Mitch Haddadi dfirsec

🏠

Working from home

dfirsec / PowerShell Command Line Logging

Created November 11, 2018 12:07 — forked from gfoss/PowerShell Command Line Logging

Detect and alert on nefarious PowerShell command line activity

	# PowerShell Audit Logging for LogRhythm SIEM - 2015
	# For detecting dangerous PowerShell Commands/Functions

	Log Source Type:
	MS Event Log for Win7/Win8/2008/2012 - PowerShell

	Add this file to your PowerShell directory to enable verbose command line audit logging
	profile.ps1
	$LogCommandHealthEvent = $true
	$LogCommandLifeCycleEvent = $true

dfirsec / powershell_eventlog_parsing.ps1

Created July 25, 2018 10:09 — forked from exp0se/powershell_eventlog_parsing.ps1

Powershell log parsing

	#Security log
	#============
	####
	#4624 - Logon & Logoff events successful
	#4625 - Logon unsucceful

	####
	# Get usernames
	Get-WinEvent -path .\Security.evtx \| Where {$_.id -eq "4624"} \| Foreach {([xml]$_.ToXml()).GetElementsByTagName("Data").ItemOf(5)}\| Select -ExpandProperty "#text" -Unique
	# Get domains

dfirsec / logparser.ps1

Created May 3, 2018 11:12 — forked from exp0se/logparser.ps1

Logparser log parsing

	# Logparser


	###############
	# Security Log
	###############

	# Find Event id
	& 'C:\Program Files (x86)\Log Parser 2.2\LogParser.exe' -stats:OFF -i:EVT "SELECT * FROM 'Security.evtx' WHERE EventID = '5038'"