Kategoria: Bez kategorii

TL;DR socjotechnika

Przykra wiadomość

Niestety dostałem po fakcie wiadomość że starsza osoba z mojej rodziny dokonała dobrowolnie przelewu znacznej sumy oszczędności na konto podobno Brokera oferującego spory zysk poprzez zainwestowanie ich na giełdzie w dobre “wschodzące” spółki.

Czytaj dalej Jak odzyskałem 20000zł wpłacone przez członka rodziny na konto oszusta?

This is part 2 of our mini-series covering PowerShell script block logging. Today, we’ll again read the script block logging log, but this time we’ll try and get back the log data in a more useful object-oriented way:

function Get-LoggedCode
{
    # read all raw events
    $logInfo = @{ ProviderName="Microsoft-Windows-PowerShell"; Id = 4104 }
    Get-WinEvent -FilterHashtable $logInfo | 
        # take each raw set of data...
        ForEach-Object {
            # create a new object and extract the interesting
            # parts from the raw data to compose a "cooked"
            # object with useful data
            [PSCustomObject]@{
                # when this was logged
                Time = $_.TimeCreated
                # script code that was logged
                Code = $_.Properties[2].Value
                # if code was split into multiple log entries,
                # determine current and total part
                PartCurrent = $_.Properties[0].Value
                PartTotal = $_.Properties[1].Value
                
                # if total part is 1, code is not fragmented
                IsMultiPart = $_.Properties[1].Value -ne 1
                # path of script file (this is empty for interactive
                # commands)
                Path = $_.Properties[4].Value
                # log level
                # by default, only level "Warning" will be logged
                Level = $_.LevelDisplayName
                # user who executed the code (SID)
                User = $_.UserId
            }
        } 
}

When you run this code, you now have a new command named Get-LoggedCode. When you execute it, it returns objects like this:

 
Time        : 25.05.2018 10:57:36
Code        : function Get-LoggedCode
              {
                  # read all raw events
                  $logInfo = @{ ProviderName="Microsoft-Windows-PowerShell"; Id = 4104 }
                  Get-WinEvent -FilterHashtable $logInfo | 
                      # take each raw set of data...
                      ForEach-Object {
                          # create a new object and extract the interesting
                          # parts from the raw data to compose a "cooked"
                          # object with useful data:
                          [PSCustomObject]@{
                              # when this was logged:
                              Time = $_.TimeCreated
                              # script code that was logged:
                              Code = $_.Properties[2].Value
                              # if code was split into multiple log entries,
                              # determine current and total part:
                              PartCurrent = $_.Properties[0].Value
                              PartTotal = $_.Properties[1].Value
                              
                              # if total part is 1, code is not fragmented:
                              IsMultiPart = $_.Properties[1].Value -ne 1
                              # path of script file (this is empty for interactive
                              # commands)
                              Path = $_.Properties[4].Value
                              # log level
                              # by default, only level "Warning" will be logged:
                              Level = $_.LevelDisplayName
                              # user who executed the code (SID)
                              User = $_.UserId
                          }
                      } 
              }
              
              
              
PartCurrent : 1
PartTotal   : 1
IsMultiPart : False
Path        : D:sample.ps1
Level       : Warning
User        : S-1-5-21-2012478179-265285931-690539891-1001 
 

In our example, we added “Select-Object” to not read the entire log but just the last entry. Here, we got back the code that we just executed. This may be different for you, and here is why:

By default, script block logging only logs code considered “security relevant” (in the returned data, Level is “Warning”). PowerShell determines internally which code is considered security relevant. In tomorrow’s tip, we will explain how you enable the “Verbose” mode. When this mode is turned on, any code is logged, so your log file grows in size considerably. Here is how you can check the ratio of default (“Warning”) logs versus verbose logs (taken from our test machine):

 
PS> Get-LoggedCode | Group-Object Level

Count Name                      Group                                                             
----- ----                      -----                                                             
  549 Verbose                   {@{Time=25.05.2018 10:57:52; Code=prompt;..
   36 Warning                   {@{Time=25.05.2018 10:57:52; Code={...   
 

Please note: Since log entries have a maximum size, long code is split up in chunks. The “IsMultiPart”, “PartCurrent”, and “PartTotal” properties provide information about this.

ReTweet this Tip!