WINDOWS LOG ANALYSIS
Invoke-SecurityCheck is a script I wrote in powershell to analyze log files and grab useful security info.
I got bored while working on the powershell program so I probably won't work on it again until I have a new windows computer to do forensics on.
The program does the following:
- Grab Security, Application, and System logs. Converts them to pipe separated value.
- Looks for events involving psexec.
- Extracts scheduled tasks and events related to scheduled tasks.
- Looks for events correlating to deleted logs and determines which computer cleared the logs.
- Grabs user and administrators information.
- Grabs processes and determine which process belongs to which user.
- Grabs autostart programs.
- Extracts the Run, RunOnce, RunOnceEx, and PrefetchParameters keys.
- Prints out services running on the machine and prints a mapping of running services to processes.
- Prints out file shares, users with open sessions on the machine, looks at sessions the machine opened, finds NetBIOS over TCP/IP activity, helps the user find unusual TCP and UDP ports and prints the current Windows firewall profile.
- Prints a count of logins by user.
- Extracts event logs from the last 24 hours.
- Grabs all files written to in the last 7 days.
- Finds powershell scripts present on the computer.
MAC OS LOG ANALYSIS
I put together a bunch of commandline code to do Mac OS analysis. I was going to put the commands into a Scala program, but I don't have time to write the code at the moment.
Powershell is super easy so, after doing a ton of research on Mac OS event log analysis, I ended up writing a program in Powershell to supplement a class project instead.