fireeye/bitsparser

bitsparser's Issues

EXE file.

Great job.
Haven't you considered compiling the python source code in an EXE?
It would be nice for the blue teams to have the EXE in the repository

Data output to out_file during process but final file is zero bytes

Firstly, great tool, thank you for all your efforts.

When using Python 3.10.5 and running BitsParser.py, I noticed the output file growing in size in the filesystem, but then returning to zero bytes a number of times. At the end of the process, the output file is zero bytes.

I changed line 333: sys.stdout = open(self.out_file, "w")

Opening the out_file with "a" rather than "w" and this appeared to work for me, but there is probably a better way?

Syntax Error Line 554

When using python 3.9 or higher

\BitsParser.py:554: SyntaxWarning: "is not" with a literal. Did you mean "!="?
if type(v) is not 'Dict':
Traceback (most recent call last):

Invalid JSON

Thank you very much for sharing BitsParser!

I tried to convert the JSON output to CSV without success. I think the JSON objects should be comma separated in an array:

[
{
"JobType": "download",
"JobPriority": "foreground",
"JobState": "suspended",
"JobId": "e36fd920-5cb1-40c5-a372-000bf2a15625",
"JobName": "Microsoft Office Click-to-Run",
"OwnerSID": "S-1-5-18",
"Owner": "NT-AUTHORITY \SYSTEM",
"CreationTime": "2021-01-17T06:23:01Z",
"ModifiedTime": "2021-01-17T06:23:01Z"
},
{
"JobType": "download",
"JobPriority": "foreground",
"JobState": "suspended",
"JobId": "d97652de-7f08-4806-9df4-44fc98ce4b7a",
"JobName": "Microsoft Office Click-to-Run",
"OwnerSID": "S-1-5-18",
"Owner": "NT-AUTHORITY \SYSTEM",
"CreationTime": "2020-12-14T13:58:18Z",
"ModifiedTime": "2020-12-14T13:58:18Z"
}
]

Processing Json output

The current json output is not formatted to allow for easy processing of BitsParser output in additional tools. There is a small change that can make the output easier to process.

https://github.com/fireeye/BitsParser/blob/master/BitsParser.py#L341

Current output code:

# Output unique jobs
if job.hash not in self.visited_jobs:
    formatted_job = json.dumps(job.job_dict, indent=4)
    print(formatted_job)

Potential change:

# Output unique jobs
if job.hash not in self.visited_jobs:
    json.dump(job.job_dict, sys.stdout)
    print()

The print() call is needed to ensure each result in the output file is on a separate line.

Maybe an option could be added to specify output type.