Join PowerShell Script from Event Logs

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx
97 of whaaaaat?
  1. DeepBlueCLI
  2. Countercept/chainsaw
  3. EVTXecmd
$created = Get-WinEvent -FilterHashtable @{ ProviderName="Microsoft-Windows-PowerShell"; Id = 4104 } |
Where-Object { $_.<...> }
$sortedScripts = $created | sort { $_.Properties[0].Value }
$mergedScript = -join ($sortedScripts | % { $_.Properties[2].Value })

Say Hello to PowerShell ISE

The WHAT

$StoreArrayHere = Get-WinEvent -FilterHashtable @{ Path="C:\EVTXSamples\Microsoft-Windows-PowerShell%4Operational.evtx"; ProviderName=“Microsoft-Windows-PowerShell”; Id = 4104 } | Where-Object { $_.Message -like '*51baf005-40a5-4878-ab90-5ecc51cab9af*' }$SortIt = $StoreArrayHere | sort { $_.Properties[0].Value }$SortIt | select ActivityId,Message
uh oh

Options:

  1. Remove the Where-Object filter and find out which script blocks have been completely recorded in the Event Logs.
$StoreArrayHere = Get-WinEvent -FilterHashtable @{ Path="C:\EVTXSamples\Microsoft-Windows-PowerShell%4Operational.evtx"; ProviderName=“Microsoft-Windows-PowerShell”; Id = 4104 }$SortIt = $StoreArrayHere | sort { $_.Properties[0].Value }$SortIt | select ActivityId,Message
$StoreArrayHere = Get-WinEvent -FilterHashtable @{ Path="Microsoft-Windows-PowerShell%4Operational.evtx"; ProviderName=“Microsoft-Windows-PowerShell”; Id = 4104 } | Where-Object { $_.Message -like '*97b04021-6c0b-4fd2-8f57-39ada2599db8*' }$SortIt = $StoreArrayHere | sort { $_.Properties[0].Value }$SortIt | select ActivityId,Message
voila

The HOW

To restore this script to disk,

$StoreArrayHere = Get-WinEvent -FilterHashtable @{ Path="Microsoft-Windows-PowerShell%4Operational.evtx"; ProviderName=“Microsoft-Windows-PowerShell”; Id = 4104 } | Where-Object { $_.Message -like '*97b04021-6c0b-4fd2-8f57-39ada2599db8*' }$SortIt = $StoreArrayHere | sort { $_.Properties[0].Value }$MergedScript = -join ($SortIt | % { $_.Properties[2].Value }) | Out-File SomeBadScript.ps1
happy huntin’
Sample Output

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Vikas Singh

Vikas Singh

I am an Information Security professional working with Sophos. Writing doesn't come naturally to me but I had to start somewhere.