Skip to content

Commit 0ed7db8

Browse files
brazilianscriptguybrazilianscriptguy
authored
Update README.md
Signed-off-by: LUIZ HAMILTON ROBERTO DA SILVA <[email protected]>
1 parent 990d70d commit 0ed7db8

1 file changed

Lines changed: 88 additions & 62 deletions

File tree

‎BlueTeam-Tools/EventLogMonitoring/README.md‎

Lines changed: 88 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -1,103 +1,129 @@
11
## 🔵 BlueTeam-Tools: EventLog Monitoring Suite
22
### Log Analysis · Threat Detection · Audit Readiness
33

4-
[![BlueTeam](https://img.shields.io/badge/BlueTeam-Event%20Log%20Analysis-orange?style=for-the-badge&logo=protonmail&logoColor=white)]()
5-
[![PowerShell](https://img.shields.io/badge/PowerShell-Primary-5391FE?style=for-the-badge&logo=powershell&logoColor=white)]()
6-
[![Windows](https://img.shields.io/badge/Windows-Server%20%7C%2010%20%7C%2011-0078D6?style=for-the-badge&logo=windows&logoColor=white)]()
7-
[![Forensics](https://img.shields.io/badge/Domain-Digital%20Forensics-black?style=for-the-badge)]()
8-
[![Security](https://img.shields.io/badge/Domain-Cybersecurity-critical?style=for-the-badge)]()
4+
[![BlueTeam](https://img.shields.io/badge/BlueTeam-Event%20Log%20Analysis-orange?style=for-the-badge&logo=protonmail&logoColor=white)]() [![PowerShell](https://img.shields.io/badge/PowerShell-Primary-5391FE?style=for-the-badge&logo=powershell&logoColor=white)]() [![Windows](https://img.shields.io/badge/Windows-Server%20%7C%2010%20%7C%2011-0078D6?style=for-the-badge&logo=windows&logoColor=white)]() [![Forensics](https://img.shields.io/badge/Domain-Digital%20Forensics-black?style=for-the-badge)]() [![Security](https://img.shields.io/badge/Domain-Cybersecurity-critical?style=for-the-badge)]()
95

106
---
117

12-
The **EventLogMonitoring** directory contains **forensic‑grade PowerShell tooling** focused exclusively on **Windows Event Log (.evtx) analysis** for **Blue Team, DFIR, SOC, and audit workflows**.
8+
The **EventLogMonitoring** folder contains a specialized and forensic-oriented collection of **PowerShell scripts** designed to process, correlate, and audit **Windows Event Log (`.evtx`) data**.
139

14-
This layer is **capability‑scoped**: it does **not** describe the full BlueTeam suite nor individual script internals, but defines *what this folder delivers operationally*.
10+
These tools are intended for use by **Blue Team operators, DFIR analysts, security engineers, and Windows administrators** in enterprise and public-sector environments where **auditability, repeatability, and evidentiary integrity** are required.
1511

16-
Core characteristics:
12+
Primary use cases include:
1713

18-
- 🎛️ **GUI‑driven execution** for analyst usability
19-
- 📈 **Structured CSV outputs** for correlation, dashboards, and SIEM ingestion
20-
- 🧾 **Deterministic execution logs** for audit trails
21-
- 🔎 **Security‑relevant detections** aligned with Windows native Event IDs
14+
- Authentication and logon analysis
15+
- Privilege escalation and group membership auditing
16+
- Object lifecycle tracking in Active Directory
17+
- Print activity and service usage auditing
18+
- System restarts, crashes, and shutdown attribution
2219

23-
All scripts are **read‑only by design** (no state changes) and compatible with **PowerShell 5.1 corporate environments**.
20+
All scripts generate **structured `.log` and `.csv` artifacts**, suitable for investigations, compliance reporting, and long-term forensic readiness.
2421

2522
---
2623

27-
## 🧪 Capability Scope
24+
## 📦 Script Inventory (Alphabetical)
2825

29-
[![Scope](https://img.shields.io/badge/Scope-Event%20Logs-blue?style=for-the-badge)]()
30-
[![ReadOnly](https://img.shields.io/badge/Mode-Read--Only-success?style=for-the-badge)]()
31-
[![Audit](https://img.shields.io/badge/Use-Audit%20%26%20DFIR-informational?style=for-the-badge)]()
26+
| Script | Purpose |
27+
|------|---------|
28+
| **EventID-Count-AllEvtx-Events.ps1** | Counts all Event IDs in selected `.evtx` files and exports a frequency summary to `.csv`. |
29+
| **EventID307-PrintAudit.ps1** | Audits print activity using Event ID 307. Complements `PrintService-Operational-EventLogs.md`. |
30+
| **EventID4624-ADUserLoginViaRDP.ps1** | Identifies successful logons (Event ID 4624) filtered specifically for RDP sessions. |
31+
| **EventID4624and4634-ADUserLoginTracking.ps1** | Correlates logon/logoff activity (Event IDs 4624 and 4634) into full user session timelines. |
32+
| **EventID4625-ADUserLoginAccountFailed.ps1** | Captures failed authentication attempts (Event ID 4625) with detailed failure reasons. |
33+
| **EventID4648-ExplicitCredentialsLogon.ps1** | Detects explicit credential usage (Event ID 4648), commonly associated with lateral movement. |
34+
| **EventID4663-TrackingObjectDeletions.ps1** | Tracks object deletions via Event ID 4663 with AccessMask `0x10000`. |
35+
| **EventID4720to4756-PrivilegedAccessTracking.ps1** | Monitors privileged account operations (creation, deletion, group changes, delegation). |
36+
| **EventID4771-KerberosPreAuthFailed.ps1** | Analyzes Kerberos pre-authentication failures (Event ID 4771). |
37+
| **EventID4800and4801-WorkstationLockStatus.ps1** | Records workstation lock and unlock events to infer user presence. |
38+
| **EventID5136-5137-5141-ADObjectChanges.ps1** | Audits Active Directory object creation, modification, and deletion events. |
39+
| **EventID6005-6006-6008-6009-6013-1074-1076-SystemRestarts.ps1** | Attributes system restarts, crashes, and shutdowns to users, services, or failures. |
40+
| **Migrate-WinEvtStructure-Tool.ps1** | Migrates the Windows Event Log storage path, updates registry settings, and preserves permissions. |
3241

33-
This folder supports:
42+
---
3443

35-
- Authentication & logon auditing
36-
- Failed logon and credential misuse detection
37-
- Privileged group and object change tracking
38-
- Kerberos authentication anomaly analysis
39-
- System restart, shutdown, and crash auditing
40-
- Print activity and operational event monitoring
44+
## 🧠 Migration Notes — `Migrate-WinEvtStructure-Tool.ps1`
4145

42-
---
46+
> ⚠️ **This script performs low-level changes to the Windows Event Log infrastructure.**
47+
> It must be executed carefully and only by qualified administrators.
4348
44-
## 📦 Script Inventory (Alphabetical)
49+
### Safe Mode Requirement
4550

46-
| Script | Purpose |
47-
|------|---------|
48-
| **EventID-Count-AllEvtx-Events.ps1** | Counts Event IDs across `.evtx` files and exports summary statistics. |
49-
| **EventID307-PrintAudit.ps1** | Audits print activity (Event ID 307). |
50-
| **EventID4624-ADUserLoginViaRDP.ps1** | Tracks interactive logons via RDP (ID 4624). |
51-
| **EventID4624and4634-ADUserLoginTracking.ps1** | Correlates logon / logoff sessions. |
52-
| **EventID4625-ADUserLoginAccountFailed.ps1** | Reports failed authentication attempts. |
53-
| **EventID4648-ExplicitCredentialsLogon.ps1** | Detects explicit credential usage (lateral movement indicator). |
54-
| **EventID4663-TrackingObjectDeletions.ps1** | Identifies object deletions using AccessMask correlation. |
55-
| **EventID4720to4756-PrivilegedAccessTracking.ps1** | Monitors privileged account lifecycle and group changes. |
56-
| **EventID4771-KerberosPreAuthFailed.ps1** | Detects Kerberos pre‑authentication failures. |
57-
| **EventID4800and4801-WorkstationLockStatus.ps1** | Tracks workstation lock / unlock events. |
58-
| **EventID5136-5137-5141-ADObjectChanges.ps1** | Audits AD object create/modify/delete operations. |
59-
| **EventID6005-6006-6008-6009-6013-1074-1076-SystemRestarts.ps1** | Audits system restarts, crashes, and shutdown causes. |
60-
| **Migrate-WinEvtStructure-Tool.ps1** | Migrates Event Log storage location while preserving permissions. |
51+
To safely stop the Event Log service and migrate the `.evtx` structure:
52+
53+
```powershell
54+
bcdedit /set {current} safeboot minimal
55+
shutdown /r /t 0
56+
```
57+
58+
After completing the migration:
59+
60+
```powershell
61+
bcdedit /deletevalue {current} safeboot
62+
shutdown /r /t 0
63+
```
64+
65+
### Optional: DHCP Configuration Backup
66+
67+
If executed on systems hosting DHCP services:
68+
69+
```powershell
70+
netsh dhcp server export C:\Backup\dhcpconfig.dat all
71+
netsh dhcp server import C:\Backup\dhcpconfig.dat all
72+
```
73+
74+
> 🔎 Always validate Event Log integrity and permissions after migration.
6175
6276
---
6377

64-
## 🚀 Usage Model
78+
## 🚀 How to Use
6579

66-
1. Execute via GUI or console
67-
2. Select `.evtx` source files
68-
3. Review generated artifacts:
69-
- `.csv` → analytical data
70-
- `.log` → execution trace
80+
1. Execute the desired script:
81+
- Right-click → **Run with PowerShell**, or
82+
- Launch from an elevated PowerShell console.
7183

72-
> ⚠️ Always preserve original evidence. Work on copies of `.evtx` files during investigations.
84+
2. Select one or more `.evtx` files when prompted (GUI or file picker).
85+
86+
3. Review generated artifacts:
87+
- `.csv` — structured analytical output
88+
- `.log` — execution trace and warnings
7389

7490
---
7591

7692
## 🛠️ Requirements
7793

78-
[![PS](https://img.shields.io/badge/PowerShell-5.1%2B-5391FE?style=for-the-badge&logo=powershell)]()
79-
[![Admin](https://img.shields.io/badge/Privileges-Administrator-critical?style=for-the-badge)]()
94+
- **PowerShell 5.1 or later**
95+
```powershell
96+
$PSVersionTable.PSVersion
97+
```
98+
99+
- **Administrator privileges** (mandatory)
80100

81-
- PowerShell **5.1 minimum**
82-
- Administrative privileges
83-
- RSAT (when querying AD‑backed events)
84-
- Optional: **Log Parser 2.2** (Microsoft)
101+
- **RSAT tools** (for Active Directory correlation)
102+
```powershell
103+
Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online
104+
```
105+
106+
- **Microsoft Log Parser 2.2**
107+
Required for advanced `.evtx` parsing operations.
85108

86109
---
87110

88-
## 📊 Outputs
111+
## 📊 Logs and Exports
112+
113+
- `.log` files
114+
Execution trace, warnings, and processing steps.
89115

90-
- **`.log`** — execution trace & warnings
91-
- **`.csv`** — structured analytical output
92-
- Ready for Excel, SIEMs, dashboards, and reports
116+
- `.csv` files
117+
Structured output suitable for Excel, SIEM ingestion, or forensic timelines.
93118

94119
---
95120

96-
## 💡 Operational Guidance
121+
## 💡 Operational Recommendations
97122

98-
- Schedule periodic runs via **Task Scheduler**
99-
- Centralize outputs to secured log repositories
100-
- Combine with IncidentResponse tools for full timelines
123+
- Schedule recurring analysis via **Task Scheduler**
124+
- Centralize outputs on secured file shares (e.g., `\\logserver\exports`)
125+
- Apply pre-filters to reduce noise and improve signal quality
126+
- Preserve original `.evtx` files for evidentiary integrity
101127

102128
---
103129

0 commit comments

Comments
 (0)