Get-Winevent Part III: Querying the Event Log for Logons (Part E)

In Part A of this series ('Get-Winevent Part III Querying the Event Log for logons'), I worked with the 'where-object' cmdlet to filter through properties of specific logon event types. In Part B, I used '-filterhashtable' and 'findstr' to more quickly dig into the message field of logon events, utlimately producing a spreadsheet or database format of those events. In Part C, I presented code that enumerates all provider types for these events.  Then I used '-filterhashtable' with an array of multiple security EventIDs whose select 'Message' fields I searched with 'findstr' for specific properties relating to logons.  In Part D,  I pull this all together, creating a timeline of multiple security EventIDs whose select 'Message' fields I pump into a spreadsheet for further analysis. In Part E (below), I tie in additional auditing events, specifically connections permitted by the Windows Filtering Platform:


'Auditpol' allows the administrator to add additional events to be collected by the Event Viewer. To see all potential categories:


auditpol /get /category:* 


[partial  list:]
System audit policy
Category/Subcategory Setting
System
   Security System Extension Success
   System Integrity Success and Failure
   IPsec Driver Success
   Other System Events Success and Failure
   Security State Change Success
Logon/Logoff
   Logon Success and Failure
   Logoff Success
 ...
A quick trick to set all categories and their subcategories for auditing:


auditpol /set /category:*


After some time, we query the Security log and notice event 5156 for further monitoring:


get-winevent Security -max 100 | ft -auto -wrap | more


7/14/2011 6:59:55 PM Microsoft-Windows-Security-Auditing 5156 The Windows Filtering Platform has permitted a connection.

Application Information:Process ID: 3588Application Name: \device\harddiskvolume3\program files (x86)\opera\opera.exe
Network Information:Direction: OutboundSource Address: 192.168.0.11Source Port: 51199Destination Address: 199.59.149.243Destination Port: 80Protocol: 6 

...
$5156=get-winevent -filterhashtable @{logname='security';id=5156} -max 1000
foreach ($event in $5156) {($event | Select TimeCreated,Message | fl * | findstr /G:Search5156.lst) -replace " ","" -join "," | out-file -append 5156.csv}


where Search5156.lst:
TimeCreated
Source
Destination

Now we can add some headers and create some filters in our spreadsheet:

Read More

Get-WinEvent, EventLogs, ETL, Providers on Win7 Part III

Microsoft has exposed substantial providers since XP. With Windows 7, Microsoft has increased the number of providers substantially over previous versions of Windows and added 'netsh trace' functionality to enable tracing, conversion, batching of these kernel level counters. In the commands below, I have mixed cmd shell, powershell, cygwin cmds to parse ETL files. In  general, parsing etl files with 'get-winevent' and powershell takes a while...  You can understand 'netsh' filtering best with 'netsh trace show CaptureFilterHelp', however I recommend setting your 'netsh trace start maxSize=' parameter at 150 MB or less. (The default is an almost unworkable 250MB.)


From cmd.exe, a variable for date/time (e.g. timestamp) could be useful:

realtd.cmd
@echo off
set realdate=%date:/=.%
set realdate=%realdate:* =%
set realtime=%time::=.%
set realtime=%realtime:* =%
set timestamp=%realdate%_%realtime%

From cmd.exe we can start the trace:

netsh trace start provider=Microsoft-Windows-Kernel-Network provider=Microsoft-Windows-Kernel-Process provider=Microsoft-Windows-Security-Auditing provider=Microsoft-Windows-Security-Netlogon provider=Microsoft-Windows-TCPIP persistent=yes traceFile=%LOCALAPPDATA%\Temp\NetTraces\NetTrace%timestamp%.etl

and stop the trace:

netsh trace stop

If we choose we can covert the trace with 'netsh' we can dump it to a text or csv dump with:

netsh trace convert input=NetTrace07.07.2011_1.38.09.40.etl output=NetTrace07.07.2011_1.38.09.40.txt dump=TXT

Next we can try parsing a particular provider from Powershell. Here I choose "Microsoft-Windows-TCPIP" provider. I adjust the screen buffer size to help 'format-table' catch all of the trace line:

$host.UI.RawUI.BufferSize = new-object System.Management.Automation.Host.Size(500,1000)
$Providers="Microsoft-Windows-TCPIP"
$FileName="NetTrace07.07.2011_1.38.09.40.etl"
foreach ($ProviderName in $Providers) {get-winevent -path "$FileName" -oldest | where {$_.ProviderName -eq "$ProviderName"} | ft TimeCreated, Message| out-file -encoding ASCII -file "$FileName$ProviderName.txt"}

I find I can not make GNUWin32 gawk work as advertised inside Powershell.
The following line does not work in Powershell:

## grep -i -w "remote" "$FileName$ProviderName.txt" | tr -s ' ' | gawk '{print $1" "$2" "$3","$4" "$5" "$6" "$7" "$8" "$9}' | out-file -encoding ASCII -append "$ProviderName.csv"

But this will work just fine in Cygwin:

grep -i -w "remote" NetTrace07.07.2011_1.38.09.40.etlMicrosoft-Windows-TCPIP.txt | tr -s ' ' | gawk '{print $1" "$2" "$3","$4" "$5" "$6" "$7" "$8" "$9}' >> NetTrace07.07.2011_1.38.09.40.etlMicrosoft-Windows-TCPIP.csv

and we are looking at a spreadsheet like this:

Read More

Get-Winevent Part III: Querying the Event Log for Logons (Part D)

In Part A of this series ('Get-Winevent Part III Querying the Event Log for logons'), I worked with the 'where-object' cmdlet to filter through properties of specific logon event types. In Part B, I used '-filterhashtable' and 'findstr' to more quickly dig into the message field of logon events, utlimately producing a spreadsheet or database format of those events. In Part C, I presented code that enumerates all provider types for these events.  Then I used '-filterhashtable' with an array of multiple security EventIDs whose select 'Message' fields I searched with 'findstr' for specific properties relating to logons.  In this post (Part D),  I pull this all together, creating a timeline of multiple security EventIDs whose select 'Message' fields I pump into a spreadsheet for further analysis.


Here I get the desired 'logon' events into spreadsheet format:

$EventLogonIDs="4611","4624","4625","4634","4647","4648","4672","4774","4775","4908","4964"
$MultipleIDLogEntries=Get-WinEvent -FilterHashtable @{Logname='security';Id=@($EventLogonIDs)}
foreach ($item in  $MultipleIDLogEntries) {($item | Select TimeCreated, Message | fl * | findstr /G:search.lst) -replace"  ","" -join "," | out-file -append test5.csv }


where search.lst :

TimeCreated
Security ID:
Account Name:
Account Domain:
Logon ID:
Logon Type:
Logon GUID:
Process Name:

Now I get the desired 'sleep' events into spreadsheet format. (My original concern was understanding a why my Windows 7 PC spontaneously "resumes from sleep" by itself and seemingly commences a log-on.)

$EventLogonIDs="1","42"
$MultipleIDLogEntries=Get-WinEvent -FilterHashtable @{Logname='system';Id=@($EventLogonIDs)}
foreach ($item in  $MultipleIDLogEntries) {($item | Select TimeCreated, Message | fl * | findstr /I /G:search.lst) -replace"  ","" -join "," | out-file -append test6.csv }


where search.lst :

TimeCreated
sleep


Now I mux the two data sets and output the combined csv:

$a=gc .\test5.csv
$b=gc .\test6.csv
$c=$a+$b
$c | out-file test7.csv

Once I translate the csv to a spreadsheet's native format, add column headers, format the Date/Time Column (the unique identifier for our purposes) and sort by Date/Time, I have a story book of events for the muxed security (e.g. 'logon') and system (e.g. 'sleep') events:

Next we need to discuss how to add additional Security auditing events to our storybook in Part E.

Read More

Bejtlich Teaching in Abu Dhabi in December

I'm pleased to announce that on December 12-13 at Black Hat Abu Dhabi I will teach a special two-day edition of TCP/IP Weapons School 3.0.

This class is designed for junior and intermediate security analysts. The "sweet spot" for the potential student is someone working in a security operations center (SOC) or computer incident response team (CIRT), or someone trying to establish one of those organizations. The class is very hands-on, and focuses on labs and discussions. There are less than 10 slides at the very beginning of the class, and I build the flow of the class based on what you want to hear.

If you would like details on the class, please see the linked site. You may also find my announcement for my Black Hat sessions on 30-31 July and 1-2 August to be helpful too. I'm looking forward to seeing you learn the investigative mindset needed to detect and respond to digital intrusions!

Black Hat has four remaining price points and deadlines for registration.

• "Best" ends 15 August


• "Early" ends 17 August


• "Late" ends 12 December


• Onsite starts at the conference

Seats are filling -- it pays to register early!

On a related note, we're almost one month away from my 8-9 August TCP/IP Weapons School 3.0 in San Francisco at USENIX Security 2011. Seats are filling in that class too!

I'm also still working on the details for a northern VA TCP/IP Weapons School 3.0 class. When I have them ready I will post them. Thank you.

Tweet

Read More

Get-Winevent Part III: Querying the Event Log for Logons (Part C)

To list Opcodes, Event IDs, Event Descriptions from any group of provider's (e.g. Securit*) events, you can use:

$ProviderNames=get-winevent -listprovider microsoft-windows-Securit* | % {$_.Name}
$ProviderNames | % {((get-winevent -listprovider $_).events) | format-table @{Name="Opcode"; Expression = {$_.Opcode.Name}},ID,Description -auto -wrap}


To create a list of EventIDs from the Security Log for which want more information, we could download  "Windows 7 and Windows Server 2008 R2 Security Event Descriptions"   or we could select the string log from our provider query:

$ProviderNames | % {((get-winevent -listprovider $_).events) | format-table @{Name="Opcode"; Expression = {$_.Opcode.Name}},ID,Description | findstr "win:"} | out-file  SecurityIDs.txt
Select-string "log" -path SecurityIDs.txt | ft -auto Line

           4611 A trusted logon process has been registered with the Local ...
           4624 An account was successfully logged on....
           4625 An account failed to log on....
           4634 An account was logged off....
           4647 User initiated logoff:...
           4648 A logon was attempted using explicit credentials....
           4672 Special privileges assigned to new logon....
           4774 An account was mapped for logon....
           4775 An account could not be mapped for logon....
           4908 Special Groups Logon table modified....
           4964 Special groups have been assigned to a new logon....

Now we query all of our particular IDs in question using the search list for findstr below:

$LogonIDs="4611","4624","4625","4634","4647","4648","4672","4774","4775","4908","4964"
foreach ($item in $LogonIDs) {(Get-WinEvent -max 100 -FilterHashtable @{Logname='security';Id=$item} | Select TimeCreated,Message | fl * | findstr /G:search.lst) -replace"  "," " | out-file -append "$item.txt" }

where search.lst :

TimeCreated
Security ID:
Account Name:
Account Domain:
Logon ID:
Logon Type:
Logon GUID:
Process Name:

This gives us some hits for the EventID numbers in separate files which contain entries that look like this:

PS C:\ps1> more 4624.txt
TimeCreated : 7/2/2011 7:25:59 PM
                  Security ID:        S-1-5-18
                  Account Name:        RMFVPC$
                  Account Domain:        RMFDEVELOPMENT
                  Logon ID:        0x3e7
              Logon Type:            5
                  Security ID:        S-1-5-18
                  Account Name:        SYSTEM
                  Account Domain:        NT AUTHORITY
                  Logon ID:        0x3e7
                  Logon GUID:        {00000000-0000-0000-0000-000000000000}
                  Process Name:        C:\Windows\System32\services.exe
....
But this type of query isn't very fast. So we can tuck our array of events inside a '-FilterHashtable' array and then query the message field with 'findstr':

$LogonIDs="4611","4624","4625","4634","4647","4648","4672","4774","4775","4908","4964"
$MultipleIDLogEntries=Get-WinEvent -max 100 -FilterHashtable @{Logname='security';Id=@($LogonIDs)}
($MultipleIDLogEntries | Select TimeCreated,Message | fl * | findstr /G:search.lst) -replace" "," " | out-file -append Events_all.txt

This output also contain entries that look like this:

PS C:\ps1> more Events_all.txt
TimeCreated : 7/2/2011 7:25:59 PM
                  Security ID:        S-1-5-18
                  Account Name:        SYSTEM
                  Account Domain:        NT AUTHORITY
                  Logon ID:        0x3e7
TimeCreated : 7/2/2011 7:25:59 PM
                  Security ID:        S-1-5-18
                  Account Name:        RMFVPC$
                  Account Domain:        RMFDEVELOPMENT
                  Logon ID:        0x3e7
              Logon Type:            5
                  Security ID:        S-1-5-18
                  Account Name:        SYSTEM
                  Account Domain:        NT AUTHORITY
                  Logon ID:        0x3e7
                  Logon GUID:        {00000000-0000-0000-0000-000000000000}
                  Process Name:        C:\Windows\System32\services.exe

But what we really need is a way to parse this output into a csv... so on to  Get-Winevent Part III: Querying the Event Log for Logons (Part D)

Read More

Google+ vs Facebook - Who will win?

Google+ is Google's latest attempt to take some of the social network from Facebook.

Now that I have Google+ I thought it would be interesting to do a short little comparison. It is fairly obvious that Google is trying their hand at social networking and hoping to dive into Facebook's market. It will be interesting to see if that can actually happen.

As an evaluation, I decided to list the features that people use on Facebook and compare them to Google+

Read article »

Read More

Get-Winevent Part III: Querying the Event Log for Logons (Part B)

This is a long post that I've edited from a answer I gave on Stack Overflow.  Although the post is about how to audit logon information in the Security log of Windows 7, it is also about discovering methods to extract critical information from the 'Message' field of a "Logon Type" (ID=4624).  




Get-WinEvent -max 100 | where { $_.Message | findstr /C:"Logon Type"}  | Select Message | fl * | findstr /C:"Logon Type"

  Logon Type:            5
  Logon Type:            7
  Logon Type:            7
  Logon Type:            7
  Logon Type:            7
  Logon Type:            5
  ...

Get-WinEvent Security -max 100 | Select ID,Level,Message | where { $_.Message | findstr /C:"Logon Type"}  | ft -auto -wrap | more

  Id Level Message
  -- ----- -------
4624     0 An account was successfully logged on.

           Subject:
               Security ID:        S-1-5-18
               Account Name:        RMFVPC$
               Account Domain:        RMFDEVELOPMENT
               Logon ID:        0x3e7

           Logon Type:            5
....
Now I introduce '-FilterHashtable' parameter which greatly speeds up queries. Below are two commands which do essentially the same thing in about the same period of time:

Get-WinEvent -max 100 -FilterHashtable @{Logname='security';ID=4624} | ft TimeCreated,MachineName,Message -auto -wrap | more

Get-WinEvent -max 100 -FilterHashtable @{Logname='security';ID=4624} | Select TimeCreated,MachineName,Message | ft -auto -wrap | more

TimeCreated           MachineName Message
-----------           ----------- -------
6/29/2011 12:36:35 PM rmfvpc      An account was successfully logged on.

                                  Subject:
                                      Security ID:        S-1-5-18
                                      Account Name:        RMFVPC$
                                      Account Domain:        RMFDEVELOPMENT
                                      Logon ID:        0x3e7

                                  Logon Type:            5
...

Get-WinEvent -max 100 -FilterHashtable @{Logname='security';ID=4624} | Select TimeCreated,MachineName,Message | Select-string "Logon Type" | more

@{TimeCreated=06/29/2011 12:36:35; MachineName=rmfvpc; Message=An account was successfully logged on.

Subject:
    Security ID:        S-1-5-18
    Account Name:        RMFVPC$
    Account Domain:        RMFDEVELOPMENT
    Logon ID:        0x3e7

Logon Type:            5
...
This last script allows me to dump pre-selected information from the logon events Message field into a spreadsheet. Very useful.

 $LogonTypes=Get-WinEvent -FilterHashtable @{Logname='security';Id=4624}
 foreach ($item in $LogonTypes) {($item | Select TimeCreated, Message | fl * | findstr /G:search.lst) -replace"  ","" -join "," | out-file -append test3.csv }

where search.lst :

TimeCreated
Security ID:
Account Name:
Account Domain:
Logon ID:
Logon Type:
Logon GUID:
Process Name:

The result is a spreadsheet that looks like this:

However, what I need is to be able to search the message field of multiple 'logon' events types...so on to

Get-Winevent Part III: Querying the Event Log for Logons (Part C)

Read More