Advance log analysis

Eventlog Analysis using Windows tool - Powershell

Windows Powershell is a cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration framework. Powershell runs on Windows, Linux, and MacOS.

Powershell makes the lives of administrators easier in managing their endpoints and servers. Why Powershell? Powershell is built on the .NET Common Language Runtime (CLR) which it makes possible for us to work on any technology we work with.

From an incident response perspective, it is necessary for the responder to have the ability and skill to triage to patient zero by using no additional tools and using built-in in Windows like Powershell that has the ability to query and parse event logs, which can be of great use for the responder. 

Get-WinEvent Timeline

Eventlog Analysis using Windows tool - Powershell

Windows Powershell is a cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration framework. Powershell runs on Windows, Linux, and MacOS.

Powershell makes the lives of administrators easier in managing their endpoints and servers. Why Powershell? Powershell is built on the .NET Common Language Runtime (CLR) which it makes possible for us to work on any technology we work with.

From an incident response perspective, it is necessary for the responder to have the ability and skill to triage to patient zero by using no additional tools and using built-in in Windows like Powershell that has the ability to query and parse event logs, which can be of great use for the responder. 

Bread crumbs during an incident needs to be followed in a time specific manner, responders cannot risk the time they will consume wondering inside thousands of event logs where time to resolve the incident is critical. To aid this is to sort logs based on the time they were created.

To put this to use, we can run the following syntax: Get-EventLog -Logname <log_name> | Sort-Object TimeCreated

 

We can also sort time based on the hours, minutes or even seconds. We will use [starttime] and [endtime] in this case.

To put this to use, we can run the following syntax:

Get-WinEvent -FilterHashTable @{Logname='<log_name>’;starttime=[datetime]”<time>”;endtime=[datetime]”<endtime>”}

In this case, we will try to sort time ranging from 5:06:33 PM to 5:09:01 PM 

 

Get-WinEvent Hunt

Eventlog Analysis using Windows tool - Powershell

Windows Powershell is a cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration framework. Powershell runs on Windows, Linux, and MacOS.

Powershell makes the lives of administrators easier in managing their endpoints and servers. Why Powershell? Powershell is built on the .NET Common Language Runtime (CLR) which it makes possible for us to work on any technology we work with.

From an incident response perspective, it is necessary for the responder to have the ability and skill to triage to patient zero by using no additional tools and using built-in in Windows like Powershell that has the ability to query and parse event logs, which can be of great use for the responder. 

During an investigation, we may be asked to look for a specific event log, particularly one related to Account Logon/Logoff, Process Creation, or Powershell Creation; these logs are typically bread crumbs of an incident, and responders must be able to parse and follow these crumbs.

To put this to use, we can run the following syntax: 

Get-WinEvent -FilterHashTable @{Logname=”; Id=<event_log> } 

We can then pipe this syntax to –Format-List for viewing and display all the information.

 

Get-EventLog Hunt

Eventlog Analysis using Windows tool - Powershell

Windows Powershell is a cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration framework. Powershell runs on Windows, Linux, and MacOS.

Powershell makes the lives of administrators easier in managing their endpoints and servers. Why Powershell? Powershell is built on the .NET Common Language Runtime (CLR) which it makes possible for us to work on any technology we work with.

From an incident response perspective, it is necessary for the responder to have the ability and skill to triage to patient zero by using no additional tools and using built-in in Windows like Powershell that has the ability to query and parse event logs, which can be of great use for the responder. 

During an investigation, we may be asked to look for a specific event log, particularly one related to Account Logon/Logoff, Process Creation, or Powershell Creation; these logs are typically bread crumbs of an incident, and responders must be able to parse and follow these crumbs.

To put this to use, we can run the following syntax: Get-EventLog -Logname <log_name> | where{$_.EventId -eq 4624}

In this case, we will hunt for event log 4624 Account Logon and we will use the -Newest parameter to parse the newest event log 4624.

 

Out-GridView answers the question “How can we read these logs?”

To put this to work, pipe the syntax to Out-GridView to display a GUI representation of the log.

 

Baseline

Eventlog Analysis using Windows tool - Powershell

Windows Powershell is a cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration framework. Powershell runs on Windows, Linux, and MacOS.

Powershell makes the lives of administrators easier in managing their endpoints and servers. Why Powershell? Powershell is built on the .NET Common Language Runtime (CLR) which it makes possible for us to work on any technology we work with.

From an incident response perspective, it is necessary for the responder to have the ability and skill to triage to patient zero by using no additional tools and using built-in in Windows like Powershell that has the ability to query and parse event logs, which can be of great use for the responder. 

Why Baseline? It is like answering the question, “How can I detect abnormal behavior when I don’t know what is normal?” Baseline is one of the best ways to know what is normal and abnormal inside the organization, especially on endpoints and critical systems. It is having a clear understanding of what normal looks like. Getting a baseline from time to time gives the organization the ability to detect abnormal behavior through different baseline comparisons gathered on different timelines.

How do we baseline events on your endpoint? We can run a powershell script to identify all the event logs from the desired endpoint.

There are two methods:

1. Save the .evtx file to your hard drive and run a powershell script to parse all the event logs.

2. Without exporting the .evtx file, parse directly to an event log.

To use both methods, you can run the following syntax:

(1) Get-WinEvent -FilterHashTable @{Logname='<event_log>’ | Group-Object id -NoElement | Sort-Object count

(2) Get-WinEvent -Path <path_to_.evtx> | Group-Object id -NoElement | Sort-Object count 

Running both script gives us the same result.