Journaux Windows
PowerShell, Sysmon et recherches
Canaux Windows, Event IDs prioritaires, PowerShell, Sysmon et méthodes de recherche reproductibles.
Get-WinEvent
# Échecs des dernières 24 h
$start=(Get-Date).AddHours(-24)
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625;StartTime=$start} |
Select-Object TimeCreated, Id, MachineName, Message
# Depuis un EVTX exporté
Get-WinEvent -Path .\Security.evtx -FilterXPath '*[System[(EventID=4624 or EventID=4625)]]'
PowerShell Operational
Get-WinEvent -FilterHashtable @{
LogName='Microsoft-Windows-PowerShell/Operational'
Id=4104
StartTime=(Get-Date).AddDays(-1)
} | Where-Object Message -Match 'EncodedCommand|DownloadString|Invoke-WebRequest'
Sysmon prioritaires
| ID | Événement |
|---|---|
| 1 | Process Create |
| 3 | Network Connection |
| 7 | Image Load |
| 8 | CreateRemoteThread |
| 10 | Process Access |
| 11 | File Create |
| 12-14 | Registry |
| 22 | DNS Query |
| 23/26 | File Delete |
Exemple Splunk Sysmon
index=sysmon EventCode=1
| eval cmd=coalesce(CommandLine,process)
| where match(lower(cmd),"(encodedcommand|-enc |downloadstring|rundll32|regsvr32)")
| table _time host User ParentImage Image cmd
Corrélation
Associe le ProcessGuid Sysmon entre processus, réseau et création de fichiers lorsque disponible.