Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/IppSec/PowerSiem

Last synced: 9 days ago
JSON representation

Host: GitHub
URL: https://github.com/IppSec/PowerSiem
Owner: IppSec
Created: 2022-03-27T14:21:12.000Z (over 2 years ago)
Default Branch: master
Last Pushed: 2024-03-27T11:49:24.000Z (9 months ago)
Last Synced: 2024-12-01T05:36:46.193Z (12 days ago)
Language: PowerShell
Size: 5.86 KB
Stars: 114
Watchers: 2
Forks: 30
Open Issues: 1
Metadata Files:
- Readme: Readme.md

Awesome Lists containing this project

jimsghstars - IppSec/PowerSiem - (PowerShell)

README

This script is a proof of concept to tail the Sysmon Event Log. I primarily use it to create (and validate) IOC's for malware. I created it on stream here: https://www.twitch.tv/videos/1438252177

Example:

```
Type: File Create
RecordID: 2836
TargetFilename: C:\Windows\SBvrixHw.exe
Process: System
PID: 4
User: NT AUTHORITY\SYSTEM
-----
Type: Process Create
Image: C:\Windows\SBvrixHw.exe
ParentCommandLine: C:\WINDOWS\system32\services.exe
ParentUser: NT AUTHORITY\SYSTEM
CurrentDirectory: C:\WINDOWS\system32\
CommandLine: C:\WINDOWS\SBvrixHw.exe
ParentImage: C:\Windows\System32\services.exe
PID: 4680
User: NT AUTHORITY\SYSTEM
-----
Type: Process Create
Image: C:\Windows\SysWOW64\cmd.exe
ParentCommandLine: C:\WINDOWS\SBvrixHw.exe
ParentUser: NT AUTHORITY\SYSTEM
CurrentDirectory: C:\WINDOWS\system32\
CommandLine: cmd.exe
ParentImage: C:\Windows\SBvrixHw.exe
PID: 7336
User: NT AUTHORITY\SYSTEM
-----
Type: Process Create
Image: C:\Windows\SysWOW64\whoami.exe
ParentCommandLine: cmd.exe
ParentUser: NT AUTHORITY\SYSTEM
CurrentDirectory: C:\WINDOWS\system32\
CommandLine: whoami
ParentImage: C:\Windows\SysWOW64\cmd.exe
PID: 6712
User: NT AUTHORITY\SYSTEM
-----
Type: File Delete
RecordID: 2855
TargetFilename: C:\Windows\SBvrixHw.exe
Process: System
PID: 4
User: NT AUTHORITY\SYSTEM
-----
```