Question

我尝试在安全事件后以管理员身份查看Enterprise机器上的最后5个登录事件。我进行了初步调查，并试图找到一种方法来快速吐出潜在的“嫌疑犯”清单。

我已经能够生成列出日志文件的输出，但是使用帐户名称（通常会看到 \ Domain \ username ），我只能得到输出“ SYSTEM”或类似名称。

如果我最近已远程进入计算机，它将拉出我的 \ Domain \ Username 并显示它没有问题。

理想情况下，我想制作一个脚本，从网络上的计算机中提取登录事件，并提供最近登录者和登录时间的列表。

这是我到目前为止所拥有的：

@@

Answer 1

我也一直对此不满意，因此决定使用Get-WinEvent cmdlet，因为不幸的是，使用Get-EventLog所需的信息都在.Message项中，并且那是一个本地化的字符串。

我的方法与Lee_Daily的答案有些不同，因为我是从底层XML获取信息的，如下所示：

#logon types: https://docs.microsoft.com/en-us/windows/desktop/api/ntsecapi/ne-ntsecapi-_security_logon_type#constants
$logonTypes = 'System','Undefined','Interactive','Network','Batch','Service','Proxy','Unlock',
              'NetworkCleartext','NewCredentials','RemoteInteractive','CachedInteractive',
              'CachedRemoteInteractive','CachedUnlock'

$dataItems = @{
    SubjectUserSid            = 0                                                                                                                                                  
    SubjectUserName           = 1                                                                                                                                                  
    SubjectDomainName         = 2                                                                                                                                                  
    SubjectLogonId            = 3                                                                                                                                                  
    TargetUserSid             = 4                                                                                                                                                  
    TargetUserName            = 5                                                                                                                                                  
    TargetDomainName          = 6                                                                                                                                                  
    TargetLogonId             = 7                                                                                                                                                  
    LogonType                 = 8                                                                                                                                                  
    LogonProcessName          = 9                                                                                                                                                  
    AuthenticationPackageName = 10                                                                                                                                                 
    WorkstationName           = 11                                                                                                                                                 
    LogonGuid                 = 12                                                                                                                                                 
    TransmittedServices       = 13                                                                                                                                                 
    LmPackageName             = 14                                                                                                                                                 
    KeyLength                 = 15                                                                                                                                                 
    ProcessId                 = 16                                                                                                                                                 
    ProcessName               = 17                                                                                                                                                 
    IpAddress                 = 18                                                                                                                                                 
    IpPort                    = 19 
}

$result = Get-WinEvent -FilterHashtable @{LogName="Security";Id=4624} -MaxEvents 100 | ForEach-Object {
    # convert the event to XML and grab the Event node
    $eventXml = ([xml]$_.ToXml()).Event

    # get the 'TargetDomainName' value and check it does not start with 'NT AUTHORITY'
    $domain = $eventXml.EventData.Data[$dataItems['TargetDomainName']].'#text'
    if ($domain -ne 'NT AUTHORITY' ) {
        [PSCustomObject]@{
            Domain    = $domain
            UserName  = $eventXml.EventData.Data[$dataItems['TargetUserName']].'#text'
            UserSID   = $eventXml.EventData.Data[$dataItems['TargetUserSid']].'#text'
            LogonType = $logonTypes[[int]$eventXml.EventData.Data[$dataItems['LogonType']].'#text'] 
            Date      = [DateTime]$eventXml.System.TimeCreated.SystemTime
            Computer  = $eventXml.System.Computer
        }
    }
}

$result | Sort-Object Date -Descending | Group-Object -Property UserName  | ForEach-Object {
    if ($_.Count -gt 1) { $_.Group[0] } else { $_.Group } 
} | Format-Table -AutoSize

在我的机器上，输出看起来像

Domain   UserName    UserSID                                      LogonType   Date               Computer
------   --------    -------                                      ---------   ----               --------
MyDomain MyUserName  S-1-5-21-487608883-1237982911-748711624-1000 Interactive 27-1-2019 20:36:45 MyComputer
MyDomain SomeoneElse S-1-5-21-487608883-1237982911-748765431-1013 Interactive 27-1-2019 18:36:45 MyComputer

Answer 2

这使用速度更快的Get-WinEvent cmdlet和-FilterHashtable参数来加快执行速度并添加更多选择器。您可能要删除一些过滤器-这是相当早以前为另一个项目编写的。 [咧嘴]

#requires -RunAsAdministrator

# there REALLY otta be a way to get this list programmatically
$LogonTypeTable = [ordered]@{
    '0' = 'System'
    '2' = 'Interactive'
    '3' = 'Network'
    '4' = 'Batch'
    '5' = 'Service'
    '6' = 'Proxy'
    '7' = 'Unlock'
    '8' = 'NetworkCleartext'
    '9' = 'NewCredentials'
    '10' = 'RemoteInteractive'
    '11' = 'CachedInteractive'
    '12' = 'CachedRemoteInteractive'
    '13' = 'CachedUnlock'
    }
$EventLevelTable = [ordered]@{
    LogAlways = 0
    Critical = 1
    Error = 2
    Warning = 3
    Informational = 4
    Verbose = 5
    }


$WantedLogonTypes = @(2, 3, 10, 11)
$AgeInDays = 15
$StartDate = (Get-Date).AddDays(-$AgeInDays)

$ComputerName = $env:COMPUTERNAME
$GWE_FilterHashTable = @{
    Logname = 'Security'
    ID = 4624
    StartTime = $StartDate
    #Level  = 2
    }
$GWE_Params = @{
    FilterHashtable = $GWE_FilterHashTable
    ComputerName = $ComputerName
    MaxEvents = 100
    }
$RawLogonEventList = Get-WinEvent @GWE_Params

$LogonEventList = foreach ($RLEL_Item in $RawLogonEventList)
    {
    $LogonTypeID = $RLEL_Item.Properties[8].Value
    if ($LogonTypeID -in $WantedLogonTypes)
        {
        [PSCustomObject]@{
            LogName = $RLEL_Item.LogName
            TimeCreated = $RLEL_Item.TimeCreated
            UserName = $RLEL_Item.Properties[5].Value
            LogonTypeID = $LogonTypeID
            LogonTypeName = $LogonTypeTable[$LogonTypeID.ToString()]
            }
        }
    }

$NewestLogonPerUser = $LogonEventList |
    Sort-Object -Property UserName |
    Group-Object -Property UserName |
    ForEach-Object {
        if ($_.Count -gt 1)
            {
            $_.Group[0]
            }
            else
            {
            $_.Group
            }
        }

$NewestLogonPerUser

我系统上的当前输出...

LogName       : Security
TimeCreated   : 2019-01-24 1:50:44 PM
UserName      : ANONYMOUS LOGON
LogonTypeID   : 3
LogonTypeName : Network

LogName       : Security
TimeCreated   : 2019-01-24 1:50:50 PM
UserName      : [MyUserName]
LogonTypeID   : 2
LogonTypeName : Interactive

远程PowerShell，查找最近5个用户登录名

2 个答案: