the wmi api gives the programmer the ability to monitor the system for certain eventsand then receive callbacks when those events occur we're going to leverage this interface to receive callback every time process is created when process gets createdwe're going to trap some valuable information for our purposesthe time the process was createdthe user that spawned the processthe executable that was launched and its command-line argumentsthe process idand the parent process id this will show us any processes that are created by higher-privilege accountsand in particularany processes that are calling external files such as vbscript or batch scripts when we have all of this informationwe'll also determine what privileges are enabled on the process tokens in certain rare casesyou'll find processes that are created as regular user but which have been granted additional windows privileges that you can leverage let' begin by creating very simple monitoring script[ that provides the basic process informationand then build on that to determine the enabled privileges note that in order to capture information about high-privilege processes created by systemfor exampleyou'll need to run your monitoring script as an administrator let' get started by adding the following code to process_monitor pyimport win con import win api import win security import wmi import sys import os def log_to_file(message)fd open("process_monitor_log csv""ab"fd write("% \ \nmessagefd close(return create log file header log_to_file("time,user,executable,commandline,pid,parent pid,privileges"instantiate the wmi interface wmi wmi(create our process monitor process_watcher win _process watch_for("creation"while truetrynew_process process_watcher(proc_owner new_process getowner(proc_owner "% \\% (proc_owner[ ],proc_owner[ ]create_date new_process creationdate executable new_process executablepath cmdline new_process commandline pid new_process processid parent_pid new_process parentprocessid privileges " /aprocess_log_message "% ,% ,% ,% ,% ,% ,% \ \ (create_date