Windows Event Logs & Sysmon

# Emplacement par defaut des journaux Windows
C:\Windows\System32\winevt\Logs\

# Fichiers principaux
C:\Windows\System32\winevt\Logs\Security.evtx
C:\Windows\System32\winevt\Logs\System.evtx
C:\Windows\System32\winevt\Logs\Application.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

# Taille par defaut : 20 Mo par journal (configurable)
# Format binaire .evtx (remplace le .evt depuis Vista/2008)

# Exporter un evenement en XML avec PowerShell
Get-WinEvent -LogName Security -MaxEvents 1 | Format-List *

# Structure XML typique d'un evenement 4624
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{...}" />
    <EventID>4624</EventID>
    <Version>2</Version>
    <Level>0</Level>
    <Task>12544</Task>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2025-01-15T14:32:05.1234567Z" />
    <Computer>DC01.corp.local</Computer>
    <Channel>Security</Channel>
  </System>
  <EventData>
    <Data Name="TargetUserName">jdupont</Data>
    <Data Name="TargetDomainName">CORP</Data>
    <Data Name="LogonType">10</Data>
    <Data Name="IpAddress">192.168.1.50</Data>
    <Data Name="LogonProcessName">User32</Data>
    <Data Name="AuthenticationPackageName">Negotiate</Data>
  </EventData>
</Event>

# Telecharger Sysmon depuis Sysinternals
# https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

# Installation basique (configuration par defaut)
sysmon64.exe -accepteula -i

# Installation avec un fichier de configuration personnalise
sysmon64.exe -accepteula -i sysmonconfig.xml

# Mettre a jour la configuration sans reinstaller
sysmon64.exe -c sysmonconfig.xml

# Verifier le statut de Sysmon
sc query sysmon64

# Desinstaller Sysmon (si necessaire)
sysmon64.exe -u

<Sysmon schemaversion="4.90">
  <!-- Capturer les hash en SHA256 -->
  <HashAlgorithms>SHA256,IMPHASH</HashAlgorithms>

  <!-- Archiver les fichiers supprimes -->
  <ArchiveDirectory>SysmonArchive</ArchiveDirectory>

  <EventFiltering>

    <!-- Event ID 1 : Process Create -->
    <RuleGroup name="ProcessCreate" groupRelation="or">
      <ProcessCreate onmatch="exclude">
        <!-- Exclure les processus systeme bruyants -->
        <Image condition="is">C:\Windows\System32\conhost.exe</Image>
        <Image condition="is">C:\Windows\System32\backgroundTaskHost.exe</Image>
      </ProcessCreate>
    </RuleGroup>

    <!-- Event ID 3 : Network Connection -->
    <RuleGroup name="NetworkConnect" groupRelation="or">
      <NetworkConnect onmatch="include">
        <!-- Capturer les connexions de processus suspects -->
        <Image condition="end with">powershell.exe</Image>
        <Image condition="end with">cmd.exe</Image>
        <Image condition="end with">rundll32.exe</Image>
        <Image condition="end with">regsvr32.exe</Image>
        <Image condition="end with">mshta.exe</Image>
        <Image condition="end with">certutil.exe</Image>
      </NetworkConnect>
    </RuleGroup>

    <!-- Event ID 7 : Image Loaded (DLL) -->
    <RuleGroup name="ImageLoad" groupRelation="or">
      <ImageLoad onmatch="include">
        <!-- DLL non signees chargees depuis des repertoires suspects -->
        <Signed condition="is">false</Signed>
        <ImageLoaded condition="contains">\Temp\</ImageLoaded>
        <ImageLoaded condition="contains">\AppData\</ImageLoaded>
      </ImageLoad>
    </RuleGroup>

    <!-- Event ID 10 : Process Access (LSASS protection) -->
    <RuleGroup name="ProcessAccess" groupRelation="or">
      <ProcessAccess onmatch="include">
        <TargetImage condition="end with">lsass.exe</TargetImage>
      </ProcessAccess>
    </RuleGroup>

    <!-- Event ID 22 : DNS Query -->
    <RuleGroup name="DnsQuery" groupRelation="or">
      <DnsQuery onmatch="exclude">
        <!-- Exclure les requetes DNS systeme bruyantes -->
        <QueryName condition="end with">.microsoft.com</QueryName>
        <QueryName condition="end with">.windowsupdate.com</QueryName>
      </DnsQuery>
    </RuleGroup>

  </EventFiltering>
</Sysmon>

# Lister tous les providers ETW enregistres
logman query providers

# Rechercher un provider specifique
logman query providers | findstr /i "security"
logman query providers | findstr /i "sysmon"

# Voir les details d'un provider
logman query providers "Microsoft-Windows-Security-Auditing"

# Lister les providers actifs sur une session
logman query -ets

# Creer une session de trace pour le provider DNS
logman create trace DNSTrace -p "Microsoft-Windows-DNS-Client" -o C:\Traces\dns.etl

# Demarrer la session
logman start DNSTrace

# Laisser la trace collecter pendant un moment...

# Arreter la session
logman stop DNSTrace

# Convertir le fichier .etl en texte lisible
tracerpt C:\Traces\dns.etl -o C:\Traces\dns_report.txt -of TEXT

# Convertir en CSV pour analyse
tracerpt C:\Traces\dns.etl -o C:\Traces\dns_report.csv -of CSV

# Supprimer la session de trace
logman delete DNSTrace

# Lister les sessions ETW actives
Get-EtwTraceSession

# Lister les providers d'une session
Get-EtwTraceProvider -SessionName "EventLog-Security"

# Creer une trace en PowerShell
New-EtwTraceSession -Name "MySecurityTrace" -LogFileMode 0x2 -FlushTimer 1
Add-EtwTraceProvider -SessionName "MySecurityTrace" `
  -Guid "{F4E1897A-BB5D-5668-F1D8-040F4D8DD344}" `
  -Level 5 -MatchAnyKeyword 0xFFFFFFFF

# Arreter et supprimer
Stop-EtwTraceSession -Name "MySecurityTrace"
Remove-EtwTraceSession -Name "MySecurityTrace"