Day 17/90: Working with Processes -- Python Security
Day 17/90: Working with Processes -- Python Security
90 Day Python Security Scripting Challenge
Process analysis is core to incident response on any operating system. Today we use psutil to build practical triage tooling.
Process Inventory with Security Context
During triage you need more than just a process name. You need the owning user, the full command line, parent PID for process tree reconstruction, and the executable path to verify it is running from a legitimate location.
import psutil
from datetime import datetime
def security_inventory():
"""Build a process inventory with fields relevant to IR triage."""
inventory = []
for proc in psutil.process_iter(
['pid', 'ppid', 'name', 'exe', 'username', 'cmdline', 'create_time']
):
try:
info = proc.info
inventory.append({
'pid': info['pid'],
'ppid': info['ppid'],
'name': info['name'],
'exe_path': info['exe'],
'user': info['username'],
'cmdline': ' '.join(info['cmdline'] or []),
'age_seconds': (
datetime.now() - datetime.fromtimestamp(info['create_time'])
).total_seconds(),
})
except (psutil.NoSuchProcess, psutil.AccessDenied):
continue
return inventory
recent = [p for p in security_inventory() if p['age_seconds'] < 300]
for p in recent:
exe = p['exe_path'] or 'unknown'
suspicious_paths = ['/tmp', '/dev/shm', 'AppData/Local/Temp']
flag = ' [SUSPICIOUS PATH]' if any(sp in exe for sp in suspicious_paths) else ''
print(f"NEW: PID={p['pid']} user={p['user']} exe={exe}{flag}")
Adding parent PID lets you reconstruct process trees. If PID 4500 spawned from PID 1200 which is svchost.exe, that tells a different story than if it spawned from cmd.exe running under a web server user.
Continuous Resource Monitoring
A single snapshot misses intermittent activity. Real monitoring samples repeatedly and builds a statistical baseline.
import psutil
import time
import statistics
def monitor_resources(duration=60, sample_interval=5):
"""Monitor process resources over a time window and report outliers."""
cpu_history = {}
for elapsed in range(0, duration, sample_interval):
for proc in psutil.process_iter(['pid', 'name']):
try:
cpu = proc.cpu_percent(interval=0.05)
pid = proc.info['pid']
if pid not in cpu_history:
cpu_history[pid] = {'name': proc.info['name'], 'samples': []}
cpu_history[pid]['samples'].append(cpu)
except (psutil.NoSuchProcess, psutil.AccessDenied):
continue
time.sleep(sample_interval)
outliers = []
for pid, data in cpu_history.items():
if len(data['samples']) >= 3:
avg = statistics.mean(data['samples'])
if avg > 25:
outliers.append({
'pid': pid, 'name': data['name'],
'avg_cpu': round(avg, 1),
'samples': len(data['samples'])
})
return sorted(outliers, key=lambda x: x['avg_cpu'], reverse=True)
for proc in monitor_resources(duration=30, sample_interval=5):
print(f"OUTLIER: {proc['name']} PID={proc['pid']} avg_cpu={proc['avg_cpu']}%")
Network Connection Forensics
The most common question during an incident: what is this process talking to?
import psutil
def external_connections(
private_prefixes=('10.', '172.16.', '172.17.', '172.18.', '172.19.',
'172.20.', '172.21.', '172.22.', '172.23.', '172.24.',
'172.25.', '172.26.', '172.27.', '172.28.', '172.29.',
'172.30.', '172.31.', '192.168.', '127.')
):
"""Find processes with connections to non-private IP addresses."""
external = []
for conn in psutil.net_connections(kind='inet'):
if not conn.raddr or conn.pid is None:
continue
rip = conn.raddr.ip
if any(rip.startswith(prefix) for prefix in private_prefixes):
continue
try:
proc = psutil.Process(conn.pid)
external.append({
'pid': conn.pid,
'process': proc.name(),
'user': proc.username(),
'remote': f"{rip}:{conn.raddr.port}",
'status': conn.status,
})
except (psutil.NoSuchProcess, psutil.AccessDenied):
external.append({
'pid': conn.pid, 'process': 'unknown',
'remote': f"{rip}:{conn.raddr.port}",
'status': conn.status
})
return external
for conn in external_connections():
print(f"{conn['process']} (PID {conn['pid']}) -> {conn['remote']} [{conn['status']}]")
Safe Process Termination
The IR-safe kill pattern: freeze, document, terminate.
import psutil
import json
from pathlib import Path
from datetime import datetime, timezone
def ir_terminate(pid, case_id, analyst):
"""Freeze process, capture state, then terminate with chain of custody."""
proc = psutil.Process(pid)
proc.suspend()
state = {
'case_id': case_id,
'analyst': analyst,
'timestamp': datetime.now(timezone.utc).isoformat(),
'process': {
'pid': pid, 'name': proc.name(),
'exe': proc.exe(), 'cmdline': proc.cmdline(),
'user': proc.username()
},
'network': [
{'remote': f"{c.raddr.ip}:{c.raddr.port}" if c.raddr else None}
for c in proc.net_connections()
],
'files': [f.path for f in proc.open_files()],
'children': [c.pid for c in proc.children(recursive=True)],
}
evidence_dir = Path('evidence') / case_id
evidence_dir.mkdir(parents=True, exist_ok=True)
evidence_file = evidence_dir / f"proc_{pid}.json"
evidence_file.write_text(json.dumps(state, indent=2))
proc.terminate()
return str(evidence_file)
Key Takeaways
Process triage with psutil gives you structured, cross-platform data that is far more reliable than parsing command output. The suspend-snapshot-terminate pattern preserves evidence. Multi-sample resource monitoring reduces false positives compared to single snapshots.
Day 17/90 of the 90 Day Python Security Scripting Challenge