windows 日志分析

$hostname=(hostname)
$LogonType = @{
    [uint32]2 = 'Interactive'
    [uint32]3 = 'ipc 登陆'
    [uint32]4 = 'Batch'
    [uint32]5 = 'Service'
    [uint32]7 = 'Unlock'
    [uint32]8 = 'NetworkCleartext'
    [uint32]9 = 'NewCredentials'
    [uint32]10 = '远程桌面登陆'
    [uint32]11 = 'CachedInteractive'
}

$events_fail =Get-WinEvent -FilterHashTable @{ ID=4625;ProviderName='Microsoft-Windows-Security-Auditing';LogName="Security";Path="日志路径\_Security.evtx";}
$events_success =Get-WinEvent -FilterHashTable @{ ID=4624;ProviderName='Microsoft-Windows-Security-Auditing';LogName="Security";Path="日志路径\_Security.evtx";}

$events_fail|ForEach-Object { New-Object PSObject -Property ([ordered]@{
            MachineName = ($_.MachineName).Split('.')[0]
            TimeCreated = $_.TimeCreated
            User = $_.Properties[5].Value
            Domain = $_.Properties[6].Value
            LogonType = $_.Properties[10].Value
            LogonTypeString = $LogonType[$_.Properties[10].Value]
            SourceIP = $_.Properties[19].Value
            Keywords = $_.KeywordsDisplayNames -join ";"
        })}|Export-Csv -Path $hostname"_fail_login.csv" -NoTypeInformation -UseCulture  -Encoding Default


$events_success |ForEach-Object { New-Object PSObject -Property ([ordered]@{
            MachineName = ($_.MachineName).Split('.')[0]
            TimeCreated = $_.TimeCreated
            User = $_.Properties[5].Value
            Domain = $_.Properties[6].Value
            LogonType = $_.Properties[8].Value
            LogonTypeString = $LogonType[$_.Properties[8].Value]
            SourceIP = $_.Properties[18].Value
            Keywords = $_.KeywordsDisplayNames -join ";"
        })} | Export-Csv -Path $hostname"_success_login.csv" -NoTypeInformation -UseCulture -Encoding Default

Param (
    [string]$evtx = $pwd.Path+"\*_Security.evtx"
)

$time=Get-Date -Format h:mm:ss
$evtx=(Get-Item $evtx).fullname
$outfile=(Get-Item $evtx).BaseName+".csv"

$logsize=[int]((Get-Item $evtx).length/1MB)

write-host [+] $time Load $evtx "("Size: $logsize MB")" ... -ForegroundColor Green
[xml]$xmldoc=WEVTUtil qe  $evtx /q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing']  and (EventID=4624 or EventID=4625)] and EventData[Data[@Name='LogonType']='3'] or EventData[Data[@Name='LogonType']='10']]" /e:root /f:Xml  /lf

$xmlEvent=$xmldoc.root.Event

function OneEventToDict {
    Param (
        $event
    )
    $ret = @{
        "SystemTime" = $event.System.TimeCreated.SystemTime | Convert-DateTimeFormat -OutputFormat 'yyyy"/"MM"/"dd HH:mm:ss';
        "EventID" = $event.System.EventID
    }
    $data=$event.EventData.Data
    for ($i=0; $i -lt $data.Count; $i++){
        $ret.Add($data[$i].name, $data[$i].'#text')
    }
    return $ret
}

filter Convert-DateTimeFormat
{
  Param($OutputFormat='yyyy-MM-dd HH:mm:ss fff')
  try {
    ([DateTime]$_).ToString($OutputFormat)
  } catch {}
}

$time=Get-Date -Format h:mm:ss
write-host [+] $time Extract XML ... -ForegroundColor Green
[System.Collections.ArrayList]$results = New-Object System.Collections.ArrayList($null)
for ($i=0; $i -lt $xmlEvent.Count; $i++){
    $event = $xmlEvent[$i]
    $datas = OneEventToDict $event

    $results.Add((New-Object PSObject -Property $datas))|out-null
}

$time=Get-Date -Format h:mm:ss
write-host [+] $time Dump into CSV: $outfile ... -ForegroundColor Green
$results | Select-Object SystemTime,IpAddress,TargetDomainName,TargetUserName,EventID,LogonType | Export-Csv $outfile -NoTypeInformation -UseCulture  -Encoding Default -Force