Added event 29, updated for new Sysmon schema
This commit is contained in:
@ -1,16 +1,23 @@
|
|||||||
$hashdirectory=".\hashes\"
|
$hashdirectory=".\hashes\"
|
||||||
$events = get-winevent @{logname="Microsoft-Windows-Sysmon/Operational";id=1,6,7}
|
$events = get-winevent @{logname="Microsoft-Windows-Sysmon/Operational";id=1,6,7,29}
|
||||||
ForEach ($event in $events) {
|
ForEach ($event in $events) {
|
||||||
if ($event.id -eq 1){ # Process creation
|
if ($event.id -eq 1){ # Process creation
|
||||||
|
|
||||||
if ($event.Properties.Count -le 16){
|
if ($event.Properties.Count -le 16){
|
||||||
$path=$event.Properties[3].Value # Full path of the file
|
$path=$event.Properties[3].Value # Full path of the file
|
||||||
$hash=$event.Properties[11].Value # Hashes
|
$hash=$event.Properties[11].Value # Hashes
|
||||||
}
|
}
|
||||||
Else {
|
ElseIf ($event.Properties.Count -le 17){
|
||||||
$path=$event.Properties[4].Value # Full path of the file
|
$path=$event.Properties[4].Value # Full path of the file
|
||||||
$hash=$event.Properties[16].Value # Hashes
|
$hash=$event.Properties[16].Value # Hashes
|
||||||
}
|
}
|
||||||
|
Else {
|
||||||
|
$path=$event.Properties[4].Value # Full path of the file
|
||||||
|
$hash=$event.Properties[17].Value # Hashes
|
||||||
|
}
|
||||||
|
}
|
||||||
|
ElseIf ($event.id -eq 29){ # FileExecutableDetected
|
||||||
|
$path=$event.Properties[6].Value # Full path of the file
|
||||||
|
$hash=$event.Properties[7].Value # Hashes
|
||||||
}
|
}
|
||||||
Else{
|
Else{
|
||||||
# Hash and path are part of the message field in Sysmon events 6 and 7. Need to parse the XML
|
# Hash and path are part of the message field in Sysmon events 6 and 7. Need to parse the XML
|
||||||
@ -19,6 +26,7 @@ ForEach ($event in $events) {
|
|||||||
if ($event.Properties.Count -le 6){
|
if ($event.Properties.Count -le 6){
|
||||||
$path=$eventXML.Event.EventData.Data[1]."#text" # Full path of the file
|
$path=$eventXML.Event.EventData.Data[1]."#text" # Full path of the file
|
||||||
$hash=$eventXML.Event.EventData.Data[2]."#text" # Hashes
|
$hash=$eventXML.Event.EventData.Data[2]."#text" # Hashes
|
||||||
|
$hash
|
||||||
}
|
}
|
||||||
Else{
|
Else{
|
||||||
$path=$eventXML.Event.EventData.Data[2]."#text" # Full path of the file
|
$path=$eventXML.Event.EventData.Data[2]."#text" # Full path of the file
|
||||||
@ -30,10 +38,14 @@ ForEach ($event in $events) {
|
|||||||
$path=$eventXML.Event.EventData.Data[4]."#text" # Full path of the file
|
$path=$eventXML.Event.EventData.Data[4]."#text" # Full path of the file
|
||||||
$hash=$eventXML.Event.EventData.Data[5]."#text" # Hashes
|
$hash=$eventXML.Event.EventData.Data[5]."#text" # Hashes
|
||||||
}
|
}
|
||||||
Else{
|
Elseif ($event.Properties.Count -lt 15){
|
||||||
$path=$eventXML.Event.EventData.Data[5]."#text" # Full path of the file
|
$path=$eventXML.Event.EventData.Data[5]."#text" # Full path of the file
|
||||||
$hash=$eventXML.Event.EventData.Data[10]."#text" # Hashes
|
$hash=$eventXML.Event.EventData.Data[10]."#text" # Hashes
|
||||||
}
|
}
|
||||||
|
Else{
|
||||||
|
$path=$eventXML.Event.EventData.Data[5]."#text" # Full path of the file
|
||||||
|
$hash=$eventXML.Event.EventData.Data[11]."#text" # Hashes
|
||||||
|
}
|
||||||
}
|
}
|
||||||
Else{
|
Else{
|
||||||
Out-Host "Logic error 1, should not reach here..."
|
Out-Host "Logic error 1, should not reach here..."
|
||||||
|
Reference in New Issue
Block a user