Real-time Security Monitoring & Privilege Escalation Detection
Features • Installation • Usage • Configuration • Contributing
An intelligent, automated security monitoring system that detects unauthorized privilege escalation attempts in real-time and alerts administrators through multiple channels. Protect your infrastructure from unauthorized privilege escalations with comprehensive cross-platform monitoring.
| Feature | Description |
|---|---|
| 🔍 Real-time Monitoring | Continuously monitors system event logs for suspicious activities |
| 🚨 Multi-Channel Alerts | Email, console, and secure file logging notifications |
| 🖥️ Cross-Platform Support | Seamlessly works on Windows and Linux systems |
| 🔒 Secure Logging | Encrypted storage with automatic log rotation |
| ⚙️ Highly Configurable | Simple environment variable-based configuration |
| 📊 Event Tracking | Detailed logging of 6+ Windows Event IDs and Linux indicators |
| 🛡️ Security First | Built with security best practices in mind |
✓ Python 3.8 or higher
✓ Windows 10/11 OR Linux (Ubuntu 20.04+, CentOS 8+)
✓ Administrative/root privileges for log access
✓ SMTP server access for email alerts (optional)
# Clone the repository
git clone https://github.com/chamarthinagendravarma-spec/privilege-escalation-monitor.git
cd privilege-escalation-monitor
# Create and activate virtual environment
python -m venv venv
venv\Scripts\activate
# Install dependencies
pip install -r requirements.txt
# Configure your settings
copy .env.example .env
# Edit .env with your configuration
# Run as Administrator
python -m src.monitor# Clone the repository
git clone https://github.com/chamarthinagendravarma-spec/privilege-escalation-monitor.git
cd privilege-escalation-monitor
# Create and activate virtual environment
python -m venv venv
source venv/bin/activate
# Install dependencies
pip install -r requirements.txt
# Configure your settings
cp .env.example .env
# Edit .env with your configuration
# Run with sudo privileges
sudo -E python -m src.monitorCreate a .env file in the project root with the following variables:
# Email Configuration
SMTP_SERVER=smtp.gmail.com
SMTP_PORT=587
SENDER_EMAIL=your-email@gmail.com
SENDER_PASSWORD=your-app-password
RECIPIENT_EMAIL=admin@company.com
# Monitoring Configuration
CHECK_INTERVAL=60 # Check interval in seconds
LOG_LEVEL=INFO # DEBUG, INFO, WARNING, ERROR
ENABLE_ENCRYPTION=true # Enable log encryption💡 Pro Tip: Use Gmail App Passwords for email configuration instead of your main password.
venv\Scripts\activate
python -m src.monitorsource venv/bin/activate
sudo -E python -m src.monitorpython -m unittest tests.test_monitor| Event ID | Description |
|---|---|
| 4672 | Special privileges assigned to a new logon |
| 4673 | A privileged service was called |
| 4688 | A new process has been created |
| 4697 | A service was installed in the system |
| 4698 | A scheduled task was created |
| 4732 | A member was added to a security-enabled local group |
| Indicator | Description |
|---|---|
| 🔐 Sudo command execution | Privilege escalation attempts |
| 🔄 Su (switch user) attempts | User switching activities |
| Failed authentication attempts | |
| 👤 Root session activities | Root user session logs |
Run comprehensive unit tests:
python -m unittest tests.test_monitor -v
⚠️ Important Security Notes:
- ❌ Never commit
.envfile to version control - 🔑 Use app-specific passwords for email authentication
- 📋 Regularly review logs in the
logs/directory - 👤 Run with minimum required privileges
- 🔄 Keep dependencies updated:
pip install --upgrade -r requirements.txt - 🛡️ Run in isolated environments or containers for production
- 📊 Monitor system resource usage during continuous monitoring
privilege-escalation-monitor/
├── src/
│ ├── monitor.py # Main monitoring engine
│ ├── alerting.py # Alert handlers
│ └── utils.py # Utility functions
├── tests/
│ └── test_monitor.py # Unit tests
├── logs/ # Log files (created at runtime)
├── .env.example # Configuration template
├── requirements.txt # Python dependencies
├── LICENSE # MIT License
└── README.md # This file
We welcome contributions! Here's how you can help:
- Fork the repository
- Create a feature branch (
git checkout -b feature/amazing-feature) - Commit your changes (
git commit -m 'Add amazing feature') - Push to the branch (
git push origin feature/amazing-feature) - Open a Pull Request
For major changes, please open an issue first to discuss the proposed changes.
This project is licensed under the MIT License - see the LICENSE file for details.
MIT License
Copyright (c) 2025 Nagendra Varma
Permission is hereby granted, free of charge...
Nagendra Varma
- 📧 Email: your-email@example.com
- 🐙 GitHub: @chamarthinagendravarma-spec
- 💼 LinkedIn: [Your LinkedIn Profile]
Found a bug or have a suggestion? Open an Issue and let us know!
Made with ❤️ by Nagendra Varma