Repolode
Submit
Rurik

Rurik/Noriben

A portable Python script that drives Sysinternals Procmon to record and report a program's runtime activity for malware analysis.

View on GitHub
Stars
1,322
Forks
224
Open issues
9
Last commit
4 days ago

What is it?

Noriben is a Python script for Windows that works with Sysinternals Procmon to capture system events while a program runs. You start the script, run a suspicious sample, press a key, and receive a plain text report of file, registry, and process activity. It includes a built-in list of whitelisted system noise to keep output readable, though pre-filtering in Procmon still helps.

Because you can run the sample manually, Noriben works for cases a fully automated sandbox handles poorly, such as programs that need command-line options or user interaction, or when you step through the code in a debugger while logging. It can also re-analyze existing Procmon CSV or PML files, and it has been used to audit ordinary software.

The project includes optional features such as YARA scanning of newly created files, VirusTotal hash submission, hash whitelists, and path generalization to Windows environment variables for indicator development. A companion script, NoribenSandbox.py, automates running samples inside a guest VM and collecting the results.

Key features

  • 01Records file, registry, and process activity by driving Sysinternals Procmon.
  • 02Produces a simple text report after a configurable collection time.
  • 03Scans newly created files against a folder of YARA rules.
  • 04Can submit file hashes to VirusTotal and ignore hashes from a whitelist.
  • 05Replaces absolute paths with Windows environment variables such as %AppData%.
  • 06Re-analyzes existing Procmon CSV or PML files.

Use cases

  • Observing what a suspicious Windows executable does on a disposable VM.
  • Running a sample that needs manual interaction or specific command-line arguments.
  • Stepping through a program in a debugger while logging its system activity.
  • Auditing the runtime behavior of ordinary Windows software.

Quick start

  1. 1

    Download Sysinternals Procmon and place procmon.exe or procmon64.exe alongside Noriben.py

  2. 2

    Run Noriben with a timeout and the malware to analyze

    python.exe Noriben.py -t 60 --cmd "path\exe"

Things to know

  • Requires Sysinternals Procmon and runs on Windows only.
  • Designed for malware analysis, so running samples carries risk and should be done in an isolated VM.
  • The NoribenSandbox automation script currently runs only on OSX and is not fully ported.

In collections

Security scanners, audits & threat intel tools

Topics

#malware-analysis#security#sysinternals#windows#forensics#sandbox#yara#python

FAQ

What is Noriben?
A portable Python script that drives Sysinternals Procmon to record and report a program's runtime activity for malware analysis. Noriben is a Python script for Windows that works with Sysinternals Procmon to capture system events while a program runs. You start the script, run a suspicious sample, press a key, and receive a plain text report of file, registry, and process activity. It includes a built-in list of whitelisted system noise to keep output readable, though pre-filtering in Procmon still helps.
Is Noriben free to use? What license does it have?
Noriben is open source under the Other license. Check the license terms before using it in commercial products.
Is Noriben still maintained?
Actively maintained. The last commit to Noriben was on Nov 3, 2026.
What can I use Noriben for?
Observing what a suspicious Windows executable does on a disposable VM. Running a sample that needs manual interaction or specific command-line arguments. Stepping through a program in a debugger while logging its system activity. Auditing the runtime behavior of ordinary Windows software.
How do I install Noriben?
Download Sysinternals Procmon and place procmon.exe or procmon64.exe alongside Noriben.py Run Noriben with a timeout and the malware to analyze: python.exe Noriben.py -t 60 --cmd "path\exe"
Where can I get Noriben?
The source code and installation instructions are on GitHub: https://github.com/Rurik/Noriben

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects