Skip to content

Commit d568fed

Browse files
AndrewRathbunAndrewRathbun
authored
Merge pull request #5 from EricZimmerman/master
update repo
2 parents f98e0d0 + 1e2a83e commit d568fed

17 files changed

+119
-172
lines changed

‎EvtxECmd/App.config

+7-8
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,21 @@
1-
<?xml version="1.0" encoding="utf-8"?>
2-
1+
<?xml version="1.0" encoding="utf-8"?>
32
<configuration>
43
<configSections>
54
</configSections>
65
<startup>
7-
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1" />
6+
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.2"/>
87
</startup>
98
<runtime>
109
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
1110
<dependentAssembly>
12-
<assemblyIdentity name="System.ValueTuple" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />
13-
<bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0" />
11+
<assemblyIdentity name="System.ValueTuple" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral"/>
12+
<bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0"/>
1413
</dependentAssembly>
1514

1615
<dependentAssembly>
17-
<assemblyIdentity name="System.Buffers" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />
18-
<bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0" />
16+
<assemblyIdentity name="System.Buffers" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral"/>
17+
<bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0"/>
1918
</dependentAssembly>
2019
</assemblyBinding>
2120
</runtime>
22-
</configuration>
21+
</configuration>

‎EvtxECmd/EvtxECmd.csproj

+3-3
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
<OutputType>Exe</OutputType>
99
<RootNamespace>EvtxECmd</RootNamespace>
1010
<AssemblyName>EvtxECmd</AssemblyName>
11-
<TargetFrameworkVersion>v4.6.1</TargetFrameworkVersion>
11+
<TargetFrameworkVersion>v4.6.2</TargetFrameworkVersion>
1212
<FileAlignment>512</FileAlignment>
1313
<AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
1414
<Deterministic>true</Deterministic>
@@ -88,7 +88,7 @@
8888
<Version>4.1.0</Version>
8989
</PackageReference>
9090
<PackageReference Include="CsvHelper">
91-
<Version>16.1.0</Version>
91+
<Version>17.0.1</Version>
9292
</PackageReference>
9393
<PackageReference Include="Exceptionless">
9494
<Version>4.5.0</Version>
@@ -105,7 +105,7 @@
105105
<Version>12.0.3</Version>
106106
</PackageReference>
107107
<PackageReference Include="NLog">
108-
<Version>4.7.5</Version>
108+
<Version>4.7.6</Version>
109109
</PackageReference>
110110
<PackageReference Include="ServiceStack.Text">
111111
<Version>5.10.2</Version>

‎EvtxECmd/Program.cs

+20-4
Original file line numberDiff line numberDiff line change
@@ -741,18 +741,35 @@ private static void UpdateFromRepo()
741741

742742
var newMapPath = Path.Combine(BaseDirectory, "evtx-master","evtx", "Maps");
743743

744-
var orgMapMath = Path.Combine(BaseDirectory, "Maps");
744+
var orgMapPath = Path.Combine(BaseDirectory, "Maps");
745745

746746
var newMaps = Directory.GetFiles(newMapPath);
747747

748748
var newlocalMaps = new List<string>();
749749

750750
var updatedlocalMaps = new List<string>();
751751

752+
if (File.Exists(Path.Combine(orgMapPath, "Security_4624.map")))
753+
{
754+
_logger.Warn($"Old map format found. Zipping to '!!oldMaps.zip' and cleaning up old maps");
755+
//old maps found, so zip em first
756+
var oldZip = Path.Combine(orgMapPath, "!!oldMaps.zip");
757+
fff.CreateZip(oldZip,orgMapPath,false,@"\.map$");
758+
foreach (var m in Directory.GetFiles(orgMapPath,"*.map"))
759+
{
760+
File.Delete(m);
761+
}
762+
}
763+
764+
if (File.Exists(Path.Combine(orgMapPath, "!!!!README.txt")))
765+
{
766+
File.Delete(Path.Combine(orgMapPath, "!!!!README.txt"));
767+
}
768+
752769
foreach (var newMap in newMaps)
753770
{
754771
var mName = Path.GetFileName(newMap);
755-
var dest = Path.Combine(orgMapMath, mName);
772+
var dest = Path.Combine(orgMapPath, mName);
756773

757774
if (File.Exists(dest) == false)
758775
{
@@ -769,7 +786,6 @@ private static void UpdateFromRepo()
769786
{
770787
//updated file
771788
updatedlocalMaps.Add(mName);
772-
773789

774790
}
775791
}
@@ -841,7 +857,7 @@ private static void ProcessFile(string file)
841857
{
842858
fileS = new FileStream(file, FileMode.Open, FileAccess.Read);
843859
}
844-
catch (Exception ex)
860+
catch (Exception)
845861
{
846862
//file is in use
847863

‎EvtxECmd/Properties/AssemblyInfo.cs

+2-2
Original file line numberDiff line numberDiff line change
@@ -31,5 +31,5 @@
3131
// You can specify all the values or you can default the Build and Revision Numbers
3232
// by using the '*' as shown below:
3333
// [assembly: AssemblyVersion("1.0.*")]
34-
[assembly: AssemblyVersion("0.6.0.3")]
35-
[assembly: AssemblyFileVersion("0.6.0.3")]
34+
[assembly: AssemblyVersion("0.6.5.0")]
35+
[assembly: AssemblyFileVersion("0.6.5.0")]

‎evtx.Test/evtx.Test.csproj

+1-1
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@
6363
<Version>2.7.0</Version>
6464
</PackageReference>
6565
<PackageReference Include="NLog">
66-
<Version>4.7.5</Version>
66+
<Version>4.7.6</Version>
6767
</PackageReference>
6868
<PackageReference Include="NUnit">
6969
<Version>3.12.0</Version>

‎evtx/ChunkInfo.cs

+2-2
Original file line numberDiff line numberDiff line change
@@ -241,10 +241,10 @@ public ChunkInfo(byte[] chunkBytes, long absoluteOffset, int chunkNumber)
241241
}
242242

243243
}
244-
catch (Exception e)
244+
catch (Exception )
245245
{
246246
//oh well, we tried
247-
//l.Warn($"Error when attemping to recover possible hidden record: {e.Message}");
247+
//l.Warn($"Error when attempting to recover possible hidden record: {e.Message}");
248248
}
249249

250250
}

‎evtx/EventLog.cs

+2-2
Original file line numberDiff line numberDiff line change
@@ -162,13 +162,13 @@ public static bool LoadMaps(string mapPath)
162162
// {
163163
//
164164
// }
165-
EventLogMaps.Add($"{eventMapFile.EventId}-{eventMapFile.Channel.ToUpperInvariant()}", eventMapFile);
165+
EventLogMaps.Add($"{eventMapFile.EventId}-{eventMapFile.Channel.ToUpperInvariant()}-{eventMapFile.Provider.ToUpperInvariant()}", eventMapFile);
166166

167167
}
168168
else
169169
{
170170
l.Warn(
171-
$"A map for event id '{eventMapFile.EventId}' with Channel '{eventMapFile.Channel}' already exists. Map '{Path.GetFileName(mapFile)}' will be skipped");
171+
$"A map for event id '{eventMapFile.EventId}' with Channel '{eventMapFile.Channel}' and Provider '{eventMapFile.Provider}' already exists. Map '{Path.GetFileName(mapFile)}' will be skipped");
172172
}
173173
}
174174
else

‎evtx/EventLogMap.cs

+2
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,8 @@ public EventLogMapValidator()
119119
{
120120
RuleFor(target => target.EventId).NotNull();
121121
RuleFor(target => target.Channel).NotEmpty();
122+
RuleFor(target => target.Provider).NotEmpty();
123+
122124
RuleFor(target => target.Author).NotEmpty();
123125
RuleFor(target => target.Description).NotEmpty();
124126

‎evtx/EventRecord.cs

+3-15
Original file line numberDiff line numberDiff line change
@@ -293,28 +293,16 @@ public void BuildProperties()
293293
return;
294294
}
295295

296-
if (!EventLog.EventLogMaps.ContainsKey($"{EventId}-{Channel.ToUpperInvariant()}"))
296+
if (!EventLog.EventLogMaps.ContainsKey($"{EventId}-{Channel.ToUpperInvariant()}-{Provider.ToUpperInvariant()}"))
297297
{
298298
return;
299299
}
300300

301301
var docNav = new XPathDocument(new StringReader(xml));
302302
var nav = docNav.CreateNavigator();
303303

304-
l.Trace($"Found map for Event ID {EventId} with Channel '{Channel}'!");
305-
var map = EventLog.EventLogMaps[$"{EventId}-{Channel.ToUpperInvariant()}"];
306-
307-
if (map.Provider.IsNullOrEmpty() == false)
308-
{
309-
l.Trace($"Map specifies a provider. Checking...");
310-
311-
if (!string.Equals(map.Provider, Provider, StringComparison.InvariantCultureIgnoreCase))
312-
{
313-
314-
l.Debug($"The Provider in the event log does not match the provider in the map. Map not applicable.");
315-
return;
316-
}
317-
}
304+
l.Trace($"Found map for Event ID {EventId} with Channel '{Channel}' and Provider '{Provider}'!");
305+
var map = EventLog.EventLogMaps[$"{EventId}-{Channel.ToUpperInvariant()}-{Provider.ToUpperInvariant()}"];
318306

319307
MapDescription = map.Description;
320308

‎evtx/Maps/Microsoft-DriverFrameworks-UserMode-Operational_Microsoft-DriverFrameworks-UserMode_2100.map

-63
This file was deleted.

‎evtx/Maps/Microsoft-Windows-Application-Experience_Program-Compatibility-Assistant_17.map

+2-1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ Author: Hyun Yi @hyuunnn
22
Description: Path of executed program
33
EventId: 17
44
Channel: "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
5+
Provider: "Microsoft-Windows-Program-Compatibility-Assistant"
56
Maps:
67
-
78
Property: ExecutableInfo
@@ -36,4 +37,4 @@ Maps:
3637
# <ResolverName>DetectorShim_Win32Exception</ResolverName>
3738
# </ResolverFiredEvent>
3839
# </UserData>
39-
# </Event>
40+
# </Event>

‎evtx/Maps/Microsoft-Windows-DriverFrameworks-UserMode_Operational_2100.map

+2-1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ Author: Hyun Yi @hyuunnn
22
Description: USB Connection
33
EventId: 2100
44
Channel: "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
5+
Provider: "Microsoft-Windows-DriverFrameworks-UserMode"
56
Maps:
67
-
78
Property: PayloadData1
@@ -55,4 +56,4 @@ Maps:
5556
# Windows Vista, 7 : enable (default)
5657
# Windows 8~ : disable (default)
5758
# https://nxlog.co/documentation/nxlog-user-guide/windows-usb-auditing.html
58-
# https://www.reddit.com/r/sysadmin/comments/4dr2t2/security_guy_wants_to_log_usb_storage_devices_on/
59+
# https://www.reddit.com/r/sysadmin/comments/4dr2t2/security_guy_wants_to_log_usb_storage_devices_on/

‎evtx/Maps/Security_Microsoft-Windows-Eventlog_1100.map

+21-21
Original file line numberDiff line numberDiff line change
@@ -21,24 +21,24 @@ Maps:
2121
# This map likely won't log any data in PayloadData1, but at least this map will provide the Map Description column with something.
2222
#
2323
# Example Event Data:
24-
<Event>
25-
<System>
26-
<Provider Name="Microsoft-Windows-Eventlog" Guid="{fc64rgd8-d6ef-4962-83d5-6e5wergce148}" />
27-
<EventID>1100</EventID>
28-
<Version>0</Version>
29-
<Level>4</Level>
30-
<Task>103</Task>
31-
<Opcode>0</Opcode>
32-
<Keywords>0x4020000340000000</Keywords>
33-
<TimeCreated SystemTime="2020-10-07 02:38:05.9085508" />
34-
<EventRecordID>266791475</EventRecordID>
35-
<Correlation />
36-
<Execution ProcessID="679" ThreadID="1234" />
37-
<Channel>Security</Channel>
38-
<Computer>HOSTNAME</Computer>
39-
<Security />
40-
</System>
41-
<UserData>
42-
<ServiceShutdown></ServiceShutdown>
43-
</UserData>
44-
</Event>
24+
#<Event>
25+
# <System>
26+
# <Provider Name="Microsoft-Windows-Eventlog" Guid="{fc64rgd8-d6ef-4962-83d5-6e5wergce148}" />
27+
# <EventID>1100</EventID>
28+
# <Version>0</Version>
29+
# <Level>4</Level>
30+
# <Task>103</Task>
31+
# <Opcode>0</Opcode>
32+
# <Keywords>0x4020000340000000</Keywords>
33+
# <TimeCreated SystemTime="2020-10-07 02:38:05.9085508" />
34+
# <EventRecordID>266791475</EventRecordID>
35+
# <Correlation />
36+
# <Execution ProcessID="679" ThreadID="1234" />
37+
# <Channel>Security</Channel>
38+
# <Computer>HOSTNAME</Computer>
39+
# <Security />
40+
# </System>
41+
# <UserData>
42+
# <ServiceShutdown></ServiceShutdown>
43+
# </UserData>
44+
#</Event>

‎evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4608.map

+20-20
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ Maps:
1616
Value: "/Event/EventData/Data[@Name=\"SubjectUserName\"]"
1717
-
1818
Property: PayloadData1
19-
PropertvenyValue: "Target: %TargetDomainName%\\%TargetUserName%"
19+
PropertyValue: "Target: %TargetDomainName%\\%TargetUserName%"
2020
Values:
2121
-
2222
Name: TargetDomainName
@@ -30,22 +30,22 @@ Maps:
3030
# This event is logged when LSASS.EXE process starts and the auditing subsystem is initialized. It typically generates during operating system startup process.
3131
#
3232
# Example Et Data:
33-
<Event>
34-
<System>
35-
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="54867925-5478-4994-a5ba-3e3b0328c30d" />
36-
<EventID>4608</EventID>
37-
<Version>0</Version>
38-
<Level>0</Level>
39-
<Task>12679</Task>
40-
<Opcode>0</Opcode>
41-
<Keywords>0x8020009000000000</Keywords>
42-
<TimeCreated SystemTime="2020-10-09 18:09:40.2437686" />
43-
<EventRecordID>266790034</EventRecordID>
44-
<Correlation />
45-
<Execution ProcessID="679" ThreadID="123" />
46-
<Channel>Security</Channel>
47-
<Computer>HOSTNAME.domain.com</Computer>
48-
<Security />
49-
</System>
50-
<EventData></EventData>
51-
</Event>
33+
#<Event>
34+
# <System>
35+
# <Provider Name="Microsoft-Windows-Security-Auditing" Guid="54867925-5478-4994-a5ba-3e3b0328c30d" />
36+
# <EventID>4608</EventID>
37+
# <Version>0</Version>
38+
# <Level>0</Level>
39+
# <Task>12679</Task>
40+
# <Opcode>0</Opcode>
41+
# <Keywords>0x8020009000000000</Keywords>
42+
# <TimeCreated SystemTime="2020-10-09 18:09:40.2437686" />
43+
# <EventRecordID>266790034</EventRecordID>
44+
# <Correlation />
45+
# <Execution ProcessID="679" ThreadID="123" />
46+
# <Channel>Security</Channel>
47+
# <Computer>HOSTNAME.domain.com</Computer>
48+
# <Security />
49+
# </System>
50+
# <EventData></EventData>
51+
#</Event>

0 commit comments

Comments
 (0)