用powershell获取sysmon日志
想用powershell获取sysmon日志仍是比较麻烦，开始觉得用Get-EventLog就行，结果试了半天报错：shell
PS D:\> Get-EventLog -LogName Microsoft-Windows-Sysmon/Operational -Newest 20
Get-EventLog : 计算机“.”上的事件日志“Microsoft-Windows-Sysmon/Operational”不存在。
所在位置 行:1 字符: 1
+ Get-EventLog -LogName Microsoft-Windows-Sysmon/Operational -Newest 20
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-EventLog], InvalidOperationException
+ FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.PowerShell.Commands.GetEventLogCommand
上网发现你们都是用的 Get-WinEvent，看了下帮助文档，这个Cmdlet能够获取全部本地和远程计算机的日志，使用-ListLog *能够获取当前主机的全部类型的日志ide
PS C:\> Get-WinEvent -ListLog * LogMode MaximumSizeInBytes RecordCount LogName ------- ------------------ ----------- ------- Circular 20971520 24186 Application Circular 20971520 0 HardwareEvents Circular 1052672 0 Internet Explorer Circular 20971520 0 Key Management Service Circular 1052672 117 OAlerts Circular 1052672 0 PreEmptive Circular 20971520 25272 Security Circular 20971520 13277 System Circular 15728640 4381 Windows PowerShell Circular 1052672 0 AMSI/Operational Circular 20971520 ForwardedEvents Circular 1052672 200 Lenovo-Power-BaseModule/Operational Circular 10485760 0 Microsoft-AppV-Client/Admin Circular 10485760 0 Microsoft-AppV-Client/Operational Circular 10485760 0 Microsoft-AppV-Client/Virtual Applications Circular 1052672 2103 Microsoft-Client-Licensing-Platform/Admin Circular 1052672 Microsoft-Management-UI/Admin Circular 1052672 0 Microsoft-Rdms-UI/Admin Circular 1052672 0 Microsoft-Rdms-UI/Operational Circular 1052672 0 Microsoft-User Experience Virtualization-Agent ......
根据网上的例子，使用哈希表同时指定日志类型和事件ID，能够查询sysmon的某类ID的事件日志ui
PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 10
ProviderName:Microsoft-Windows-Sysmon
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
2019/4/1 22:23:35 17 信息 Pipe Created:...
2019/4/1 22:23:35 17 信息 Pipe Created:...
2019/4/1 22:23:35 17 信息 Pipe Created:...
2019/4/1 22:23:34 17 信息 Pipe Created:...
2019/4/1 22:23:34 17 信息 Pipe Created:...
2019/4/1 22:23:34 17 信息 Pipe Created:...
2019/4/1 22:23:33 17 信息 Pipe Created:...
2019/4/1 22:23:33 17 信息 Pipe Created:...
2019/4/1 22:23:33 17 信息 Pipe Created:...
2019/4/1 22:23:33 17 信息 Pipe Created:...
接下来我但愿获取日志中的其余消息，想到使用 Format-Table指定属性的方法，首先我查询到sysmon的事件ID为17的日志中的属性有：RuleName，UtcTime，ProcessGuid，ProcessId，PipeName，Image，而后用指定属性输出：日志
PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 10 | Format-Tab
le -Property UtcTime,processguid, processid,pipename,image -AutoSize -Wrap
UtcTime processguid ProcessId pipename image
------- ----------- --------- -------- -----
4140
4140
4140
4140
4140
4140
4140
4140
4140
4140
可是发现只有一个ProcessId有值，其余都为空！这就很奇怪。而后使用Format-List *获取一下日志的属性都有什么：code
PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 10 | Format-List *
Message : Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.814
ProcessGuid: {791A80C2-1EE7-5CA2-0000-0010E60FF000}
ProcessId: 6724
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Id : 17
Version : 1
Qualifiers :
Level : 4
Task : 17
Opcode : 0
Keywords : -9223372036854775808
RecordId : 113253
ProviderName : Microsoft-Windows-Sysmon
ProviderId : 5770385f-c22a-43e0-bf4c-06f5698ffbd9
LogName : Microsoft-Windows-Sysmon/Operational
ProcessId : 4140
ThreadId : 6228
MachineName : DESKTOP-DKGHJUN
UserId : S-1-5-18
TimeCreated : 2019/4/1 22:23:35
ActivityId :
RelatedActivityId :
ContainerLog : Microsoft-Windows-Sysmon/Operational
MatchedQueryIds : {}
Bookmark : System.Diagnostics.Eventing.Reader.EventBookmark
LevelDisplayName : 信息
OpcodeDisplayName : 信息
TaskDisplayName : Pipe Created (rule: PipeEvent)
KeywordsDisplayNames : {}
Properties : {System.Diagnostics.Eventing.Reader.EventProperty,
System.Diagnostics.Eventing.Reader.EventProperty,
System.Diagnostics.Eventing.Reader.EventProperty,
System.Diagnostics.Eventing.Reader.EventProperty...}
......
结果发现日志的信息都在Message里面，连显示的进程ID都是错的。知道缘由了，也就是说获取sysmon的日志信息的话只须要显示一条Message就够了。orm
PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 10 | Format-Table -Property message -Wrap
Message
-------
Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.814
ProcessGuid: {791A80C2-1EE7-5CA2-0000-0010E60FF000}
ProcessId: 6724
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.751
ProcessGuid: {791A80C2-1EE7-5CA2-0000-00108D0AF000}
ProcessId: 856
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Pipe Created:
可是这种结果并不利于查看，须要在前面添加几列信息，让每一条结果能显示的更易于区分。经过Format-List *查看有哪些属性是比较有用的，此次选择ID，TaskDisplayName这两项：进程
PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 5 | Format-Table -Property ID,TaskDisplayName,message -Wrap
Id TaskDisplayName Message
-- --------------- -------
17 Pipe Created (rule: PipeEvent) Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.814
ProcessGuid: {791A80C2-1EE7-5CA2-0000-0010E60FF000}
ProcessId: 6724
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
17 Pipe Created (rule: PipeEvent) Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.751
ProcessGuid: {791A80C2-1EE7-5CA2-0000-00108D0AF000}
ProcessId: 856
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
17 Pipe Created (rule: PipeEvent) Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.353
ProcessGuid: {791A80C2-1EE7-5CA2-0000-00103F04F000}
ProcessId: 10636
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
......
可是这个结果也很差，由于获取到某个ID的日志后不能继续搜索了。事件
遗留了两个问题：ip
- Get-EventLog和Get-WinEvent两个cmdlet的差别在哪里？
- 如何进一步筛选sysmon日志？
相关文章
- 1. PowerShell获取系统日志
- 2. PowerShell 抓取网络日志
- 3. HiveServer2 获取日志
- 4. iOS 获取日志
- 5. Docker log-日志的获取
- 6. 获取Android手机日志
- 7. Android 日志获取总结
- 8. ELK获取nginx日志
- 9. SSM获取AOP日志
- 10. golang 获取es 日志
- 更多相关文章...
- • PHP imageaffinematrixget - 获取矩阵 - PHP参考手册
- • XML DOM 获取节点值 - XML DOM 教程
- • Composer 安装与使用
- • 使用Rxjava计算圆周率
相关标签/搜索
每日一句
-
每一个你不满意的现在，都有一个你没有努力的曾经。
欢迎关注本站公众号,获取更多信息
相关文章
- 1. PowerShell获取系统日志
- 2. PowerShell 抓取网络日志
- 3. HiveServer2 获取日志
- 4. iOS 获取日志
- 5. Docker log-日志的获取
- 6. 获取Android手机日志
- 7. Android 日志获取总结
- 8. ELK获取nginx日志
- 9. SSM获取AOP日志
- 10. golang 获取es 日志