1

我正在尝试将事件 4625 中的特定数据字段 (FailureReason) 获取到 CSV 字段。

我已经使用以下代码分析了事件模式：

(Get-WinEvent -ListProvider Microsoft-Windows-Security-Auditing).Events |
    Where-Object {$_.Id -eq 4625}

这导致：

Id          : 4625
Version     : 0
LogLink     : System.Diagnostics.Eventing.Reader.EventLogLink
Level       : System.Diagnostics.Eventing.Reader.EventLevel
Opcode      : System.Diagnostics.Eventing.Reader.EventOpcode
Task        : System.Diagnostics.Eventing.Reader.EventTask
Keywords    : {}
Template    : <template xmlns="http://schemas.microsoft.com/win/2004/08/events">
                <data name="SubjectUserSid" inType="win:SID" outType="xs:string"/>
                <data name="SubjectUserName" inType="win:UnicodeString" outType="xs:string"/>
                <data name="SubjectDomainName" inType="win:UnicodeString" outType="xs:string"/>
                <data name="SubjectLogonId" inType="win:HexInt64" outType="win:HexInt64"/>
                <data name="TargetUserSid" inType="win:SID" outType="xs:string"/>
                <data name="TargetUserName" inType="win:UnicodeString" outType="xs:string"/>
                <data name="TargetDomainName" inType="win:UnicodeString" outType="xs:string"/>
                <data name="Status" inType="win:HexInt32" outType="win:HexInt32"/>
                <data name="FailureReason" inType="win:UnicodeString" outType="xs:string"/>
                <data name="SubStatus" inType="win:HexInt32" outType="win:HexInt32"/>
                <data name="LogonType" inType="win:UInt32" outType="xs:unsignedInt"/>
                <data name="LogonProcessName" inType="win:UnicodeString" outType="xs:string"/>
                <data name="AuthenticationPackageName" inType="win:UnicodeString" outType="xs:string"/>
                <data name="WorkstationName" inType="win:UnicodeString" outType="xs:string"/>
                <data name="TransmittedServices" inType="win:UnicodeString" outType="xs:string"/>
                <data name="LmPackageName" inType="win:UnicodeString" outType="xs:string"/>
                <data name="KeyLength" inType="win:UInt32" outType="xs:unsignedInt"/>
                <data name="ProcessId" inType="win:Pointer" outType="win:HexInt64"/>
                <data name="ProcessName" inType="win:UnicodeString" outType="xs:string"/>
                <data name="IpAddress" inType="win:UnicodeString" outType="xs:string"/>
                <data name="IpPort" inType="win:UnicodeString" outType="xs:string"/>
              </template>

Description : Fehler beim Anmelden eines Kontos.

              Antragsteller:
                Sicherheits-ID:     %1
                Kontoname:      %2
                Kontodomäne:        %3
                Anmelde-ID:     %4

              Anmeldetyp:           %11

              Konto, für das die Anmeldung fehlgeschlagen ist:
                Sicherheits-ID:     %5
                Kontoname:      %6
                Kontodomäne:        %7

              Fehlerinformationen:
                Fehlerursache:      %9
                Status:         %8
                Unterstatus::       %10

              Prozessinformationen:
                Aufrufprozess-ID:   %18
                Aufrufprozessname:  %19

              Netzwerkinformationen:
                Arbeitsstationsname:    %14
                Quellnetzwerkadresse:   %20
                Quellport:      %21

              Detaillierte Authentifizierungsinformationen:
                Anmeldeprozess:     %12
                Authentifizierungspaket:    %13
                Übertragene Dienste:    %15
                Paketname (nur NTLM):   %16
                Schlüssellänge:     %17

通过此输出，我知道数据字段名称是“FailureReason”或$_.properties[9]. 我在以下代码片段中尝试了这两种变体：

Get-WinEvent -FilterHashtable @{Path="c:\temp\test.evtx";} -ErrorAction SilentlyContinue |
    # which are the interesting Events in the Eventlog?
    Where-Object {($_.id -eq "4625")} |
    ForEach-Object {
        if ($_.Id -eq  4625) {
            # which extended Fields from the Eventlog are needed for further investigations?
            # example: how does the eventlog schema looks like?
            # can be examined with (Get-WinEvent -ListProvider Microsoft-Windows-Security-Auditing).Events | Where-Object {$_.Id -eq 4625}
            $SelectorStrings = [string[]]@(
                'Event/EventData/Data[@Name="TargetUserName"]',
                'Event/EventData/Data[@Name="TargetDomainName"]',
                'Event/EventData/Data[@Name="WorkstationName"]',
                'Event/EventData/Data[@Name="IpAddress"]',
                'Event/EventData/Data[@Name="IpPort"]',
                'Event/EventData/Data[@Name="LogonType"]',
                'Event/EventData/Data[@Name="FailureReason"]'
            )
            $PropertySelector = [System.Diagnostics.Eventing.Reader.EventLogPropertySelector]::new($SelectorStrings)

            $TargetUserName, $TargetDomainName, $WorkstationName, $IpAddress, $IpPort, $LogonType, $Remark, $FailureReason = $_.GetPropertyValues($PropertySelector)
            $Remark ="Failed Login !"
            #Create the PSCustomObject from the given Fieldnames
            [PSCustomObject]@{
                TimeCreated   = $_.TimeCreated
                UserName      = $TargetUserName
                Domain        = $TargetDomainName
                ComputerName  = $WorkstationName
                IPAddress     = $IpAddress
                Port          = $IpPort
                LogonType     = $LogonType
                Remark        = $Remark
                FailureReason = $FailureReason
                Message       = ($_.Message).Split(".")[0]
                #Export everything to CSV-File
            } | Export-Csv -NoTypeInformation -Force -Encoding UTF8 -Path 'c:\temp\failedlogin.csv' -Append
        }
    }

结果，CSV 文件中的所有字段都被填充，除了字段“FailureReason”。之后我更改了代码以获取具有相同结果的字段“ProcessId”的值，然后 CSV 字段也为空。

备注：代码通常要复杂得多，我将其简化为所需的部分。

4

1 回答 1

1

您过滤 7 个属性，$SelectorStrings然后尝试填充 8 个变量。我认为您需要$remark从此行中删除：

$TargetUserName, $TargetDomainName, $WorkstationName, $IpAddress, $IpPort, $LogonType, $Remark, $FailureReason = $_.GetPropertyValues($PropertySelector)

应该：

$TargetUserName, $TargetDomainName, $WorkstationName, $IpAddress, $IpPort, $LogonType, $FailureReason = $_.GetPropertyValues($PropertySelector)

我认为 FailureReason 值进入了$Remark变量，然后您立即在其后面的行中替换该变量。

另外，如果您将| Export-CSV..部件移动到关闭后发生}，ForEach-Object那么您可以取消使用-Append.

于 2018-02-07T11:56:06.023 回答