Module for
Process local Windows security event log (PowerShell must be run as Administrator):
Process local Windows system event log:
Process evtx file:
Windows Event Logs processed
Command Line Logs processed
Security event 4625 (Failed logons):
PowerShell auditing (PowerShell 5.0):
Sysmon
if you receive a 'running scripts is disabled on this system' error.
Process local Windows security event log (PowerShell must be run as Administrator):
.\DeepBlue.ps1
or:
.\DeepBlue.ps1 -log security
Process local Windows system event log:
.\DeepBlue.ps1 -log system
Process evtx file:
.\DeepBlue.ps1 .\evtx\new-user-security.evtx
Windows Event Logs processed
- Windows Security
- Windows System
- Windows Application
- Windows PowerShell
- Sysmon
Command Line Logs processed
See
Security event 4625 (Failed logons):
Requires
PowerShell auditing (PowerShell 5.0):
DeepBlueCLI uses module logging (PowerShell event 4103) and script block logging (4104). It does not use transcription.
See: (and not just script block) on Windows 7 through Windows 8.1, add the following to \Windows\System32\WindowsPowerShell\v1.0\profile.ps1
CODE
$LogCommandHealthEvent = $true
$LogCommandLifecycleEvent = $true
See the following for more information:
Thank you:
Sysmon
Install Sysmon from Sysinternals:
Vollständiger Original-Bericht
Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf feedproxy.google.com.
SOCIAL SHARE CARD GENERATOR