用powershell获取sysmon日志

想用powershell获取sysmon日志还是比较麻烦,开始以为用Get-EventLog就行,结果试了半天报错:

PS D:\> Get-EventLog -LogName Microsoft-Windows-Sysmon/Operational -Newest 20
Get-EventLog : 计算机“.”上的事件日志“Microsoft-Windows-Sysmon/Operational”不存在。
所在位置 行:1 字符: 1
+ Get-EventLog -LogName Microsoft-Windows-Sysmon/Operational -Newest 20
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-EventLog], InvalidOperationException
    + FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.PowerShell.Commands.GetEventLogCommand

上网发现大家都是用的 Get-WinEvent,看了下帮助文档,这个Cmdlet可以获取所有本地和远程计算机的日志,使用-ListLog *可以获取当前主机的所有类型的日志

PS C:\> Get-WinEvent -ListLog *

LogMode   MaximumSizeInBytes RecordCount LogName
-------   ------------------ ----------- -------
Circular            20971520       24186 Application
Circular            20971520           0 HardwareEvents
Circular             1052672           0 Internet Explorer
Circular            20971520           0 Key Management Service
Circular             1052672         117 OAlerts
Circular             1052672           0 PreEmptive
Circular            20971520       25272 Security
Circular            20971520       13277 System
Circular            15728640        4381 Windows PowerShell
Circular             1052672           0 AMSI/Operational
Circular            20971520             ForwardedEvents
Circular             1052672         200 Lenovo-Power-BaseModule/Operational
Circular            10485760           0 Microsoft-AppV-Client/Admin
Circular            10485760           0 Microsoft-AppV-Client/Operational
Circular            10485760           0 Microsoft-AppV-Client/Virtual Applications
Circular             1052672        2103 Microsoft-Client-Licensing-Platform/Admin
Circular             1052672             Microsoft-Management-UI/Admin
Circular             1052672           0 Microsoft-Rdms-UI/Admin
Circular             1052672           0 Microsoft-Rdms-UI/Operational
Circular             1052672           0 Microsoft-User Experience Virtualization-Agent 
......

根据网上的例子,使用哈希表同时指定日志类型和事件ID,可以查询sysmon的某类ID的事件日志

PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 10


   ProviderName:Microsoft-Windows-Sysmon

TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
2019/4/1 22:23:35               17 信息             Pipe Created:...
2019/4/1 22:23:35               17 信息             Pipe Created:...
2019/4/1 22:23:35               17 信息             Pipe Created:...
2019/4/1 22:23:34               17 信息             Pipe Created:...
2019/4/1 22:23:34               17 信息             Pipe Created:...
2019/4/1 22:23:34               17 信息             Pipe Created:...
2019/4/1 22:23:33               17 信息             Pipe Created:...
2019/4/1 22:23:33               17 信息             Pipe Created:...
2019/4/1 22:23:33               17 信息             Pipe Created:...
2019/4/1 22:23:33               17 信息             Pipe Created:...

接下来我希望获取日志中的其他消息,想到使用 Format-Table指定属性的方法,首先我查询到sysmon的事件ID为17的日志中的属性有:RuleName,UtcTime,ProcessGuid,ProcessId,PipeName,Image,然后用指定属性输出:

PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 10 | Format-Tab
le -Property UtcTime,processguid, processid,pipename,image -AutoSize -Wrap

UtcTime processguid ProcessId pipename image
------- ----------- --------- -------- -----
                         4140
                         4140
                         4140
                         4140
                         4140
                         4140
                         4140
                         4140
                         4140
                         4140

但是发现只有一个ProcessId有值,其他都为空!这就很奇怪。然后使用Format-List *获取一下日志的属性都有什么:

PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 10 | Format-List *


Message              : Pipe Created:
                       RuleName:
                       UtcTime: 2019-04-01 14:23:35.814
                       ProcessGuid: {791A80C2-1EE7-5CA2-0000-0010E60FF000}
                       ProcessId: 6724
                       PipeName: <Anonymous Pipe>
                       Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Id                   : 17
Version              : 1
Qualifiers           :
Level                : 4
Task                 : 17
Opcode               : 0
Keywords             : -9223372036854775808
RecordId             : 113253
ProviderName         : Microsoft-Windows-Sysmon
ProviderId           : 5770385f-c22a-43e0-bf4c-06f5698ffbd9
LogName              : Microsoft-Windows-Sysmon/Operational
ProcessId            : 4140
ThreadId             : 6228
MachineName          : DESKTOP-DKGHJUN
UserId               : S-1-5-18
TimeCreated          : 2019/4/1 22:23:35
ActivityId           :
RelatedActivityId    :
ContainerLog         : Microsoft-Windows-Sysmon/Operational
MatchedQueryIds      : {}
Bookmark             : System.Diagnostics.Eventing.Reader.EventBookmark
LevelDisplayName     : 信息
OpcodeDisplayName    : 信息
TaskDisplayName      : Pipe Created (rule: PipeEvent)
KeywordsDisplayNames : {}
Properties           : {System.Diagnostics.Eventing.Reader.EventProperty,
                      System.Diagnostics.Eventing.Reader.EventProperty,
                        System.Diagnostics.Eventing.Reader.EventProperty, 
                        System.Diagnostics.Eventing.Reader.EventProperty...}
......

结果发现日志的信息都在Message里面,连显示的进程ID都是错的。知道原因了,也就是说获取sysmon的日志信息的话只需要显示一条Message就够了。

PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 10 | Format-Table -Property message -Wrap

Message
-------
Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.814
ProcessGuid: {791A80C2-1EE7-5CA2-0000-0010E60FF000}
ProcessId: 6724
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.751
ProcessGuid: {791A80C2-1EE7-5CA2-0000-00108D0AF000}
ProcessId: 856
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Pipe Created:

但是这种结果并不利于查看,需要在前面添加几列信息,让每一条结果能显示的更易于区分。通过Format-List *查看有哪些属性是比较有用的,这次选择ID,TaskDisplayName这两项:

PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 5 | Format-Table -Property ID,TaskDisplayName,message -Wrap

Id TaskDisplayName                Message
-- ---------------                -------
17 Pipe Created (rule: PipeEvent) Pipe Created:
                                  RuleName:
                                  UtcTime: 2019-04-01 14:23:35.814
                                  ProcessGuid: {791A80C2-1EE7-5CA2-0000-0010E60FF000}
                                  ProcessId: 6724
                                  PipeName: <Anonymous Pipe>
                                  Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
17 Pipe Created (rule: PipeEvent) Pipe Created:
                                  RuleName:
                                  UtcTime: 2019-04-01 14:23:35.751
                                  ProcessGuid: {791A80C2-1EE7-5CA2-0000-00108D0AF000}
                                  ProcessId: 856
                                  PipeName: <Anonymous Pipe>
                                  Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
17 Pipe Created (rule: PipeEvent) Pipe Created:
                                  RuleName:
                                  UtcTime: 2019-04-01 14:23:35.353
                                  ProcessGuid: {791A80C2-1EE7-5CA2-0000-00103F04F000}
                                  ProcessId: 10636
                                  PipeName: <Anonymous Pipe>
                                  Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
......

但是这个结果也不好,因为获取到某个ID的日志后不能继续搜索了。

遗留了两个问题:

  1. Get-EventLog和Get-WinEvent两个cmdlet的差异在哪里?
  2. 如何进一步筛选sysmon日志?

相关推荐