Cyberdefense/DeepBlueCLI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #22 from zmbf0r3ns1cs/master

Browse Source 
Update System EID 104 parsing output to correctly reflect the cleared log name
This commit is contained in:
Joshua Wright
2021-05-06 19:11:11 +00:00
committed by GitHub
parent c2a3840bae 122d078efe
commit 396bbc4e28
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
DeepBlue.ps1
View File

@ -1,4 +1,4 @@
<# <#
.SYNOPSIS .SYNOPSIS
A PowerShell module for hunt teaming via Windows event logs A PowerShell module for hunt teaming via Windows event logs
@ -87,7 +87,7 @@ function Main {
Date = $event.TimeCreated Date = $event.TimeCreated
Log = $logname Log = $logname
EventID = $event.id EventID = $event.id
Message = "" Message = $event.message
Results = "" Results = ""
Command = "" Command = ""
Decoded = "" Decoded = ""
@ -405,7 +405,7 @@ function Main {
ElseIf ($event.id -eq 104){ ElseIf ($event.id -eq 104){
# The System log file was cleared. # The System log file was cleared.
$obj.Message = "System Log Clear" $obj.Message = "System Log Clear"
$obj.Results = "The System log was cleared." $obj.Results = $event.message
Write-Output $obj Write-Output $obj
} }
} }