diff --git a/main.py b/main.py index 2b2c585..80572c0 100644 --- a/main.py +++ b/main.py @@ -96,7 +96,7 @@ class SuspiciousFileHandler(FileSystemEventHandler): if event.event_type in ['created', 'modified', 'deleted']: file_owner = get_file_owner(event.src_path) current_user = getpass.getuser() # Get current user - if file_owner.lower() not in [current_user.lower(), "trustedinstaller", "unknown"]: + if file_owner.lower() not in [current_user.lower(), "trustedinstaller"]: print(f"Suspicious file operation: {event.event_type} {event.src_path} by {file_owner}") def get_file_owner(file_path): @@ -150,115 +150,4 @@ def get_gpu_usage(): for gpu in gpus: gpu_details = tf.config.experimental.get_memory_info(gpu.name) memory_total = gpu_details['total'] - memory_free = gpu_details['free'] - usage = (memory_total - memory_free) / memory_total * 100 - return usage - except Exception as e: - print(f"Error getting GPU usage: {e}") - return 0 - -def kill_suspicious_processes(): - for proc in psutil.process_iter(['pid', 'name', 'cmdline']): - try: - proc_name = proc.info['name'].lower() - cmdline = " ".join(proc.info['cmdline']).lower() - - if proc_name in mining_processes and proc_name not in bypassed_processes: - print(f"Terminating suspicious mining process: {proc.info['name']} (PID: {proc.info['pid']})") - proc.terminate() - proc.wait() - - # Check for crypto addresses in command line arguments - if (bitcoin_regex.search(cmdline) or - ethereum_regex.search(cmdline) or - monero_regex.search(cmdline)) and proc_name not in bypassed_processes: - print(f"Terminating process with crypto address: {proc.info['name']} (PID: {proc.info['pid']})") - proc.terminate() - proc.wait() - except (psutil.NoSuchProcess, psutil.AccessDenied) as e: - print(f"Error terminating process: {e}") - -# Monitor Registry Changes (Windows) -def monitor_registry_changes(): - reg_path = r"Software\Microsoft\Windows\CurrentVersion" - try: - registry_key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, reg_path, 0, winreg.KEY_READ) - while True: - try: - for i in range(winreg.QueryInfoKey(registry_key)[1]): # Number of subkeys - subkey_name = winreg.EnumKey(registry_key, i) - print(f"Registry subkey detected: {subkey_name}") - - time.sleep(10) - except WindowsError as e: - print(f"Registry monitoring error: {e}") - finally: - winreg.CloseKey(registry_key) - -# Verify TLS Certificates -def verify_tls_cert(url): - try: - response = requests.get(url, verify=certifi.where()) - print(f"TLS certificate valid for {url}") - except requests.exceptions.SSLError as e: - print(f"TLS certificate error for {url}: {e}") - -def monitor_tls_certificates(): - urls = [ - "https://google.com", - "https://discord.com" - # Add more URLs as needed - ] - while True: - for url in urls: - verify_tls_cert(url) - time.sleep(3600) # Check every hour - -# Detecting Suspicious Browser Activity -def monitor_browser(browser='chrome'): - if browser == 'chrome': - chrome_options = ChromeOptions() - chrome_options.add_argument('--enable-logging') - chrome_options.add_argument('--v=1') - service = ChromeService() - driver = webdriver.Chrome(service=service, options=chrome_options) - elif browser == 'firefox': - firefox_options = FirefoxOptions() - firefox_options.log.level = "TRACE" - service = FirefoxService() - driver = webdriver.Firefox(service=service, options=firefox_options) - else: - raise ValueError("Unsupported browser!") - - while True: - logs = driver.get_log('performance') - for entry in logs: - for url in monitored_urls: - if url in entry['message']: - print(f'Alert: Potential cookie or token theft attempt detected on {url}!') - - # Kill process involved in suspicious browser activity - for proc in psutil.process_iter(['pid', 'name', 'connections']): - if any(url in conn.raddr for conn in proc.info['connections']): - if proc.info['name'].lower() not in bypassed_processes: - print(f'Alert: Killing suspicious process {proc.info["name"]} (PID: {proc.info["pid"]})') - proc.terminate() - proc.wait() - time.sleep(1) - driver.quit() - -# Start Monitoring in Threads -threads = [ - threading.Thread(target=start_file_system_monitor), - threading.Thread(target=monitor_cpu_gpu_usage), - threading.Thread(target=monitor_registry_changes), - threading.Thread(target=monitor_tls_certificates), - threading.Thread(target=monitor_browser, args=('chrome',)), - threading.Thread(target=monitor_browser, args=('firefox',)) -] - -for thread in threads: - thread.start() - -for thread in threads: - thread.join() + memory_free = gpu_detai