Skip to content

Instantly share code, notes, and snippets.

@BoredHackerBlog
Created February 1, 2022 14:49
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save BoredHackerBlog/d2683c388c5a8406666d5d5bf827bc0a to your computer and use it in GitHub Desktop.
Save BoredHackerBlog/d2683c388c5a8406666d5d5bf827bc0a to your computer and use it in GitHub Desktop.
process graph using graphviz and python
from graphviz import Digraph
process_data = []
process_data.append({"pid":"1", "ppid":"204", "path":"c:/cmd.exe"})
process_data.append({"pid":"4", "ppid":"204", "path":"c:/powershell.exe"})
process_data.append({"pid":"204", "ppid":"0", "path":"c:/svhost.exe"})
process_data.append({"pid":"8", "ppid":"4", "path":"c:/net.exe"})
process_data.append({"pid":"10", "ppid":"4", "path":"c:/netsh.exe"})
def graph_process(jsonarray, pid_key, ppid_key, label_key):
dot = Digraph()
for event in jsonarray:
dot.node(event[pid_key], event[label_key])
for event in jsonarray:
dot.edge(event[ppid_key], event[pid_key])
return dot
graph_process(process_data, "pid", "ppid", "path")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment