Cyberdefense/DeepBlueCLI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed windows event log check.

Browse Source 
The output of the start/stop windows event log service was not correct. 
After checking the script on the sample file: disablestop-eventlog.evtx I have noticed that the output was not correct and found out it is actually the third parameter that should be checked instead of the second.
This commit is contained in:
TheNiv
2021-11-06 10:11:03 +02:00
committed by GitHub
parent cf9411f721
commit ea97820b79
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
DeepBlue.ps1
View File

@ -391,7 +391,7 @@ function Main {
ElseIf ($event.id -eq 7040){ ElseIf ($event.id -eq 7040){
# The start type of the Windows Event Log service was changed from auto start to disabled. # The start type of the Windows Event Log service was changed from auto start to disabled.
$servicename=$eventXML.Event.EventData.Data[0]."#text" $servicename=$eventXML.Event.EventData.Data[0]."#text"
$action = $eventXML.Event.EventData.Data[1]."#text" $action = $eventXML.Event.EventData.Data[2]."#text"
if ($servicename -ccontains "Windows Event Log") { if ($servicename -ccontains "Windows Event Log") {
$obj.Results = "Service name: $servicename`n" $obj.Results = "Service name: $servicename`n"
$obj.Results += $text $obj.Results += $text