https://github.com/ms-0x404/auditing-toolkit
A lightweight, cross-platform toolkit to monitor critical system events on both Windows and Linux environments.
https://github.com/ms-0x404/auditing-toolkit
audit audit-logging auditing linux security-audit security-tools windows
Last synced: 3 months ago
JSON representation
A lightweight, cross-platform toolkit to monitor critical system events on both Windows and Linux environments.
- Host: GitHub
- URL: https://github.com/ms-0x404/auditing-toolkit
- Owner: MS-0x404
- License: mit
- Created: 2025-05-03T06:32:27.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2025-05-03T06:51:14.000Z (over 1 year ago)
- Last Synced: 2025-05-28T04:14:23.634Z (about 1 year ago)
- Topics: audit, audit-logging, auditing, linux, security-audit, security-tools, windows
- Language: PowerShell
- Homepage:
- Size: 10.7 KB
- Stars: 1
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# 🔍 Audit System Toolkit — PowerShell & Bash
A lightweight, cross-platform toolkit to monitor critical system events on both Windows and Linux environments.
🛡️ Built from scratch, written manually — designed for sysadmins, pentesters, and students who want to truly understand system logging **without relying on external tools**.
---
## 📂 Contents
### `auditing.ps1`
- Windows tool using PowerShell
- CLI interface
- Based on `Get-WinEvent`
- Supports Event ID search and optional filters (e.g. user, handle, object)
- Outputs to `C:\log_audit.txt`
### `auditing.sh`
- Linux script for manual auditing
- Checks root activity, logins, cron, sudo logs, and more
- Outputs to `/root/audit_log.log`
---
## 🚀 Features
- ✅ Security event monitoring on Windows (Logon, Account Locked, etc.)
- ✅ Optional user/object filter
- ✅ Clean persistent logging
- ✅ Readable, modifiable Linux script
- ✅ No external dependencies
---
## 🧠 Ideal For
- Junior sysadmins who want hands-on practice
- Red teamers or pentesters needing low-level visibility
- Students who want to understand system logs
---
## 🖥️ Requirements
### Windows
- PowerShell 5+
- Admin privileges to read Security logs
### Linux
- Bash
- Root privileges to access system logs
---
## 📦 Installation
### Windows
```bash
git clone https://github.com/matteosalis04/Auditing-ToolKit.git
cd Auditing-ToolKit/Windows
powershell -ExecutionPolicy Bypass -File auditing.ps1
```
### Linux
```bash
git clone https://github.com/matteosalis04/Auditing-ToolKit.git
cd Auditing-ToolKit/Linux
sudo bash auditing.sh
```
---
## 👤 Author
Made by **[@MS-0x404](https://github.com/MS-0x404)**
---
## 📜 License
MIT — do what you want, just give credit.