Generate the alert if Microsoft Windows Kernel Power application has been crashed

Download JSON Download Python

Ratings

(0)

Release Time

09/14/2017

Downloads

1261 times

Update Time

11/16/2024

Views

1479 times

Share-it:

Tags

Microsoft kernal crash

Description
Screen Shots

Hi,

This script helps to generate the alert if Microsoft Windows Kernel Power application has been crashed in the last 24 hours.

Note:

This script as Custom Monitoring script. Please refer https://wiki.comodo.com/frontend/web/topic/how-to-use-custom-script-procedure-monitoring

And set the custom Monitoring condition duration as 24 Hours

This script run as a custom monitoring script

Tested Platform:

Windows (7, 8, 8.1, 10)

Provider name == " Microsoft-Windows-Kernel-Power".

Run this script as System user.

Procedure's Instructions

ps_content=r'''

$end = [datetime]([datetime]::Now.ToString('MM-dd-yyyy hh:00:00'))
Get-WinEvent -FilterHashTable @{logname='system'; ProviderName = "Microsoft-Windows-Kernel-Power"; id=41; Level = 1; StartTime = $end.AddHours(-24); EndTime = $end}
'''

import os
import sys

def alert(arg): 
    sys.stderr.write("%d%d%d" % (arg, arg, arg))

def ecmd(command):
    import ctypes
    from subprocess import PIPE, Popen
    
    class disable_file_system_redirection:
        _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
        _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection
        def __enter__(self):
            self.old_value = ctypes.c_long()
            self.success = self._disable(ctypes.byref(self.old_value))
        def __exit__(self, type, value, traceback):
            if self.success:
                self._revert(self.old_value)
    
    with disable_file_system_redirection():
        obj = Popen(command, shell = True, stdout = PIPE, stderr = PIPE)
    out, err = obj.communicate()
    ret=obj.returncode
    if ret==0:
        if out:
            return out.strip()
        else:
            return ret
    else:
        if err:
            return err.strip()
        else:
            return ret

file_name='powershell_file.ps1'
file_path=os.path.join(os.environ['TEMP'], file_name)
with open(file_path, 'wb') as wr:
    wr.write(ps_content)

ecmd('powershell "Set-ExecutionPolicy RemoteSigned"')
data = ecmd('powershell "%s"'%file_path)

if data:
    print 'Application crash event has been occured'
    alert(1)
    print "Event Details"
    print data
    
else:
    alert(0)
    print ' No application crashed found recently'

os.remove(file_path)

Comments

No Comments.

Generate the alert if Microsoft Windows Kernel Power application has been crashed

Comments

Leave a Comment