powershell - 如何获取与 0x1 或 0x4 匹配的 Powershell > Get-WinEvent > Security > Message > Access Mask
问题描述
如何获取消息为 0x1|0x4|等的安全 ID 4663。
我尝试了不同的代码,我只想将大约 5 个代码记录到 CSV,我可以导出到 CSV,并且我只能提取 4663 ID,但我无法过滤消息访问掩码,它是消息字段中的文本,任何人都有任何想法,这是我迄今为止建立的代码: -
$Results = foreach($server in "server-name")
{
Get-WinEvent -ComputerName $Server -logname security -MaxEvents 10 -ErrorAction SilentlyContinue | where {$_.id -eq "4663"} | select Timecreated, ID, Message | Get-EventLog "Security" -before 4/10/2013 -InstanceId 4663 | % {
New-Object psobject -Property @{
Index = $_.Index
TimeGenerated = $_.TimeGenerated
"Account Name" = $_.ReplacementStrings[1]
"Object Type" = $_.ReplacementStrings[5]
"Object Name" = $_.ReplacementStrings[6]
}
} | Write-Host
这得到了记录
#$Results = foreach($server in "file-server")
#{
# Get-WinEvent -ComputerName $Server -logname security -MaxEvents 10 -ErrorAction SilentlyContinue | where {$_.id -eq "4663"} | select #Timecreated, ID, Message | Write-Host
结果应该是
帐户名称:对象名称:WHERE 记录是访问掩码之一:“0x0”、“0x1”、“0x2”、“0x4”、“0x20”、“0x40”、“0x10000”
解决方案
因此,让我们更深入地了解窗口事件消息。
每条消息都有一个模板。您可以查看模板,例如
(Get-WinEvent -ListProvider * -ErrorAction Ignore).Events |
select Id, Version, Template |
Format-List
我们可以向下挖掘找到我们正在寻找的事件也喜欢
(Get-WinEvent -ListProvider * -ErrorAction Ignore).Events |
Where-Object {$_.Id -eq 4663} |
select Id, Version, Template |
Format-List
我们可以看到在 windows 中使用了 2 个版本的模板。我们还可以看到专有名称是什么。
Template : <template xmlns="http://schemas.microsoft.com/win/2004/08/events">
<data name="SubjectUserSid" inType="win:SID" outType="xs:string"/>
<data name="SubjectUserName" inType="win:UnicodeString" outType="xs:string"/>
<data name="SubjectDomainName" inType="win:UnicodeString" outType="xs:string"/>
<data name="SubjectLogonId" inType="win:HexInt64" outType="win:HexInt64"/>
<data name="ObjectServer" inType="win:UnicodeString" outType="xs:string"/>
<data name="ObjectType" inType="win:UnicodeString" outType="xs:string"/>
<data name="ObjectName" inType="win:UnicodeString" outType="xs:string"/>
<data name="HandleId" inType="win:Pointer" outType="win:HexInt64"/>
<data name="AccessList" inType="win:UnicodeString" outType="xs:string"/>
<data name="AccessMask" inType="win:HexInt32" outType="win:HexInt32"/>
<data name="ProcessId" inType="win:Pointer" outType="win:HexInt64"/>
<data name="ProcessName" inType="win:UnicodeString" outType="xs:string"/>
<data name="ResourceAttributes" inType="win:UnicodeString" outType="xs:string"/>
</template>
在帖子中,我们想要获取访问掩码。我们可以在模板中看到
<data name="AccessMask" inType="win:HexInt32" outType="win:HexInt32"/>
因此,我们将获取所有符合我们想要的 ID 的事件,即 4663,并将输出限制为 10
Get-WinEvent -logname security -FilterXPath "*[System[EventID=4663]]" -MaxEvents 10
我们将该输出转换为 XML 并解析为我们得到这些设置,然后创建一个 PSObject 来存储所有这些设置。然后我们将每个 PSObject 添加到一个 ArrayList。
$ArrayList = New-Object System.Collections.ArrayList
Get-WinEvent -logname security -FilterXPath "*[System[EventID=4663]]" -MaxEvents 10 | %{
$XML = [xml]$_.toXml()
$PsObject = New-Object psobject
$XML.Event.EventData.Data | %{
$PsObject | Add-Member -MemberType NoteProperty -Name $_.Name -Value $_."#text"
}
$ArrayList.add($PsObject) | out-null
}
$ArrayList | Select AccessMask
我们在arraylist 上只选择AccessMask,我们很好。
在结束说明中,我为此编写了一个函数。
function Parse-WindowsEvents(){
param(
[Parameter(Position=1, ValueFromPipeline)]
[object[]]$Events
)
process{
$ArrayList = New-Object System.Collections.ArrayList
$Events | %{
$EventObj = $_
$EventObjFullName = $_.GetType().FullName
if($EventObjFullName -like "System.Diagnostics.EventLogEntry"){
$EventObj = Get-WinEvent -LogName security -FilterXPath "*[System[EventRecordID=$($_.get_Index())]]"
}elseif($EventObjFullName -like "System.Diagnostics.Eventing.Reader.EventLogRecord"){
}else{
throw "Not An Event System.Diagnostics.Eventing.Reader.EventLogRecord or System.Diagnostics.EventLogEntry"
}
$PsObject = New-Object psobject
$EventObj.psobject.properties | %{
$PsObject | Add-Member -MemberType NoteProperty -Name $_.Name -Value $_.Value
}
$XML = [xml]$EventObj.toXml()
$PsObject2 = New-Object psobject
$XML.Event.EventData.Data | %{
$PsObject2 | Add-Member -MemberType NoteProperty -Name $_.Name -Value $_."#text"
}
$PsObject | Add-Member -MemberType NoteProperty -Name ParsedMessage -Value $PsObject2
$ArrayList.add($PsObject) | out-null
}
return $ArrayList
}
}
示例用法
Get-EventLog -LogName Security | select -first 3 | Parse-WindowsEvents | select id, recordid -ExpandProperty parsedmessage | fl
或者
get-winevent -logName security | parse-winevents
该函数将向名为 ParsedMessage 的对象添加一个新属性
推荐阅读
- pandas - Crosstab multiple aggfunc has '_dummy_' error
- python - 如何使用 Python 修改 tsv 文件列
- asp.net - Why does my ASPX app keep logging the user out?
- angular - Highchart graphs embedded in ngfor table disappear when a row filter is applied
- c - AVR Timer and Hardware interrupts
- cucumber - cucumber example seems adding more items
- matlab - How to plot family of functions in MATLAB?
- javascript - 自定义 Leaflet 图层控件
- php - 如果 santance 不能与 MYSQL UPDATE 一起使用,则到期日期
- asp.net - How to Get Expire Date from Jwt Empty Payload