Closed andrewkroh closed 4 years ago
Pinging @elastic/siem (Team:SIEM)
PowerShell module logging has been working well for me, and for parsing on 4103 and 800 you can pull apart the param fields, I'm currently doing this with a dissect parser.
example:
- name: Microsoft-Windows-PowerShell/Operational
event_id: 4103
processors:
- dissect:
when:
has_fields: ['winlog.event_data.ContextInfo']
tokenizer: " Severity = %{Severity}\n Host Name = %{HostName}\n Host Version = %{HostVersion}\n Host ID = %{HostID}\n Host Application = %{HostApplication}\n Engine Version = %{EngineVersion}\n Runspace ID = %{RunspaceID}\n Pipeline ID = %{PipelineID}\n Command Name = %{CommandName}\n Command Type = %{CommandType}\n Script Name = %{ScriptName}\n Command Path = %{CommandPath}\n Sequence Number = %{SequenceNumber}\n User = %{User}\n Connected User = %{ConnectedUser}\n Shell ID = %{ShellID}"
field: "winlog.event_data.ContextInfo"
target_prefix: "winlog.event_data.powershell"
If you added an enhancement here, I'd recommend doing the key-value extraction more efficiently (if possible) and adding in an option to tail powershell transcript directories as a separate module.
Also please don't forget about "Windows PowerShell" event code 400 and 800, they are absolute gold.
- name: Windows PowerShell
event_id: 400, 800
processors:
- dissect:
when:
equals.winlog.event_id: 400
tokenizer: "\tNewEngineState=%{NewEngineState}\n\tPreviousEngineState=%{PreviousEngineState}\n\n\tSequenceNumber=%{SequenceNumber}\n\n\tHostName=%{HostName}\n\tHostVersion=%{HostVersion}\n\tHostId=%{HostId}\n\tHostApplication=%{HostApplication}\n\tEngineVersion=%{EngineVersion}\n\tRunspaceId=%{RunspaceId}\n\tPipelineId=%{PipelineId}\n\tCommandName=%{CommandName}\n\tCommandType=%{CommandType}\n\tScriptName=%{ScriptName}\n\tCommandPath=%{CommandPath}\n\tCommandLine=%{CommandLine}"
field: "winlog.event_data.param3"
target_prefix: "winlog.event_data.powershell"
- dissect:
when:
equals.winlog.event_id: 800
tokenizer: "\tDetailSequence=%{DetailSequence}\n\tDetailTotal=%{DetailTotal}\n\n\tSequenceNumber=%{SequenceNumber}\n\n\tUserId=%{UserId}\n\tHostName=%{HostName}\n\tHostVersion=%{HostVersion}\n\tHostId=%{HostId}\n\tHostApplication=%{HostApplication}\n\tEngineVersion=%{EngineVersion}\n\tRunspaceId=%{RunspaceId}\n\tPipelineId=%{PipelineId}\n\tScriptName=%{ScriptName}\n\tCommandLine=%{CommandLine}"
field: "winlog.event_data.param2"
target_prefix: "winlog.event_data.powershell"
Also please don't forget about "Windows PowerShell" event code 400 and 800, they are absolute gold.
Thanks for the reminder. I had those two IDs in my notes about creating this issue but forgot to add them. We'll make sure to take a look at that log as well. The same dissect approach for those is probably what I'd use.
adding in an option to tail powershell transcript directories as a separate module
These are text files, right? That would take some effort to do in Winlogbeat. We'd need a mashup of Filebeat + Winlogbeat.
Yes these are text files that are dropped in directories based on date. Really a filebeat agent is better for this so I'd exclude it for winlogbeat, I just wanted to mention it since it is in the link you had above and frequently talked about.
Thanks for your work. For clarification for others - do the event ID's have to be hardcoded in the winlogbeat.yml for this to be picked up, or will simply ingesting the PowerShell log perform this work?
Also, what if the events are forwarded to a non-standard log like "Forwarded Events."
Basically my question is, how does it know to perform these actions? What's the criteria?
Also, what if the events are forwarded to a non-standard log like "Forwarded Events."
In that case you can apply the script
processor to the ForwardedEvents
log.
do the event ID's have to be hardcoded in the winlogbeat.yml for this to be picked up, or will simply ingesting the PowerShell log perform this work?
The event_ids
filter is optional. The documentation lists what event IDs are processed by the module and the filters in the config examples reflect those same. IDs. If you omit the filter then any event IDs that are not handled by the module will simply pass through (source code) without any additional processing.
Add a new Winlogbeat module to collect logs from PowerShell. This will collect information about the scripts and modules that are being executed.
References:
Module Checklist