├── sysmonmap.html
├── liveprocessmap.html
├── LFO.ps1
├── ExecTimeQuery.ps1
├── ProcessMapperLive.ps1
├── ProcessMapper.ps1
└── SysmonMapper1.1.ps1
/sysmonmap.html:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/glassdfir/SysmonMapper/HEAD/sysmonmap.html
--------------------------------------------------------------------------------
/liveprocessmap.html:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/glassdfir/SysmonMapper/HEAD/liveprocessmap.html
--------------------------------------------------------------------------------
/LFO.ps1:
--------------------------------------------------------------------------------
1 | Param(
2 | [Parameter(Mandatory=$False)]
3 | [String] $Remote =""
4 | )
5 | $ComputerName="LocalHost"
6 | If($Remote -ne ""){$ComputerName = $Remote}
7 | $global:imagenames = @()
8 | $Events = Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational -ComputerName $ComputerName|Where-Object { ( $_.id -eq 1)}
9 | ForEach($event in $Events){
10 | $eventxmldata = [xml]$event.toxml()
11 | $EventData = $eventxmldata.Event.EventData.Data
12 | $Image =$EventData | where {$_.name -eq "Image"}
13 | $global:imagenames += $Image."#text"
14 | }
15 | $global:imagenames|group|sort-object -property count,Name|Format-Table -Property count,name -AutoSize| Ft -autosize | out-string -width 4096
16 |
--------------------------------------------------------------------------------
/ExecTimeQuery.ps1:
--------------------------------------------------------------------------------
1 | Param(
2 | [Parameter(Mandatory=$False)]
3 | [String] $Remote ="",
4 | [Parameter(Mandatory=$True)]
5 | [String] $query ="",
6 | [Parameter(Mandatory=$False)]
7 | [Switch] $exact = $False
8 | )
9 | $ComputerName="LocalHost"
10 | If($Remote -ne ""){$ComputerName = $Remote}
11 | If($exact){
12 | $events = Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational -FilterXPath 'Event[System[EventID=1] and EventData[Data[@Name="Image"]="4"]]'
13 | ForEach($event in $events){$event.TimeCreated}
14 | }
15 | Else{
16 |
17 | $events = get-winevent -LogName microsoft-windows-sysmon/operational -ComputerName $ComputerName|Where-Object { ( $_.id -eq 1)}
18 | ForEach($event in $events){
19 | $image = $event |% {(([xml]$_.toxml()).Event.EventData.Data | ? {$_.name -eq "Image" })."#text"}
20 | if($image -match $query){Write-host ($event.TimeCreated.ToString() + "`t" + $image)}
21 | }
22 | }
--------------------------------------------------------------------------------
/ProcessMapperLive.ps1:
--------------------------------------------------------------------------------
1 | [CmdletBinding(PositionalBinding=$false)]
2 | Param(
3 | [Parameter(Mandatory=$False)]
4 | [String] $Remote =""
5 | )
6 |
7 | $global:outputlines = @()
8 | $outfile = "liveprocessmap.html"
9 | $ComputerName="LocalHost"
10 |
11 | $Header = "
12 |
13 |
14 |
15 |
48 |
49 |
50 |
51 |
52 |
53 | "
54 | $footer| Add-Content $outfile
--------------------------------------------------------------------------------
/ProcessMapper.ps1:
--------------------------------------------------------------------------------
1 | #Parse Windows Security Logs for 4688 events
2 | #Map processes to parent processes
3 |
4 | [CmdletBinding(PositionalBinding=$false)]
5 | Param(
6 | [Parameter(Mandatory=$True)]
7 | [datetime]$StartDate,
8 | [Parameter(Mandatory=$True)]
9 | [datetime]$StopDate
10 | )
11 |
12 |
13 | $global:outputlines = @()
14 |
15 | $outfile = "processmap.html"
16 |
17 | $Header = "
18 |
19 |
20 |
21 |
60 |
61 |
62 |
63 |
64 |
65 |
66 | "
67 | $footer| Add-Content $outfile
68 |
--------------------------------------------------------------------------------
/SysmonMapper1.1.ps1:
--------------------------------------------------------------------------------
1 |
2 | # Type 1
3 | # 0 - UtcTime
4 | # 1 - ProcessGuid
5 | # 2 - ProcessId
6 | # 3 - Image
7 | # 4 - CommandLine
8 | # 5 - User
9 | # 6 - LogonId
10 | # 7 - TerminalSessionId
11 | # 8 - IntegrityLevel
12 | # 9 - HashType
13 | # 10 - Hash
14 | # 11 - ParentProcessGuid
15 | # 12 - ParentProcessId
16 | # 13 - ParentImage
17 | # 14 - ParentCommandLine
18 |
19 | #Type2
20 | # 0 - UtcTime
21 | # 1 - ProcessGuid
22 | # 2 - ProcessId
23 | # 3 - Image
24 | # 4 - TargetFilename
25 | # 5 - CreationUtcTime
26 | # 6 - PreviousCreationUtcTime
27 |
28 | #Type3
29 | # 0 - UtcTime
30 | # 1 - ProcessGuid
31 | # 2 - ProcessId
32 | # 3 - Image
33 | # 4 - User
34 | # 5 - Protocol
35 | # 6 - SourceIsIpv6
36 | # 7 - SourceIp
37 | # 8 - SourceHostname
38 | # 9 - SourcePort
39 | # 10 - SourcePortName
40 | # 11 - DestinationIsIpv6
41 | # 12 - DestinationIp
42 | # 13 - DestinationHostname
43 | # 14 - DestinationPort
44 | # 15 - DestinationPortName
45 |
46 |
47 |
48 | [CmdletBinding(PositionalBinding=$false)]
49 | Param(
50 | [Parameter(Mandatory=$False)]
51 | [String] $Remote ="",
52 | [Parameter(Mandatory=$False)]
53 | [Switch] $FA = $false, #File Access
54 | [Parameter(Mandatory=$False)]
55 | [Switch] $NA = $false, #Network Access
56 | [Parameter(Mandatory=$False)]
57 | [Int] $P = 0,
58 | [Parameter(Mandatory=$True)]
59 | [datetime]$StartDate,
60 | [Parameter(Mandatory=$True)]
61 | [datetime]$StopDate
62 | )
63 | $ComputerName="LocalHost"
64 | If($Remote -ne ""){$ComputerName = $Remote}
65 | $global:outputlines = @()
66 | $outfile = "sysmonmap.html"
67 |
68 | $Header = "
69 |
70 |
71 |
72 |
250 |
251 |
252 |
253 |
254 |
255 |
256 | "
257 | $footer| Add-Content $outfile
258 |
--------------------------------------------------------------------------------