윈도우 이벤트 로그 분석-파워쉘(PowerShell)

check-windows-event-log.zip

0.00MB

Get-WinEvent

이벤트 목록 확인 

PS C:\Temp> Get-WinEvent -ListLog *

이벤트 건수 확인
PS C:\Temp> (get-winevent -FilterHashtable @{logname="security";id=4624;starttime=(get-date).adddays(-10);endtime=(get-date).adddays(-5)}).count
835

특정 기간 조회
PS C:\Temp> get-winevent -FilterHashtable @{logname="security";id=4624;starttime=(get-date).adddays(-10);endtime=(get-date).adddays(-5)}

   ProviderName: Microsoft-Windows-Security-Auditing
TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
2019-07-08 오후 6:01:22       4624 정보             계정이 성공적으로 로그온되었습니다....
2019-07-08 오후 6:01:20       4624 정보             계정이 성공적으로 로그온되었습니다....
2019-07-08 오후 6:01:18       4624 정보             계정이 성공적으로 로그온되었습니다....
......

 

최근 이벤트 조회
PS C:\Temp> Get-WinEvent -FilterHashtable @{logname='Security'} -MaxEvents 50

 

조회 결과 csv 저장 [1]
PS C:\Temp> get-winevent -FilterHashtable @{logname="security";id=4624;starttime=(get-date).adddays(-10);endtime=(get-date).adddays(-5)} | format-list -property id, timecreate, message | export-csv f:\temp\eve-login.csv

특정 이벤트ID 조회 [2]

PS C:\Temp> get-winevent security | where {$_.id -eq 4624} | where {$_.timecreated -ge (get-date).adddays(-10)} |  where {$_.timecreated -le (get-date).adddays(-5)}
2019-07-13 오후 6:12:55       4624 정보             계정이 성공적으로 로그온되었습니다....
2019-07-13 오후 6:12:55       4624 정보             계정이 성공적으로 로그온되었습니다....
2019-07-13 오후 6:12:55       4624 정보             계정이 성공적으로 로그온되었습니다....
......

<참고>

[1]과 [2]를 비교해보면 FilterHashtable이 훨씬 빠르다

레퍼런스 : https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7

Get-EventLog
Get-EventLog에서는 FilterHashtable 지원이 안된다. 그리고 Get-WinEvent와 항목의 컬럼명이 서로 다르다. 예를 들어 Get-WinEvent의 이벤트 Id는 ID명으로 표시되지만 Get-EventLog에서는 InstancedID로 표시된다.

 

이벤트 목록 확인 

PS C:\Temp> Get-EventLog  -List

 

최근 이벤트 조회

PS F:\script\powershell> get-eventlog -LogName Security -Newest 5                                                       
   Index Time          EntryType   Source                 InstanceID Message
   ----- ----          ---------   ------                 ---------- -------
   31284 3 03 11:52    SuccessA... Microsoft-Windows...         4672 특수 권한을 새 로그온에 할당했습니다....
   31283 3 03 11:52    SuccessA... Microsoft-Windows...         4624 계정이 성공적으로 로그온되었습니다....
   31282 3 03 11:52    SuccessA... Microsoft-Windows...         4798 사용자의 로컬 그룹 구성원이 열거되었습니다....
   31281 3 03 11:52    SuccessA... Microsoft-Windows...         4798 사용자의 로컬 그룹 구성원이 열거되었습니다....
   31280 3 03 11:52    SuccessA... Microsoft-Windows...         4798 사용자의 로컬 그룹 구성원이 열거되었습니다....

특정 이벤트ID 조회
PS C:\Temp> get-eventlog security | where {$_.Instanceid -eq 4624} | select -First 3

특정 기간 조회
PS C:\Temp> (get-eventlog security | where {$_.InstanceID -eq 4624} | where {$_.TimeWritten.toString("yyyy-MM-dd HH:mm:ss") -ge (get-date).adddays(-10).toString("yyyy-MM-dd HH:mm:ss")} |  where {$_.TimeWritten.toString("yyyy-MM-dd HH:mm:ss") -le (get-date).adddays(-5).toString("yyyy-MM-dd HH:mm:ss")}).count
868

PS C:\Temp> get-eventlog security | where {$_.InstanceID -eq 4624} | where {$_.TimeWritten.toString("yyyy-MM-dd HH:mm:ss") -ge (get-date).adddays(-10).toString("yyyy-MM-dd HH:mm:ss")} |  where {$_.TimeWritten.toString("yyyy-MM-dd HH:mm:ss") -le (get-date).adddays(-5).toString("yyyy-MM-dd HH:mm:ss")} | select -First 3 | select-object InstanceID, @{Name='CTime';Expression={$_.TimeWritten.toString("yyyy-MM-dd HH:mm:ss")}}, Message

 

시스템 이벤트 로그에서 1000 개의 최신 항목에 포함된 건수별 리소스 확인

PS F:\script\powershell>$Events = Get-EventLog -LogName System -Newest 1000                                            

PS F:\script\powershell>$Events | Group-Object -Property Source -NoElement | Sort-Object -Property Count -Descending   

Count Name
----- ----
  227 Microsoft-Windows-Filt...
  154 Microsoft-Windows-Kern...
  113 Service Control Manager
   72 DCOM
   50 Microsoft-Windows-Time...
   49 Microsoft-Windows-Kern...
   42 Microsoft-Windows-Dhcp...
   35 Microsoft-Windows-Ntfs
   34 EventLog
   32 Microsoft-Windows-Grou...
   30 Microsoft-Windows-Wind...
   28 Microsoft-Windows-TPM-WMI
   28 Microsoft-Windows-Kern...
   21 Microsoft-Windows-DHCP...
   14 Microsoft-Windows-Winl...
   14 Microsoft-Windows-Kern...
    7 User32
    7 volmgr
    7 Microsoft-Windows-Dire...
    7 TPM
    7 Microsoft-Windows-Wininit
    7 MEIx64
    7 e1i65x64
    4 Microsoft-Windows-DNS-...
    3 Application Popup
    1 WinDivert

 

에러 이벤트 조회

PS F:\script\powershell> Get-EventLog -LogName System -EntryType Error  

< 참고 >
주요 분석 대상별로 ID나 InstanceID를 바꿔가면서 실행하면 된다.

레퍼런스 : https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1

Get-WmiObject
PS C:\Temp>  Get-WmiObject -Query "Select EventCode,TimeGenerated,Type,Message from Win32_NTLogEvent WHERE (LogFile = 'Security' and Eventcode='4624')" | select -First 10 | select-object EventCode,TimeGenerated,Type,Message | ft

 

<참고>

조회 속도는 가장 빠른 거 같다.

레퍼런스 : https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1

 

PowerShell Scripts

check-windows-event-log.ps1

 

Application 이벤트 로그에서 메세지에 "보안"이 포함된 내역 조회
F:\script\powershell>powershell -ExecutionPolicy bypass -f check-windows-event-log.ps1 -LogName Application -Pattern 보안