I am trying to create a scoring Jupyter Notebook created for Windows Processes and I was wondering about what information would I exactly need to generate a basic Score for each process running on a Windows Machine.
- For the information retrieval I will be using a .bat(WMIC) script or PowerShell
- For the parsing I will be using a Python Notebook on Jupyter.
- For Storing and Visualisations I will be using Elasticsearch and Kibana.
My question is about the first step, since I am looking for what information i need to generate the score for each process like :
- A process whitelist
- A process Blacklist
- Hashes Verification
- Signature Verification
- Process Size in Bytes
Do you think I need more information? and what it is exactly and why ?