Data:\s*(.*)$", detail)
            if m:
                data = m.group(1)
            reg.setdefault(f"{op} {path}" + (f" = {data}" if data else ""), who)
        elif op.startswith(("TCP", "UDP")) and "->" in path:
            dst = path.split("->", 1)[1].strip()
            net.setdefault(f"{op.split()[0]} {dst}", who)
        elif op == "Load Image" and not SYSTEM_DIR_RE.match(path):
            loads.setdefault(path, who)

    out = [f"# Procmon summary  ({len(rows)} events, {len(scope)} processes in scope)", "", "## Process tree"]
    for root in roots:
        print_tree(root, children, info, 0, out)

    def section(title, items, limit=200):
        out.extend(["", f"## {title} ({len(items)})"])
        for i, (k, who) in enumerate(items.items()):
            if i >= limit:
                out.append(f"... {len(items) - limit} more")
                break
            out.append(f"- {k}   [{who}]")

    section("Files created/written", files)
    section("Files renamed", renames)
    section("Files deleted", deletes)
    out.extend(["", f"## Registry writes ({len(reg)})"])
    for k, who in reg.items():
        flag = "  <-- PERSISTENCE" if PERSISTENCE_RE.search(k) else ""
        out.append(f"- {k}   [{who}]{flag}")
    section("Network endpoints", net)
    section("Image loads outside C:\\Windows", loads)
    out.extend(["", "## Event count per process"])
    for who, n in sorted(counts.items(), key=lambda x: -x[1])[:20]:
        out.append(f"- {who}: {n}")
    return "\n".join(out)


SELF_TEST_CSV = '''"Time of Day","Process Name","PID","Operation","Path","Result","Detail"
"1","explorer.exe","100","Process Create","C:\\Users\\Public\\sample.exe","SUCCESS","PID: 200, Command line: ""C:\\Users\\Public\\sample.exe"" /install"
"2","sample.exe","200","Process Start","","SUCCESS","Parent PID: 100, Command line: ""C:\\Users\\Public\\sample.exe"" /install, Current directory: C:\\Users\\Public\\"
"3","sample.exe","200","CreateFile","C:\\Users\\Bob\\AppData\\Roaming\\svc.exe","SUCCESS","Desired Access: Generic Write, OpenResult: Created"
"4","sample.exe","200","RegSetValue","HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\svc","SUCCESS","Type: REG_SZ, Length: 60, Data: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe"
"5","sample.exe","200","TCP Connect","host.local:49700 -> 203.0.113.5:443","SUCCESS","Length: 0"
"6","sample.exe","200","Process Create","C:\\Windows\\System32\\cmd.exe","SUCCESS","PID: 300, Command line: cmd.exe /c del sample.exe"
"7","cmd.exe","300","SetDispositionInformationFile","C:\\Users\\Public\\sample.exe","SUCCESS","Delete: True"
"8","chrome.exe","999","WriteFile","C:\\Users\\Bob\\cache.dat","SUCCESS","Offset: 0"
'''


def self_test():
    rows = list(csv.DictReader(io.StringIO(SELF_TEST_CSV)))
    out = summarize(rows, ["sample.exe"])
    assert "cmd.exe (PID 300)" in out and "  cmd.exe" in out, "child not nested under sample"
    assert "svc.exe" in out and "PERSISTENCE" in out, "persistence run key not flagged"
    assert "203.0.113.5:443" in out, "network endpoint missing"
    assert "cache.dat" not in out, "unrelated process leaked into scope"
    assert "Files deleted (1)" in out, "deletion missing"
    print("self-test OK")


def main():
    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
    ap.add_argument("csv", nargs="?")
    ap.add_argument("--process", help="comma list of image names to scope on (plus descendants)")
    ap.add_argument("--all", action="store_true", help="include every process")
    ap.add_argument("--self-test", action="store_true")
    a = ap.parse_args()
    if a.self_test:
        return self_test()
    if not a.csv:
        ap.error("csv path required")
    names = None if a.all or not a.process else [n.strip() for n in a.process.split(",")]
    print(summarize(load(a.csv), names))


if __name__ == "__main__":
    main()