KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #typescript #ai-agent #developer-tools #claude-code #codex #deepseek-harness #ai-agents #react #mcp #rust

EventLogParser

★ 128 Open GitHub ↗

Parse PowerShell and Security event logs for sensitive information.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# EventLogParser

```
Usage
=====

EventLogParser.exe eventid=EVENTID [outfile=C:\Windows\Temp\loggedfiles.txt]

Description:

EventLogParser will parse event IDs 4103, 4104 and 4688 to search for sensitive
    information, including:
        - RDP Credentials
        - net user commands
        - Plaintext secure-strings
        - PSCredential objects
        - SSH commands using keys
        - Imported powershell modules.

Arguments:

Required:

eventid - Must be one of:
                    4103 - Script Block Logging
                    4104 - PowerShell module logging
                    4688 - Process Creation logging.
                           Note: Must be high integrity and have
                                 command line logging enabled.

Optional:

context - Number of lines surrounding the ""interesting"" regex matches.
                  Only applies to 4104 events. Default is 3.

outfile - Path to the file you wish to write all matching script block logs
                  to. This only applies to event ID 4104.

Example:

.\EventLogParser.exe eventid=4104 outfile=C:\Windows\Temp\scripts.txt context=5

Writes all 4104 events with ""sensitive"" information to C:\Windows\Temp\scripts.txt
        and prints 5 lines before and after the matching line.

.\EventLogParser.exe eventid=4103

List all modules path on disk that have been loaded by each user.
```

## Examples

```
.\EventLogParser.exe eventid=4104
[*] Parsing PowerShell 4104 event logs...

[+] Regex Match: net user $NewOsUser $NewOsPass /add & net localgroup administrators /add $NewOsUser'';"
[+] Regex Context:
        # Create query
        }else{
        Break
        Write-Verbose "$Instance : The service account does not have local administrator privileges so no OS admin can be created.  Aborted."
        net user $NewOsUser $NewOsPass /add & net localgroup administrators /add $NewOsUser'';"
        # Status user
        Write-Verbose "$Instance : Payload generated."
        }
        }else{

[+] Regex Match: New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ($Username, $secpass)
[+] Regex Context:
        $secpass = ConvertTo-SecureString $Password -AsPlainText -Force
        {
        if($Username -and $Password)
        # Create PS Credential object
        New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ($Username, $secpass)
        }
        # Create Create the connection to LDAP
        if ($DomainController)
        {

[+] Regex Match: ConvertTo-SecureString $Password -AsPlainText -Force
[+] Regex Context:
        {
        if($Username -and $Password)
        # Create PS Credential object
        {
        ConvertTo-SecureString $Password -AsPlainText -Force
        $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ($Username, $secpass)
        }
        # Create Create the connection to LDAP
        if ($DomainController)
```

EventLogParser

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README