{"id":29414371,"url":"https://github.com/the-viper-one/invoke-findeventcreds","last_synced_at":"2026-04-18T13:32:26.719Z","repository":{"id":303096484,"uuid":"1014383320","full_name":"The-Viper-One/Invoke-FindEventCreds","owner":"The-Viper-One","description":"PowerShell script to parse Sysmon Event ID 1 and Security Event Log ID 4688 for command line credentials","archived":false,"fork":false,"pushed_at":"2025-07-05T16:33:47.000Z","size":10,"stargazers_count":6,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-08-04T11:22:58.795Z","etag":null,"topics":["hacking","lateral-movement","pentesting","powershell","windows"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/The-Viper-One.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-05T16:04:03.000Z","updated_at":"2025-07-19T21:30:03.000Z","dependencies_parsed_at":null,"dependency_job_id":"b47b981d-141b-47cf-830c-667e4cc46c77","html_url":"https://github.com/The-Viper-One/Invoke-FindEventCreds","commit_stats":null,"previous_names":["the-viper-one/invoke-findeventcreds"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/The-Viper-One/Invoke-FindEventCreds","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FInvoke-FindEventCreds","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FInvoke-FindEventCreds/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FInvoke-FindEventCreds/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FInvoke-FindEventCreds/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/The-Viper-One","download_url":"https://codeload.github.com/The-Viper-One/Invoke-FindEventCreds/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FInvoke-FindEventCreds/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31971486,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-18T00:39:45.007Z","status":"online","status_checked_at":"2026-04-18T02:00:07.018Z","response_time":103,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hacking","lateral-movement","pentesting","powershell","windows"],"created_at":"2025-07-11T13:30:20.971Z","updated_at":"2026-04-18T13:32:26.714Z","avatar_url":"https://github.com/The-Viper-One.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Invoke-FindEventCreds\nPowerShell script to parse Sysmon Event ID 1 and Security Event Log ID 4688 for command line credentials\n\n`Invoke-FindEventCreds` connects to either the local or a remote computers Security log (Event ID 4688) and Sysmon Operational log (Event ID 1), parses each process creation event’s command‑line string, and matches it against a library of regex patterns for common binaries (net, schtasks, wmic, psexec, sc.exe, etc.). \n\n## Requirements\n\n- Requires local administrator or SYSTEM privileges to local or remote computer\n- Sysmon must be installed and configured to log ProcessCreate (Event ID 1) for the Sysmon portion to return data\n- Audit Process Creation must be enabled under Advanced Audit Policy Configuration for event ID 4688 to be populated\n\n## Usage\n\nDownload into memory\n```powershell\nIRM \"https://raw.githubusercontent.com/The-Viper-One/Invoke-FindEventCreds/refs/heads/main/Invoke-FindEventCreds.ps1\" | IEX\n```\n\nExecution\n```powershell\n# Local Execution\nInvoke-FindEventCreds\n\n# Remote Execution\nInvoke-FindEventCreds -ComputerName WEB01\n```\n## Example Output\n```\nPS \u003e Invoke-FindEventCreds\n\n\nTimeCreated       : 05/07/2025 16:46:07\nAccountName       : SECURITY\\Moe\nProcessName       : C:\\Windows\\System32\\net.exe\nParentProcessName : C:\\Windows\\System32\\cmd.exe\nCommandLine       : net  user testu /add Password123\n\nTimeCreated       : 05/07/2025 16:46:03\nAccountName       : SECURITY\\Moe\nProcessName       : C:\\Windows\\System32\\net.exe\nParentProcessName : C:\\Windows\\System32\\cmd.exe\nCommandLine       : net  user test /add Password123\n\nTimeCreated       : 04/07/2025 21:23:20\nAccountName       : SECURITY\\Moe\nProcessName       : C:\\Windows\\System32\\wbem\\WMIC.exe\nParentProcessName : C:\\Windows\\System32\\cmd.exe\nCommandLine       : wmic  /node:\"TARGETHOST\" /user:AdminUser /password:Adm1nP@ss process call create \"cmd.exe /c whoami\"\n\nTimeCreated       : 04/07/2025 21:22:50\nAccountName       : SECURITY\\Moe\nProcessName       : C:\\Windows\\System32\\sc.exe\nParentProcessName : C:\\Windows\\System32\\cmd.exe\nCommandLine       : sc.exe  create MyService binPath= \"C:\\MyApp\\app.exe\" obj= \"DOMAIN\\ServiceAcct\" password=SvcP@ss!\n\nTimeCreated       : 05/07/2025 16:46:07\nAccountName       : Moe\nProcessName       : C:\\Windows\\System32\\net.exe\nParentProcessName : C:\\Windows\\System32\\cmd.exe\nCommandLine       : net  user testu /add Password123\n\nTimeCreated       : 05/07/2025 16:46:03\nAccountName       : Moe\nProcessName       : C:\\Windows\\System32\\net.exe\nParentProcessName : C:\\Windows\\System32\\cmd.exe\nCommandLine       : net  user test /add Password123\n\nTimeCreated       : 04/07/2025 21:23:20\nAccountName       : Moe\nProcessName       : C:\\Windows\\System32\\wbem\\WMIC.exe\nParentProcessName : C:\\Windows\\System32\\cmd.exe\nCommandLine       : wmic  /node:\"TARGETHOST\" /user:AdminUser /password:Adm1nP@ss process call create \"cmd.exe /c whoami\"\n\nTimeCreated       : 04/07/2025 21:22:50\nAccountName       : Moe\nProcessName       : C:\\Windows\\System32\\sc.exe\nParentProcessName : C:\\Windows\\System32\\cmd.exe\nCommandLine       : sc.exe  create MyService binPath= \"C:\\MyApp\\app.exe\" obj= \"DOMAIN\\ServiceAcct\" password=SvcP@ss!\n\nTimeCreated       : 04/07/2025 21:06:04\nAccountName       : Moe\nProcessName       : C:\\Windows\\System32\\net.exe\nParentProcessName : C:\\Windows\\System32\\cmd.exe\nCommandLine       : net  user logtest P@ssw0rd! /add\n\nTimeCreated       : 04/07/2025 08:24:19\nAccountName       : Moe\nProcessName       : C:\\Windows\\System32\\schtasks.exe\nParentProcessName : C:\\Windows\\System32\\cmd.exe\nCommandLine       : schtasks  /Create /SC DAILY /TN \"Backup\" /TR \"C:\\Scripts\\Backup.cmd\" /RU ServiceAcct /RP P@ssServ!\n\nTimeCreated       : 04/07/2025 08:24:16\nAccountName       : Moe\nProcessName       : C:\\Windows\\System32\\net.exe\nParentProcessName : C:\\Windows\\System32\\cmd.exe\nCommandLine       : net  use Z: \\\\FILESERVER\\Share /user:DOMAIN\\AdminUser SecureP@ss!\n\nTimeCreated       : 04/07/2025 08:24:13\nAccountName       : Moe\nProcessName       : C:\\Windows\\System32\\net.exe\nParentProcessName : C:\\Windows\\System32\\cmd.exe\nCommandLine       : net  user NewUser P@ssw0rd123! /add\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthe-viper-one%2Finvoke-findeventcreds","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fthe-viper-one%2Finvoke-findeventcreds","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthe-viper-one%2Finvoke-findeventcreds/lists"}