In the Open
In the Open

Logging

Loglevel

|ID|Event Type|Description| |--|----------|-----------| |0|Error|An event that indicates a significant problem.| |1|Warning|An event that is not necessarily significant.| |2|Information|An event describing the successful operation of an application.| |3|Success Audit|An event that records an audited security access attempt that is successful.| |4|Failure Audit|An event that records an audited security access attempt that is failure.|

Logrotation

C:\Windows\System32\winevt\Logs
  • As an example, paths can be found under Microsoft > Windows > PowerShell > Operational and right click Properties in Event Viewer. Logs can be cleared as well in properties.

Tools

  • Event Viewer (GUI-based application)
  • Wevtutil.exe (command-line tool)
  • Get-WinEvent (PowerShell cmdlet)

wevtutil.exe

wevtutil.exe /?
  • Count logs
wevtutil.exe le | measure
  • Read three most recent Application logs
wevtutil qe Application /c:3 /rd:true /f:text

Get-WinEvent

Get-WinEvent -ListLog *
  • Find string
 Get-WinEvent -Path .\merged.evtx | Where-Object { $_.Message -like '*log clear*' }
  • Further filtering
Get-WinEvent -LogName Application | Where-Object { $_.ProviderName -Match 'WLMS' }

Get-WinEvent -ListProvider *Policy*

(Get-WinEvent -ListProvider Microsoft-Windows-GroupPolicy).Events | Format-Table Id, Description
  • Filter by hashtable values
Get-WinEvent -FilterHashtable @{ LogName='Application'; ProviderName='MsiInstaller' };

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; ID=4104} | Select-Object -Property Message | Select-String -Pattern 'SecureString'
  • Including XPATH
Get-WinEvent -LogName Application -FilterXPath '*/System/EventID=101 and */System/Provider[@Name="WLMS"]'

Get-WinEvent -LogName Security -FilterXPath '*/EventData/Data[@Name="TargetUserName"]="System"'

 Get-WinEvent -LogName Application -FilterXPath '*/System/Provider[@Name="WLMS"] and */System/TimeCreated[@SystemTime="2020-12-15T01:09:08.940277500Z"]' -MaxEvents 1
  • Find login by username
Get-WinEvent -LogName Security -FilterXPath '*/System/EventID=4720 and */EventData/Data[@Name="TargetUserName"]="sam"'

Command Line Logging

  • Enable PS Logging
Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell
  • CLI Process Auditing -- ID 4688
Local Computer Policy > Computer Configuration > Administrative Templates > System > Audit Process Creation