乐趣区

用powershell获取sysmon日志

想用 powershell 获取 sysmon 日志还是比较麻烦,开始以为用 Get-EventLog 就行,结果试了半天报错:
PS D:\> Get-EventLog -LogName Microsoft-Windows-Sysmon/Operational -Newest 20
Get-EventLog : 计算机“.”上的事件日志“Microsoft-Windows-Sysmon/Operational”不存在。
所在位置 行:1 字符: 1
+ Get-EventLog -LogName Microsoft-Windows-Sysmon/Operational -Newest 20
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-EventLog], InvalidOperationException
+ FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.PowerShell.Commands.GetEventLogCommand
上网发现大家都是用的 Get-WinEvent,看了下帮助文档,这个 Cmdlet 可以获取所有本地和远程计算机的日志,使用 -ListLog * 可以获取当前主机的所有类型的日志
PS C:\> Get-WinEvent -ListLog *

LogMode MaximumSizeInBytes RecordCount LogName
——- —————— ———– ——-
Circular 20971520 24186 Application
Circular 20971520 0 HardwareEvents
Circular 1052672 0 Internet Explorer
Circular 20971520 0 Key Management Service
Circular 1052672 117 OAlerts
Circular 1052672 0 PreEmptive
Circular 20971520 25272 Security
Circular 20971520 13277 System
Circular 15728640 4381 Windows PowerShell
Circular 1052672 0 AMSI/Operational
Circular 20971520 ForwardedEvents
Circular 1052672 200 Lenovo-Power-BaseModule/Operational
Circular 10485760 0 Microsoft-AppV-Client/Admin
Circular 10485760 0 Microsoft-AppV-Client/Operational
Circular 10485760 0 Microsoft-AppV-Client/Virtual Applications
Circular 1052672 2103 Microsoft-Client-Licensing-Platform/Admin
Circular 1052672 Microsoft-Management-UI/Admin
Circular 1052672 0 Microsoft-Rdms-UI/Admin
Circular 1052672 0 Microsoft-Rdms-UI/Operational
Circular 1052672 0 Microsoft-User Experience Virtualization-Agent
……
根据网上的例子,使用哈希表同时指定日志类型和事件 ID,可以查询 sysmon 的某类 ID 的事件日志
PS C:\> Get-WinEvent -FilterHashtable @{logname=’Microsoft-Windows-Sysmon/Operational’;id=17} -MaxEvents 10

ProviderName:Microsoft-Windows-Sysmon

TimeCreated Id LevelDisplayName Message
———– — —————- ——-
2019/4/1 22:23:35 17 信息 Pipe Created:…
2019/4/1 22:23:35 17 信息 Pipe Created:…
2019/4/1 22:23:35 17 信息 Pipe Created:…
2019/4/1 22:23:34 17 信息 Pipe Created:…
2019/4/1 22:23:34 17 信息 Pipe Created:…
2019/4/1 22:23:34 17 信息 Pipe Created:…
2019/4/1 22:23:33 17 信息 Pipe Created:…
2019/4/1 22:23:33 17 信息 Pipe Created:…
2019/4/1 22:23:33 17 信息 Pipe Created:…
2019/4/1 22:23:33 17 信息 Pipe Created:…
接下来我希望获取日志中的其他消息,想到使用 Format-Table 指定属性的方法,首先我查询到 sysmon 的事件 ID 为 17 的日志中的属性有:RuleName,UtcTime,ProcessGuid,ProcessId,PipeName,Image,然后用指定属性输出:
PS C:\> Get-WinEvent -FilterHashtable @{logname=’Microsoft-Windows-Sysmon/Operational’;id=17} -MaxEvents 10 | Format-Tab
le -Property UtcTime,processguid, processid,pipename,image -AutoSize -Wrap

UtcTime processguid ProcessId pipename image
——- ———– ——— ——– —–
4140
4140
4140
4140
4140
4140
4140
4140
4140
4140
但是发现只有一个 ProcessId 有值,其他都为空!这就很奇怪。然后使用 Format-List * 获取一下日志的属性都有什么:
PS C:\> Get-WinEvent -FilterHashtable @{logname=’Microsoft-Windows-Sysmon/Operational’;id=17} -MaxEvents 10 | Format-List *

Message : Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.814
ProcessGuid: {791A80C2-1EE7-5CA2-0000-0010E60FF000}
ProcessId: 6724
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Id : 17
Version : 1
Qualifiers :
Level : 4
Task : 17
Opcode : 0
Keywords : -9223372036854775808
RecordId : 113253
ProviderName : Microsoft-Windows-Sysmon
ProviderId : 5770385f-c22a-43e0-bf4c-06f5698ffbd9
LogName : Microsoft-Windows-Sysmon/Operational
ProcessId : 4140
ThreadId : 6228
MachineName : DESKTOP-DKGHJUN
UserId : S-1-5-18
TimeCreated : 2019/4/1 22:23:35
ActivityId :
RelatedActivityId :
ContainerLog : Microsoft-Windows-Sysmon/Operational
MatchedQueryIds : {}
Bookmark : System.Diagnostics.Eventing.Reader.EventBookmark
LevelDisplayName : 信息
OpcodeDisplayName : 信息
TaskDisplayName : Pipe Created (rule: PipeEvent)
KeywordsDisplayNames : {}
Properties : {System.Diagnostics.Eventing.Reader.EventProperty,
System.Diagnostics.Eventing.Reader.EventProperty,
System.Diagnostics.Eventing.Reader.EventProperty,
System.Diagnostics.Eventing.Reader.EventProperty…}
……
结果发现日志的信息都在 Message 里面,连显示的进程 ID 都是错的。知道原因了,也就是说获取 sysmon 的日志信息的话只需要显示一条 Message 就够了。
PS C:\> Get-WinEvent -FilterHashtable @{logname=’Microsoft-Windows-Sysmon/Operational’;id=17} -MaxEvents 10 | Format-Table -Property message -Wrap

Message
——-
Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.814
ProcessGuid: {791A80C2-1EE7-5CA2-0000-0010E60FF000}
ProcessId: 6724
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.751
ProcessGuid: {791A80C2-1EE7-5CA2-0000-00108D0AF000}
ProcessId: 856
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Pipe Created:
但是这种结果并不利于查看,需要在前面添加几列信息,让每一条结果能显示的更易于区分。通过 Format-List * 查看有哪些属性是比较有用的,这次选择 ID,TaskDisplayName 这两项:
PS C:\> Get-WinEvent -FilterHashtable @{logname=’Microsoft-Windows-Sysmon/Operational’;id=17} -MaxEvents 5 | Format-Table -Property ID,TaskDisplayName,message -Wrap

Id TaskDisplayName Message
— ————— ——-
17 Pipe Created (rule: PipeEvent) Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.814
ProcessGuid: {791A80C2-1EE7-5CA2-0000-0010E60FF000}
ProcessId: 6724
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
17 Pipe Created (rule: PipeEvent) Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.751
ProcessGuid: {791A80C2-1EE7-5CA2-0000-00108D0AF000}
ProcessId: 856
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
17 Pipe Created (rule: PipeEvent) Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.353
ProcessGuid: {791A80C2-1EE7-5CA2-0000-00103F04F000}
ProcessId: 10636
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
……
但是这个结果也不好,因为获取到某个 ID 的日志后不能继续搜索了。
遗留了两个问题:

Get-EventLog 和 Get-WinEvent 两个 cmdlet 的差异在哪里?
如何进一步筛选 sysmon 日志?

退出移动版