Sysmon

package           : tis-sysmon
version           : 13.24-0
architecture      : x86
section           : base
priority          : optional
name              : Sysmon
categories        : Utilities,System and network
maintainer        : WAPT Team,Tranquil IT,Kenan KILICARSLAN,Gaëtan SEGAT
description       : System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log
depends           : 
conflicts         : 
maturity          : PROD
locale            : all
target_os         : windows
min_wapt_version  : 1.7
sources           : https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
installed_size    : 2592768
impacted_process  : Sysmon
description_fr    : System Monitor (Sysmon) est un service système Windows et un pilote de périphérique qui, une fois installé sur un système, reste lors des redémarrages du système pour surveiller et enregistrer l'activité du système dans le journal des événements Windows
description_pl    : 
description_de    : 
description_es    : 
description_pt    : 
description_it    : 
description_nl    : 
description_ru    : 
audit_schedule    : 
editor            : Microsoft Sysinternals
keywords          : device,driver,monitor,service,log
licence           : GPL-3.0
homepage          : https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
package_uuid      : 864f3142-72b1-44da-b7bb-f74afa611d97
valid_from        : 
valid_until       : 
forced_install_on : 
changelog         : 
min_os_version    : 6.1
max_os_version    : 
icon_sha256sum    : a5196572c8f3680ec6166ef070c8d843ab8511ffdd2de859adb1f5eed7efb35d
signer            : Tranquil IT
signer_fingerprint: 8c5127a75392be9cc9afd0dbae1222a673072c308c14d88ab246e23832e8c6bb
signature         : exJHX5LkIlKoVK9yl0O47JxTI/69LKJNkqycMjEhZePkI8W7b3Yaz5bDFNIl11ByAItM3wyfl24sJHiH+FheCi10HlmyWsMoItCdHMN5LceMig1g4LqbcFSXNdZHjbbOAbQ19pH4djVqsRwSEXYltq2r2L11jbSHjnvoEKLx/N8EmiVoSRKT5hxkNN6lhwaHhq0lNk5NbzzEVFJzpckLYYZ92ARGi4XtNWP6ZtXMgEjjNEDzuaRtUkIqZB1po6MjdXeKQT9MH1aHf8jrSjR1WLgRYbTh9J5RSqnHaMIDw/R2jXPS+M6A3OcSDecCB261dCwAEgdybDUeWgDtJQuxQg==
signature_date    : 2021-12-20T10:53:53.131595
signed_attributes : package,version,architecture,section,priority,name,categories,maintainer,description,depends,conflicts,maturity,locale,target_os,min_wapt_version,sources,installed_size,impacted_process,description_fr,description_pl,description_de,description_es,description_pt,description_it,description_nl,description_ru,audit_schedule,editor,keywords,licence,homepage,package_uuid,valid_from,valid_until,forced_install_on,changelog,min_os_version,max_os_version,icon_sha256sum,signer,signer_fingerprint,signature_date,signed_attributes

# -*- coding: utf-8 -*-
from setuphelpers import *
import platform
import json
import time

uninstallkey = []

# Defining variables
bin_latest_zip = 'Sysmon.zip'
silent_args = '-accepteula -i'
silent_args_update = '-c'
silent_args_remove = '-u force'
app_name = 'Sysmon'
app_service = 'Sysmon'
app_bin = 'Sysmon.exe'
app_unzip = makepath(app_name,app_bin)
app_dir = makepath(systemdrive, 'Windows')
app_bin_path = makepath(app_dir, app_bin)


def install():
    # Initializing variables
    package_version = control.version.split('-')[0]

    # Installing the package
    if not service_installed(app_service):
        print('Installing: %s' % app_name)
        install_exe_if_needed(app_unzip,
            silentflags=silent_args,
            min_version=package_version)

        # Adding this package to the "list-registry"
        register_windows_uninstall(control) # control is a PackageEntry object corresponding to this package
    else :
        print('Updating: %s' % app_name)
        install_exe_if_needed(app_unzip,
            silentflags=silent_args_update,
            min_version=package_version)
        if not installed_softwares (app_name):
            # Adding this package to the "list-registry"
            register_windows_uninstall(control) # control is a PackageEntry object corresponding to this package


def uninstall():
    if run(('%s %s') % (app_bin_path,silent_args_remove)) :
        remove_file(app_bin_path)
        unregister_uninstall(app_name)


def update_package():
    # Initializing variables
    proxies = get_proxies()
    if not proxies:
        proxies = get_proxies_from_wapt_console()
    url_dl = 'https://download.sysinternals.com/files/Sysmon.zip'

    print("Download url is: %s" % url_dl)

    # Downloading latest binaries
    if not isfile(bin_latest_zip):
        print('Downloading: %s' % bin_latest_zip)
        wget(url_dl, bin_latest_zip, proxies=proxies)

        # Unzip
        unzip(bin_latest_zip)
            
        # Changing version of the package
        version = get_version_from_binary(app_unzip)
        control.version = '%s-%s' % (version, control.version.split('-', 1)[-1])
        control.save_control_to_wapt()
        print("Changing package version to: %s in WAPT\\control" % control.version)


def audit ():
    # Check Sysmon Services
    if service_installed(app_service):
        return 'OK'
    else :
        return 'ERROR'



def register_windows_uninstall(package_entry):
    """ Add a windows registry key for custom installer"""
    register_uninstall(package_entry.name,
        'wapt-get remove %s' % package_entry.package,
        display_name=package_entry.name,
        display_version=package_entry.get_software_version(),
        publisher=package_entry.editor)


def get_proxies():
    import platform
    if platform.python_version_tuple()[0] == '3':
        from urllib.request import getproxies
    else:
        from urllib import getproxies
    return getproxies()


def get_proxies_from_wapt_console():
    proxies = {}
    if platform.system() == 'Windows':
        waptconsole_ini_path = makepath(user_local_appdata(), 'waptconsole', 'waptconsole.ini')
    else:
        waptconsole_ini_path = makepath(user_home_directory(), '.config', 'waptconsole', 'waptconsole.ini')
    if isfile(waptconsole_ini_path):
        proxy_wapt = inifile_readstring(waptconsole_ini_path, 'global', 'http_proxy')
        if proxy_wapt:
            proxies = {'http': proxy_wapt, 'https': proxy_wapt}
    return proxies


def get_version_from_binary(filename, parameter='ProductVersion'):
    if filename.endswith('.msi'):
        return get_msi_properties(filename)[parameter]
    else:
        return get_file_properties(filename)[parameter]

c361259255772af74d2733bddfd801729732b45a822df61ef626b90ad37152aa : setup.py
82b16d5247be31d9bddeb07dc716dd5d7a50f233807519037e88d8279ce85033 : Sysmon/Sysmon64.exe
8329bcbadc7f81539a4969ca13f0be5b8eb7652b912324a1926fc9bfb6ec005a : Sysmon/Eula.txt
a9a099eb066060c4839c65e6f425ba0a46145075868cffe4dd1350ce2a9498e6 : Sysmon/Sysmon.exe
85bd77b8f0133b6bc164a1c1e9d8be676d57e4e469ee17f87ebd91735fe6c1bc : Sysmon.zip
a5196572c8f3680ec6166ef070c8d843ab8511ffdd2de859adb1f5eed7efb35d : WAPT/icon.png
a5a97261381e1d0ad46ee15916abec9c2631d0201f5cc50ceb0197a165a0bbbf : WAPT/certificate.crt
e9de885427ceb78947d4e5edb396f0e3c7e1a5173a98fdaa3efe673d77c8bb9f : WAPT/control