Compare commits
No commits in common. 'main' and 'NineLamp' have entirely different histories.
Binary file not shown.
@ -1,100 +1,99 @@
|
|||||||
{
|
[
|
||||||
"description": "此 JSON 文件包含与 O365 安全检测相关的规则，每条规则包括名称、严重性等级和查询语句。",
|
{
|
||||||
"rules": [
|
"name": "Suspicious User Agent",
|
||||||
{
|
"severity": "High",
|
||||||
"name": "Suspicious User Agent",
|
"query": "SELECT * FROM events WHERE UserAgent LIKE '%python%' OR UserAgent LIKE '%ruler%' OR UserAgent LIKE '%curl%' OR UserAgent LIKE '%Wget%' OR UserAgent LIKE '%python-requests%' OR UserAgent LIKE '%AADInternals%' OR UserAgent LIKE '%azurehound%' OR UserAgent LIKE '%axios%' OR UserAgent LIKE '%BAV2ROPC%' "
|
||||||
"severity": "High",
|
},
|
||||||
"query": "SELECT * FROM events WHERE UserAgent LIKE '%python%' OR UserAgent LIKE '%ruler%' OR UserAgent LIKE '%curl%' OR UserAgent LIKE '%Wget%' OR UserAgent LIKE '%python-requests%' OR UserAgent LIKE '%AADInternals%' OR UserAgent LIKE '%azurehound%' OR UserAgent LIKE '%axios%' OR UserAgent LIKE '%BAV2ROPC%' "
|
{
|
||||||
},
|
"name": "User adding or removing Inbox Rule",
|
||||||
{
|
"severity": "Medium",
|
||||||
"name": "User adding or removing Inbox Rule",
|
"query": "SELECT * FROM events WHERE Operation LIKE '%InboxRule%' OR Operation LIKE 'Set-Mailbox' OR Operation LIKE '%DeliverToMailboxAndForward%' OR Operation LIKE '%ForwardingAddress%' OR Operation LIKE '%ForwardingAddress%' "
|
||||||
"severity": "Medium",
|
},
|
||||||
"query": "SELECT * FROM events WHERE Operation LIKE '%InboxRule%' OR Operation LIKE 'Set-Mailbox' OR Operation LIKE '%DeliverToMailboxAndForward%' OR Operation LIKE '%ForwardingAddress%' OR Operation LIKE '%ForwardingAddress%' "
|
{
|
||||||
},
|
"name": "After Hours Activity",
|
||||||
{
|
"severity": "Medium",
|
||||||
"name": "After Hours Activity",
|
"query": "SELECT * FROM events WHERE (CASE WHEN CAST(substr(CreationTime, 12, 2) AS INTEGER) < 0 THEN 24 + (CAST(substr(CreationTime, 12, 2) AS INTEGER)) ELSE CAST(substr(CreationTime, 12, 2) AS INTEGER) END >= 20 OR CASE WHEN CAST(substr(CreationTime, 12, 2) AS INTEGER) < 0 THEN 24 + (CAST(substr(CreationTime, 12, 2) AS INTEGER)) ELSE CAST(substr(CreationTime, 12, 2) AS INTEGER) END < 6) AND NOT (Operation LIKE 'File%' OR Operation LIKE 'List%' OR Operation LIKE 'Page%' OR Operation LIKE '%UserLogin%');"
|
||||||
"severity": "Medium",
|
},
|
||||||
"query": "SELECT * FROM events WHERE (CASE WHEN CAST(substr(CreationTime, 12, 2) AS INTEGER) < 0 THEN 24 + (CAST(substr(CreationTime, 12, 2) AS INTEGER)) ELSE CAST(substr(CreationTime, 12, 2) AS INTEGER) END >= 20 OR CASE WHEN CAST(substr(CreationTime, 12, 2) AS INTEGER) < 0 THEN 24 + (CAST(substr(CreationTime, 12, 2) AS INTEGER)) ELSE CAST(substr(CreationTime, 12, 2) AS INTEGER) END < 6) AND NOT (Operation LIKE 'File%' OR Operation LIKE 'List%' OR Operation LIKE 'Page%' OR Operation LIKE '%UserLogin%');"
|
{
|
||||||
},
|
"name": "Possible file exfiltration",
|
||||||
{
|
"severity": "Low",
|
||||||
"name": "Possible file exfiltration",
|
"query": "SELECT * FROM events WHERE Operation LIKE '%FileUploaded%' "
|
||||||
"severity": "Low",
|
},
|
||||||
"query": "SELECT * FROM events WHERE Operation LIKE '%FileUploaded%' "
|
{
|
||||||
},
|
"name": "Admin searching in emails of other users",
|
||||||
{
|
"severity": "Low",
|
||||||
"name": "Admin searching in emails of other users",
|
"query": "SELECT * FROM events WHERE Operation LIKE '%SearchStarted%' OR Operation LIKE '%SearchExportDownloaded%' OR Operation LIKE '%ViewedSearchExported%' "
|
||||||
"severity": "Low",
|
},
|
||||||
"query": "SELECT * FROM events WHERE Operation LIKE '%SearchStarted%' OR Operation LIKE '%SearchExportDownloaded%' OR Operation LIKE '%ViewedSearchExported%' "
|
{
|
||||||
},
|
"name": "Strong Authentication Disabled",
|
||||||
{
|
"severity": "medium",
|
||||||
"name": "Strong Authentication Disabled",
|
"query": "SELECT * FROM events WHERE Operation LIKE '%disable strong authentication%'"
|
||||||
"severity": "medium",
|
},
|
||||||
"query": "SELECT * FROM events WHERE Operation LIKE '%disable strong authentication%'"
|
{
|
||||||
},
|
"name": "User added to admin group",
|
||||||
{
|
"severity": "High",
|
||||||
"name": "User added to admin group",
|
"query": "SELECT * FROM events WHERE ( Operation LIKE '%add member to group%' AND ModifiedProperties Like '%admin%') OR ( Operation LIKE '%AddedToGroup%' AND TargetUserOrGroupName Like '%admin%') "
|
||||||
"severity": "High",
|
},
|
||||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%add member to group%' AND ModifiedProperties Like '%admin%') OR ( Operation LIKE '%AddedToGroup%' AND TargetUserOrGroupName Like '%admin%') "
|
{
|
||||||
},
|
"name": "New Policy created",
|
||||||
{
|
"severity": "Medium",
|
||||||
"name": "New Policy created",
|
"query": "SELECT * FROM events WHERE ( Operation LIKE '%add policy%' ) "
|
||||||
"severity": "Medium",
|
},
|
||||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%add policy%' ) "
|
{
|
||||||
},
|
"name": "Security Alert triggered",
|
||||||
{
|
"severity": "Medium",
|
||||||
"name": "Security Alert triggered",
|
"query": "SELECT * FROM events WHERE ( Operation LIKE '%AlertTriggered%' AND NOT Severity Like '%Low%') "
|
||||||
"severity": "Medium",
|
},
|
||||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%AlertTriggered%' AND NOT Severity Like '%Low%') "
|
{
|
||||||
},
|
"name": "Transport rules ( mail flow rules ) modified",
|
||||||
{
|
"severity": "High",
|
||||||
"name": "Transport rules ( mail flow rules ) modified",
|
"query": "SELECT * FROM events WHERE ( Operation LIKE '%TransportRule%') "
|
||||||
"severity": "High",
|
},
|
||||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%TransportRule%') "
|
{
|
||||||
},
|
"name": "An application was registered in Azure AD",
|
||||||
{
|
"severity": "Medium",
|
||||||
"name": "An application was registered in Azure AD",
|
"query": "SELECT * FROM events WHERE ( Operation LIKE '%Add service principal.%') "
|
||||||
"severity": "Medium",
|
},
|
||||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%Add service principal.%') "
|
{
|
||||||
},
|
"name": "Add app role assignment grant to user",
|
||||||
{
|
"severity": "Medium",
|
||||||
"name": "Add app role assignment grant to user",
|
"query": "SELECT * FROM events WHERE ( Operation LIKE '%Add app role assignment grant to user.%') "
|
||||||
"severity": "Medium",
|
},
|
||||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%Add app role assignment grant to user.%') "
|
{
|
||||||
},
|
"name": "eDiscovery Abuse",
|
||||||
{
|
"severity": "High",
|
||||||
"name": "eDiscovery Abuse",
|
"query": "SELECT * FROM events WHERE ( Operation LIKE '%New-ComplianceSearch%') "
|
||||||
"severity": "High",
|
},
|
||||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%New-ComplianceSearch%') "
|
{
|
||||||
},
|
"name": "Operations affecting OAuth Applications",
|
||||||
{
|
"severity": "Medium",
|
||||||
"name": "Operations affecting OAuth Applications",
|
"query": "SELECT * FROM events WHERE ( Operation = 'Add application.' OR Operation = 'Update application' OR Operation = 'Add service principal.' OR Operation = 'Update application Certificates and secrets management' OR Operation = 'Update applicationUpdate service principal.' OR Operation = 'Add app role assignment grant to user.' OR Operation = 'Add delegated permission grant.' OR Operation = 'Add owner to application.' OR Operation = 'Add owner to service principal.') "
|
||||||
"severity": "Medium",
|
},
|
||||||
"query": "SELECT * FROM events WHERE ( Operation = 'Add application.' OR Operation = 'Update application' OR Operation = 'Add service principal.' OR Operation = 'Update application Certificates and secrets management' OR Operation = 'Update applicationUpdate service principal.' OR Operation = 'Add app role assignment grant to user.' OR Operation = 'Add delegated permission grant.' OR Operation = 'Add owner to application.' OR Operation = 'Add owner to service principal.') "
|
{
|
||||||
},
|
"name": "Suspicious Operations affecting Mailbox ",
|
||||||
{
|
"severity": "Medium",
|
||||||
"name": "Suspicious Operations affecting Mailbox ",
|
"query": "SELECT * FROM events WHERE ( Operation = 'Set-MailboxJunkEmailConfiguration' OR Operation = 'SoftDelete' OR Operation = 'SendAs' OR Operation = 'HardDelete' OR Operation = 'MoveToDeletedItems' ) "
|
||||||
"severity": "Medium",
|
},
|
||||||
"query": "SELECT * FROM events WHERE ( Operation = 'Set-MailboxJunkEmailConfiguration' OR Operation = 'SoftDelete' OR Operation = 'SendAs' OR Operation = 'HardDelete' OR Operation = 'MoveToDeletedItems' ) "
|
{
|
||||||
},
|
"name": "Suspicious Operations affecting SharePoint ",
|
||||||
{
|
"severity": "Medium",
|
||||||
"name": "Suspicious Operations affecting SharePoint ",
|
"query": "SELECT * FROM events WHERE ( Operation = 'AddedToSecureLink' OR Operation = 'SearchQueryPerformed' OR Operation = 'SecureLinkCreated' OR Operation = 'SecureLinkUpdated' OR Operation = 'SharingInvitationCreated' ) "
|
||||||
"severity": "Medium",
|
},
|
||||||
"query": "SELECT * FROM events WHERE ( Operation = 'AddedToSecureLink' OR Operation = 'SearchQueryPerformed' OR Operation = 'SecureLinkCreated' OR Operation = 'SecureLinkUpdated' OR Operation = 'SharingInvitationCreated' ) "
|
{
|
||||||
},
|
"name": "User Modifying RetentionPolicy ",
|
||||||
{
|
"severity": "High",
|
||||||
"name": "User Modifying RetentionPolicy ",
|
"query": "SELECT * FROM events WHERE ( Operation LIKE '%UnifiedAuditLogRetentionPolicy%' ) "
|
||||||
"severity": "High",
|
},
|
||||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%UnifiedAuditLogRetentionPolicy%' ) "
|
{
|
||||||
},
|
"name": "User Modifying Audit Logging ",
|
||||||
{
|
"severity": "High",
|
||||||
"name": "User Modifying Audit Logging ",
|
"query": "SELECT * FROM events WHERE ( Operation LIKE '%AdminAuditLogConfig%' ) "
|
||||||
"severity": "High",
|
},
|
||||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%AdminAuditLogConfig%' ) "
|
{
|
||||||
},
|
"name": "String Authentication Disabled ",
|
||||||
{
|
"severity": "High",
|
||||||
"name": "String Authentication Disabled ",
|
"query": "SELECT * FROM events WHERE ( Operation LIKE '%Disable Strong Authentication.%' ) "
|
||||||
"severity": "High",
|
}
|
||||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%Disable Strong Authentication.%' ) "
|
|
||||||
}
|
|
||||||
]
|
]
|
||||||
}
|
|
||||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 10 KiB |
|
After Width: | Height: | Size: 236 KiB |
|
After Width: | Height: | Size: 86 KiB |
|
After Width: | Height: | Size: 70 KiB |
|
After Width: | Height: | Size: 222 KiB |
@ -1,107 +1,101 @@
|
|||||||
# 尝试创建一个名为 "wineventlog" 的目录
|
try{
|
||||||
try {
|
New-Item -ItemType "directory" -Path "wineventlog"
|
||||||
New-Item -ItemType "directory" -Path "wineventlog"
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果创建目录失败，输出错误信息
|
{
|
||||||
echo "can't create a new directory"
|
echo "can't create a new directory"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试获取安全日志并导出为 CSV 文件
|
try{
|
||||||
try {
|
get-eventlog -log Security | export-csv wineventlog/Security.csv
|
||||||
get-eventlog -log Security | export-csv wineventlog/Security.csv
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果获取安全日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Security Logs"
|
echo "Can't retrieve Security Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试获取系统日志并导出为 CSV 文件
|
try
|
||||||
try {
|
{
|
||||||
Get-WinEvent -LogName System | export-csv wineventlog/System.csv
|
Get-WinEvent -LogName System | export-csv wineventlog/System.csv
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果获取系统日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve System Logs"
|
echo "Can't retrieve System Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试获取应用程序日志并导出为 CSV 文件
|
try{
|
||||||
try {
|
Get-WinEvent -LogName Application | export-csv wineventlog/Application.csv
|
||||||
Get-WinEvent -LogName Application | export-csv wineventlog/Application.csv
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果获取应用程序日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Application Logs"
|
echo "Can't retrieve Application Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试获取 Windows PowerShell 日志并导出为 CSV 文件
|
|
||||||
try {
|
try{
|
||||||
Get-WinEvent -LogName "Windows PowerShell" | export-csv wineventlog/Windows_PowerShell.csv
|
Get-WinEvent -LogName "Windows PowerShell" | export-csv wineventlog/Windows_PowerShell.csv
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果获取 Windows PowerShell 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Windows PowerShell Logs"
|
echo "Can't retrieve Windows PowerShell Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试获取 Microsoft-Windows-TerminalServices-LocalSessionManager/Operational 日志并导出为 CSV 文件
|
try{
|
||||||
try {
|
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" | export-csv wineventlog/LocalSessionManager.csv
|
||||||
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" | export-csv wineventlog/LocalSessionManager.csv
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果获取 LocalSessionManager 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Microsoft-Windows-TerminalServices-LocalSessionManager/Operational Logs"
|
echo "Can't retrieve Microsoft-Windows-TerminalServices-LocalSessionManager/Operational Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试获取 Microsoft-Windows-Windows Defender/Operational 日志并导出为 CSV 文件
|
try{
|
||||||
try {
|
Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" | export-csv wineventlog/Windows_Defender.csv
|
||||||
Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" | export-csv wineventlog/Windows_Defender.csv
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果获取 Windows Defender 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Microsoft-Windows-Windows Defender/Operational Logs"
|
echo "Can't retrieve Microsoft-Windows-Windows Defender/Operational Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试获取 Microsoft-Windows-TaskScheduler/Operational 日志并导出为 CSV 文件
|
try{
|
||||||
try {
|
Get-WinEvent -LogName Microsoft-Windows-TaskScheduler/Operational | export-csv wineventlog/TaskScheduler.csv
|
||||||
Get-WinEvent -LogName Microsoft-Windows-TaskScheduler/Operational | export-csv wineventlog/TaskScheduler.csv
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果获取 TaskScheduler 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Microsoft-Windows-TaskScheduler/Operational Logs"
|
echo "Can't retrieve Microsoft-Windows-TaskScheduler/Operational Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试获取 Microsoft-Windows-WinRM/Operational 日志并导出为 CSV 文件
|
try{
|
||||||
try {
|
Get-WinEvent -LogName Microsoft-Windows-WinRM/Operational | export-csv wineventlog/WinRM.csv
|
||||||
Get-WinEvent -LogName Microsoft-Windows-WinRM/Operational | export-csv wineventlog/WinRM.csv
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果获取 WinRM 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Microsoft-Windows-WinRM/Operational Logs"
|
echo "Can't retrieve Microsoft-Windows-WinRM/Operational Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试获取 Microsoft-Windows-Sysmon/Operational 日志并导出为 CSV 文件
|
try{
|
||||||
try {
|
Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational | export-csv wineventlog/Sysmon.csv
|
||||||
Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational | export-csv wineventlog/Sysmon.csv
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果获取 Sysmon 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Microsoft-Windows-Sysmon/Operational Logs"
|
echo "Can't retrieve Microsoft-Windows-Sysmon/Operational Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试获取 Microsoft-Windows-PowerShell/Operational 日志并导出为 CSV 文件
|
|
||||||
try {
|
try{
|
||||||
Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | export-csv wineventlog/Powershell_Operational.csv
|
Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | export-csv wineventlog/Powershell_Operational.csv
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果获取 PowerShell Operational 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Microsoft-Windows-PowerShell/Operational Logs"
|
echo "Can't retrieve Microsoft-Windows-PowerShell/Operational Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试压缩 "wineventlog" 目录为 logs.zip
|
|
||||||
try {
|
try
|
||||||
Compress-Archive -Path wineventlog -DestinationPath ./logs.zip
|
{
|
||||||
|
Compress-Archive -Path wineventlog -DestinationPath ./logs.zip
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果压缩失败，输出错误信息
|
{
|
||||||
echo "couldn't compress the log folder"
|
echo "couldn't compress the the log folder "
|
||||||
}
|
}
|
||||||
|
|||||||
@ -1,107 +1,101 @@
|
|||||||
# 尝试创建一个名为 "wineventlog" 的目录
|
try{
|
||||||
try {
|
New-Item -ItemType "directory" -Path "wineventlog"
|
||||||
New-Item -ItemType "directory" -Path "wineventlog"
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果创建目录失败，输出错误信息
|
{
|
||||||
echo "can't create a new directory"
|
echo "can't create a new directory"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试导出安全日志到指定的 EVTX 文件
|
try{
|
||||||
try {
|
wevtutil epl Security wineventlog/Security.evtx
|
||||||
wevtutil epl Security wineventlog/Security.evtx
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果导出安全日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Security Logs"
|
echo "Can't retrieve Security Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试导出系统日志到指定的 EVTX 文件
|
try
|
||||||
try {
|
{
|
||||||
wevtutil epl System wineventlog/System.evtx
|
wevtutil epl System wineventlog/System.evtx
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果导出系统日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve System Logs"
|
echo "Can't retrieve System Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试导出应用程序日志到指定的 EVTX 文件
|
try{
|
||||||
try {
|
wevtutil epl Application wineventlog/Application.evtx
|
||||||
wevtutil epl Application wineventlog/Application.evtx
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果导出应用程序日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Application Logs"
|
echo "Can't retrieve Application Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试导出 Windows PowerShell 日志到指定的 EVTX 文件
|
|
||||||
try {
|
try{
|
||||||
wevtutil epl "Windows PowerShell" wineventlog/Windows_PowerShell.evtx
|
wevtutil epl "Windows PowerShell" wineventlog/Windows_PowerShell.evtx
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果导出 Windows PowerShell 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Windows PowerShell Logs"
|
echo "Can't retrieve Windows PowerShell Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试导出 Microsoft-Windows-TerminalServices-LocalSessionManager/Operational 日志到指定的 EVTX 文件
|
try{
|
||||||
try {
|
wevtutil epl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" wineventlog/LocalSessionManager.evtx
|
||||||
wevtutil epl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" wineventlog/LocalSessionManager.evtx
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果导出 LocalSessionManager 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Microsoft-Windows-TerminalServices-LocalSessionManager/Operational Logs"
|
echo "Can't retrieve Microsoft-Windows-TerminalServices-LocalSessionManager/Operational Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试导出 Microsoft-Windows-Windows Defender/Operational 日志到指定的 EVTX 文件
|
try{
|
||||||
try {
|
wevtutil epl "Microsoft-Windows-Windows Defender/Operational" wineventlog/Windows_Defender.evtx
|
||||||
wevtutil epl "Microsoft-Windows-Windows Defender/Operational" wineventlog/Windows_Defender.evtx
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果导出 Windows Defender 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Microsoft-Windows-Windows Defender/Operational Logs"
|
echo "Can't retrieve Microsoft-Windows-Windows Defender/Operational Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试导出 Microsoft-Windows-TaskScheduler/Operational 日志到指定的 EVTX 文件
|
try{
|
||||||
try {
|
wevtutil epl Microsoft-Windows-TaskScheduler/Operational wineventlog/TaskScheduler.evtx
|
||||||
wevtutil epl Microsoft-Windows-TaskScheduler/Operational wineventlog/TaskScheduler.evtx
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果导出 TaskScheduler 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Microsoft-Windows-TaskScheduler/Operational Logs"
|
echo "Can't retrieve Microsoft-Windows-TaskScheduler/Operational Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试导出 Microsoft-Windows-WinRM/Operational 日志到指定的 EVTX 文件
|
try{
|
||||||
try {
|
wevtutil epl Microsoft-Windows-WinRM/Operational wineventlog/WinRM.evtx
|
||||||
wevtutil epl Microsoft-Windows-WinRM/Operational wineventlog/WinRM.evtx
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果导出 WinRM 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Microsoft-Windows-WinRM/Operational Logs"
|
echo "Can't retrieve Microsoft-Windows-WinRM/Operational Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试导出 Microsoft-Windows-Sysmon/Operational 日志到指定的 EVTX 文件
|
try{
|
||||||
try {
|
wevtutil epl Microsoft-Windows-Sysmon/Operational wineventlog/Sysmon.evtx
|
||||||
wevtutil epl Microsoft-Windows-Sysmon/Operational wineventlog/Sysmon.evtx
|
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果导出 Sysmon 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Microsoft-Windows-Sysmon/Operational Logs"
|
echo "Can't retrieve Microsoft-Windows-Sysmon/Operational Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试导出 Microsoft-Windows-PowerShell/Operational 日志到指定的 EVTX 文件
|
|
||||||
try {
|
try{
|
||||||
wevtutil epl Microsoft-Windows-PowerShell/Operational wineventlog/Powershell_Operational.evtx
|
wevtutil epl Microsoft-Windows-PowerShell/Operational wineventlog/Powershell_Operational.evtx
|
||||||
}
|
}
|
||||||
catch {
|
catch
|
||||||
# 如果导出 PowerShell Operational 日志失败，输出错误信息
|
{
|
||||||
echo "Can't retrieve Microsoft-Windows-PowerShell/Operational Logs"
|
echo "Can't retrieve Microsoft-Windows-PowerShell/Operational Logs"
|
||||||
}
|
}
|
||||||
|
|
||||||
# 尝试压缩 "wineventlog" 目录为 logs.zip
|
|
||||||
try {
|
try
|
||||||
Compress-Archive -Path wineventlog -DestinationPath ./logs.zip
|
{
|
||||||
}
|
Compress-Archive -Path wineventlog -DestinationPath ./logs.zip
|
||||||
catch {
|
}
|
||||||
# 如果压缩失败，输出错误信息
|
catch
|
||||||
echo "couldn't compress the log folder"
|
{
|
||||||
}
|
echo "couldn't compress the the log folder "
|
||||||
|
}
|
||||||
|
|||||||
Loading…
Reference in new issue