Script to Send Mail to the System Administrator when the USB Disk is Inserted

Download JSON Download Python

Ratings

Release Time

07/30/2019

Downloads

819 times

Update Time

10/07/2024

Views

811 times

Share-it:

Tags

script Email send

This is a custom monitoring script that raises alert email when new USB device is detected by the system.

Please refer the wiki guide for how to use the custom monitoring scripts:

https://wiki.xcitium.com/frontend/web/topic/how-to-use-monitors-to-track-endpoint-performance#custom_script

Note : Run as System User.

Tested in Windows 10 machine.

Procedure's Instructions

#To define a particular parameter, replace the 'parameterName' inside itsm.getParameter('parameterName') with that parameter's name
emailto=['XXXX@gmail.com']  # Provide System Administrator email address where the alert mail has to be received
emailfrom='yuyuyu@gmail.com' # Provide an Fromemail address from which the alert mail has to be sent
password='xxxxx' # Provide an Fromemail password
smtpserver='smtp.gmail.com'
port=587

device_id = ""

import os
import sys
import socket
import smtplib
import mimetypes
from email.mime.multipart import MIMEMultipart
from email import encoders
from email.message import Message
from email.mime.audio import MIMEAudio
from email.mime.base import MIMEBase
from email.mime.image import MIMEImage
from email.mime.text import MIMEText

def alert(arg):
    sys.stderr.write("%d%d%d" % (arg, arg, arg))
    
def ExecuteCMD(CMD, OUT = False):
    import ctypes
    class disable_file_system_redirection:
        _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
        _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection
        def __enter__(self):
            self.old_value = ctypes.c_long()
            self.success = self._disable(ctypes.byref(self.old_value))
        def __exit__(self, type, value, traceback):
            if self.success:
                self._revert(self.old_value)
    from subprocess import PIPE, Popen
    with disable_file_system_redirection():
        OBJ = Popen(CMD, shell = True, stdout = PIPE, stderr = PIPE)
    out, err = OBJ.communicate()
    return out
def check(ale):
    print "check"
    CMD='REG query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR"'
    out=ExecuteCMD(CMD, OUT = False)
    out=out.replace("\r","")
    out=out.split('\n')
    output=[]
    for i in out:
        ki=os.path.basename(i)
        ki=ki.replace("Disk&Ven_","")
        ki.replace("&Rev_1.00","")
        ki=ki.replace("&Rev_1.00","")
        USBNAME=ki.replace("&Prod_","_")
        output.append(USBNAME)
        output.append("|")
    output1="".join(output)
    PROGRAMDATA=os.environ['programdata']
    COMP_PATH=os.path.join(PROGRAMDATA,"Compare_usb.txt")

if os.path.exists(COMP_PATH):
        with open(COMP_PATH,"r") as f:
            ki=f.read()
            if ale==0:
                ki=ki.split('\n')
                for i in ki:
                    if len(i)>1:
                        if i=="||":
                            z=1
                        else:
                            print i+"  Devices is added in endpoint before 1 Min"
                            for i in out:
                                C='REG DELETE "'+i+'" /F'
                                ExecuteCMD(C, OUT = False)
                                z=0
            else:
                for i in output:
                    if len(i)>2:
                        print i+"  Devices is detected on endpoint"
                        
        COMP_PATH=r"C:/ProgramData/Compare_usb.txt"
        os.remove(COMP_PATH)
        if z==0:
            return 0     
    else:
        
        with open(COMP_PATH,"w") as f:
            f.write(output1)

def computername():
    return os.environ['COMPUTERNAME']

def ipaddress():
    return socket.gethostbyname(socket.gethostname())

subject='%s %s Alert : New USB Inserted!!!!!'%(computername(), ipaddress())

def emailreport(subject, emailto,emailfrom,password,smtpserver,port,msgbody):
    msg = MIMEMultipart()
    msg["From"] = emailfrom
    msg["To"] = ",".join(emailto)
    msg["Subject"] = subject
    msg.preamble = subject
    body = MIMEText(msgbody)
    msg.attach(body)       
    try:
        server = smtplib.SMTP(smtpserver,port)
        server.ehlo()
        server.starttls()
        server.login(emailfrom, password)
        server.sendmail(emailfrom, emailto, msg.as_string())
        server.quit()
        return " \nThe email report has been sent to "+msg["To"]
    except Exception as e:
        return e    
    
def USB():
    import os
    import sys
    import getpass
    print "USER NAME: "+getpass.getuser()
    import re
    import socket
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    s.connect(("8.8.8.8", 80))
    print "IP-ADDRESS : "+(s.getsockname()[0])
    a=os.popen('wmic logicaldisk where drivetype=2 get deviceid, volumename, description,size').read()
    dev=re.findall('([A-Z]:\s+[0-9]+|[A-Z]:\s+)',a)
    list=[]
    ki=1
    for i in dev:
        list.append(i.split())
    ale=0
    length=len(list)
    device_id = ""
    if length==1:
        ale=0
        print "alert"
        ki=check(ale)
    else:
        for i in list:
            device_id = i[0]
            try:
                if len(i[1])>0:
                    print i[0] +" New USB REMOVABLE DEVICE(S) HAS BEEN DETECTED BY YOUR SYSTEM"
                    ale=ale+1
                else:
                    ale=0
                    ki=check(ale)
            except:
                pass
            
    msgbody=r'''Hi

NEW USB REMOVABLE DEVICE(S) HAS BEEN DETECTED BY YOUR SYSTEM

DEVICE ID IS %s

Thank you.'''%device_id

if ki==0:
        print emailreport(subject,emailto,emailfrom,password,smtpserver,port,msgbody)
        print 'mail sent'
        alert(1)
    else:
        if ale>0:
            print emailreport(subject,emailto,emailfrom,password,smtpserver,port,msgbody)
            print 'mail sent'
            alert(1)
        else:
            print "NO NEW DEVICES DETECTED"
            alert(0) 
USB()

Comments

No Comments.

Script to Send Mail to the System Administrator when the USB Disk is Inserted

Comments

Leave a Comment