Windows日志分析
快捷进入
eventvwr
日志存放
C:\Windows\System32\winevt\Logs
重点日志文件
安全日志、系统日志、应用日志、远程连接日志文件。
Security.evtx 安全日志
System.evtx 系统日志
Application.evtx 应用日志
远程连接日志
Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx 被远程连接(主要)
Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx 被远程连接(辅助)
Log Parser日志分析工具
登录失败
LogParser.exe -i:EVT -o:DATAGRID "SELECT TimeGenerated as LoginTime,EXTRACT_TOKEN(Strings,5,'|') as username,EXTRACT_TOKEN(Strings, 10, '|') as LogonType,EXTRACT_TOKEN(Strings, 18, '|') AS ProcessName,EXTRACT_TOKEN(Strings, 19, '|') AS SourceIP FROM C:\Security.evtx where EventID=4625"
登录成功
LogParser.exe -i:EVT -o:DATAGRID "SELECT TimeGenerated as LoginTime,EXTRACT_TOKEN(Strings,5,'|') as username,EXTRACT_TOKEN(Strings, 8, '|') as LogonType,EXTRACT_TOKEN(Strings, 17, '|') AS ProcessName,EXTRACT_TOKEN(Strings, 18, '|') AS SourceIP FROM C:\Security.evtx where EventID=4624"
统计用户
需要统计用户admin登录信息,通过在搜索末尾增加“*and extract_token(strings,5,‘|’)=‘admin’*”进行提取关键数据统计,使用:
SELECT TimeGenerated as LoginTime,EXTRACT_TOKEN(Strings,5,'|') as username,EXTRACT_TOKEN(Strings, 8, '|') as LogonType,EXTRACT_TOKEN(Strings, 17,'|') AS ProcessName,EXTRACT_TOKEN(Strings, 18, '|') AS SourceIP FROM C:\Security.evtx where EventID=4624 and extract_token(strings,5,'|')='admin'
统计源IP
需要统计源IP“172.168.1.30”登录信息,通过在搜索末尾增加“*and extract_token(strings,**18**,‘|’)='**172.168.1.30**'*”进行提取关键数据统计,使用:
SELECT TimeGenerated as LoginTime,EXTRACT_TOKEN(Strings,5,'|') as username,EXTRACT_TOKEN(Strings, 8, '|') as LogonType,EXTRACT_TOKEN(Strings, 17,'|') AS ProcessName,EXTRACT_TOKEN(Strings, 18, '|') AS SourceIP FROM C:\Security.evtx where EventID=4624 and extract_token(strings,18,'|')='172.168.1.30'
格式转换
将日志文件输出到csv格式的文件中,方便进行数据筛选
logparser.exe "select * INTO SecurityExport.csv from 'C:\Security.evtx'" -i:EVT -headers:ON