Process Hardening Analyzer 🛡️

A lightweight, web-based tool designed to analyze running Windows processes, assess their threat levels, and provide a clear, spreadsheet-like interface for security monitoring. It classifies processes into categories (Native Windows, Microsoft, Third-party, Unknown) and assesses them as Safe, Suspicious, or Malicious.

Features

• Dashboard UI: A sleek, modern dashboard to view and filter all running processes.
• Process Tree View: Visualize parent-child process relationships.
• Detailed Threat Analysis: Click on any process to view its memory usage, command-line arguments, file path, digital signature publisher, and the exact reasons for its threat score.
• Whitelist / Blacklist: Maintain a custom list of trusted or blocked processes.
• Filtered CSV Export: Export the currently filtered view of processes to a CSV file for reporting.
• Standalone Executable: The entire application can be compiled into a single .exe for easy portability.

---

🚀 Getting Started

You can run the application either directly from the source code or by executing the compiled standalone executable.

Fast Track (Compiled Executable)

If you download or compile the standalone executable:

1. Double-click the ProcessAnalyzer.exe file.
2. A console window will open, indicating the server has started.
3. Open your web browser and navigate to: http://localhost:3000
4. The system will automatically perform a scan and display the processes.
5. Your whitelists and blacklists will be saved automatically in a data folder next to the .exe.

Exporting Filtered Data to CSV

You can generate a customized CSV report of the processes you are currently viewing:

1. Use the Threat or Category filter chips to narrow down the process list.
2. Alternatively, use the Search box to look for specific process names (e.g., "brave").
3. Once the table reflects only the data you want, click the Export CSV button in the top right.
4. The browser will instantly download a .csv file containing only those filtered records.

---

🛠️ For Developers

Prerequisites

• Windows OS (Required for PowerShell process queries)
• Node.js (v16 or higher)

Setup & Development

1. Clone the repository:

   git clone https://github.com/yourusername/process-hardening-analyzer.git
   cd process-hardening-analyzer

2. Install dependencies:

   npm install

3. Start the development server:

   npm run dev

4. Access the dashboard at http://localhost:3000

Compiling to .exe

We use pkg to bundle the Node runtime, backend server, and frontend assets into a single executable.

1. Make sure dependencies are installed (npm install).
2. Run the build script:

   npm run build

3. A ProcessAnalyzer.exe file will be generated in your project root.

---

🧠 Under the Hood

This tool utilizes several techniques to gather data and determine the threat score of processes without requiring complex driver installations:

Data Collection (PowerShell)

The backend leverages native Windows APIs via PowerShell to enumerate processes:

• Get-CimInstance Win32_Process: Fetches the process list, including PID, Path, Parent PID, Working Set Size (RAM), and Command Line execution strings.
• Get-AuthenticodeSignature: Verifies the digital signature of the executable file on disk. This helps determine if the software comes from a known, trusted publisher (e.g., Microsoft, Google, Adobe).

Classification Engine & Heuristics

The classification engine acts as the core of the analyzer, running algorithms against the raw data:

1. Known-Good Databases: Checks against built-in sets of known safe Native OS processes, Microsoft application processes, and standard third-party services.
2. Path Anomalies: Flags processes executing from historically suspicious locations (e.g., AppData\Local\Temp, Users\Public).
3. Location Enforcement: Ensures that critical Windows system processes (like svchost.exe or lsass.exe) are actually running from C:\Windows\System32.
4. Masquerading Detection: Detects process names trying to mimic legitimate system names (e.g., svch0st.exe instead of svchost.exe).
5. Publisher Verification: Flags unsigned binaries or processes lacking a verified publisher certificate (unless they are known safe local services).
6. Resource Anomalies: Flags background processes with unusually high memory consumption.

Tech Stack

• Backend: Node.js, Express.js
• Frontend: Vanilla HTML5, CSS3, JavaScript (No heavy frameworks for maximum performance)
• Packaging: pkg

License

MIT License