search

JPCERTCC / LogonTracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log
Other
2.7k stars 441 forks source link

Update logontracer.py #93

Closed falsneg closed 3 years ago

falsneg commented 3 years ago

replaced repetitive strptime conversions with convert_logtime and added a workaround to remove trailing timezone (with re.sub)

shu-tom commented 3 years ago

Is this re.sub a bug fix?

falsneg commented 3 years ago

Yeah I've had a log with a trailing timezone that required stripping

shu-tom commented 3 years ago

Could you show me an event log sample?

falsneg commented 3 years ago

I'm sorry, I cannot share the log in question as it belongs to a customer.

shu-tom commented 3 years ago

We will consider how to fix it after checking the log of this issue.