Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/djhohnstein/EventLogParser
Parse PowerShell and Security event logs for sensitive information.
https://github.com/djhohnstein/EventLogParser
Last synced: 21 days ago
JSON representation
Parse PowerShell and Security event logs for sensitive information.
- Host: GitHub
- URL: https://github.com/djhohnstein/EventLogParser
- Owner: djhohnstein
- Created: 2019-03-29T02:09:57.000Z (over 5 years ago)
- Default Branch: master
- Last Pushed: 2019-03-29T02:21:20.000Z (over 5 years ago)
- Last Synced: 2024-08-05T17:24:30.751Z (4 months ago)
- Language: C#
- Size: 8.79 KB
- Stars: 121
- Watchers: 3
- Forks: 20
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
- awesome-hacking-lists - djhohnstein/EventLogParser - Parse PowerShell and Security event logs for sensitive information. (C# #)
README
# EventLogParser
```
Usage
=====
EventLogParser.exe eventid=EVENTID [outfile=C:\Windows\Temp\loggedfiles.txt]
Description:
EventLogParser will parse event IDs 4103, 4104 and 4688 to search for sensitive
information, including:
- RDP Credentials
- net user commands
- Plaintext secure-strings
- PSCredential objects
- SSH commands using keys
- Imported powershell modules.
Arguments:
Required:
eventid - Must be one of:
4103 - Script Block Logging
4104 - PowerShell module logging
4688 - Process Creation logging.
Note: Must be high integrity and have
command line logging enabled.
Optional:
context - Number of lines surrounding the ""interesting"" regex matches.
Only applies to 4104 events. Default is 3.
outfile - Path to the file you wish to write all matching script block logs
to. This only applies to event ID 4104.
Example:
.\EventLogParser.exe eventid=4104 outfile=C:\Windows\Temp\scripts.txt context=5
Writes all 4104 events with ""sensitive"" information to C:\Windows\Temp\scripts.txt
and prints 5 lines before and after the matching line.
.\EventLogParser.exe eventid=4103
List all modules path on disk that have been loaded by each user.
```
## Examples
```
.\EventLogParser.exe eventid=4104
[*] Parsing PowerShell 4104 event logs...
[+] Regex Match: net user $NewOsUser $NewOsPass /add & net localgroup administrators /add $NewOsUser'';"
[+] Regex Context:
# Create query
}else{
Break
Write-Verbose "$Instance : The service account does not have local administrator privileges so no OS admin can be created. Aborted."
net user $NewOsUser $NewOsPass /add & net localgroup administrators /add $NewOsUser'';"
# Status user
Write-Verbose "$Instance : Payload generated."
}
}else{
[+] Regex Match: New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ($Username, $secpass)
[+] Regex Context:
$secpass = ConvertTo-SecureString $Password -AsPlainText -Force
{
if($Username -and $Password)
# Create PS Credential object
New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ($Username, $secpass)
}
# Create Create the connection to LDAP
if ($DomainController)
{
[+] Regex Match: ConvertTo-SecureString $Password -AsPlainText -Force
[+] Regex Context:
{
if($Username -and $Password)
# Create PS Credential object
{
ConvertTo-SecureString $Password -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ($Username, $secpass)
}
# Create Create the connection to LDAP
if ($DomainController)
```