Skip to content

Commit 518d8c4

Browse files
jiushilljiushill
authored
Add files via upload
1 parent 592ab97 commit 518d8c4

1 file changed

Lines changed: 35 additions & 12 deletions

File tree

‎Windows系统安全事件应急响应/modes/windows_log.py‎

Lines changed: 35 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -23,14 +23,29 @@ def get_windows_login():
2323
elif i=='Windows PowerShell.evtx':
2424
log_dict['powershell']='C:\\Windows\\System32\\winevt\\Logs\\'+i
2525

26-
for y in log_dict.keys():
27-
print('[+] windows日志:{}'.format(y))
28-
with open(log_dict[y],'r') as f:
29-
with contextlib.closing(mmap.mmap(f.fileno(),0,access=mmap.ACCESS_READ)) as buf: #内存映射处理
30-
fh=FileHeader(buf,0) #将二进制数据变成可视化xmla
31-
a=evtx_file_xml_view(fh)
32-
for xml,rec in a:
33-
get_id(xml,conf.config.id)
26+
if conf.config.login_name=='':
27+
print('[+] 没有设置日志过滤，默认读取全部日志')
28+
for y in log_dict.keys():
29+
if conf.config.login_id != '':
30+
print('[+] 启用日志过滤')
31+
print('[+] windows日志:{}'.format(y))
32+
with open(log_dict[y],'r') as f:
33+
with contextlib.closing(mmap.mmap(f.fileno(),0,access=mmap.ACCESS_READ)) as buf: #内存映射处理
34+
fh=FileHeader(buf,0) #将二进制数据变成可视化xml
35+
a=evtx_file_xml_view(fh)
36+
for xml,rec in a:
37+
get_id(xml,conf.config.id)
38+
else:
39+
print('[+] 设置了日志过滤，只读日志:{}'.format(conf.config.login_name))
40+
if conf.config.login_id != '':
41+
print('[+] 启用日志过滤')
42+
print('[+] windows日志:{}'.format(conf.config.login_name))
43+
with open(log_dict[conf.config.login_name], 'r') as f:
44+
with contextlib.closing(mmap.mmap(f.fileno(), 0, access=mmap.ACCESS_READ)) as buf: # 内存映射处理
45+
fh = FileHeader(buf, 0) # 将二进制数据变成可视化xml
46+
a = evtx_file_xml_view(fh)
47+
for xml, rec in a:
48+
get_id(xml, conf.config.id)
3449

3550
def get_id(xml,id):
3651
global EventData
@@ -46,8 +61,16 @@ def get_id(xml,id):
4661
eventid=str(ids[s]).replace('<EventID Qualifiers="">','').replace('</EventID>','')
4762
event_time=str(times[s]).replace('<TimeCreated SystemTime=','').replace('"','').replace('>','')
4863
data = 'ID:{} 时间:{} EventData:{}'.format(eventid, event_time,EventData)
49-
if eventid in id:
50-
data = 'ID:{} 时间:{} 事件:{} EventData:{}'.format(eventid, event_time, id[eventid],EventData)
51-
print(data)
64+
if conf.config.login_id!='':
65+
if eventid==conf.config.login_id:
66+
if eventid in id:
67+
data = 'ID:{} 时间:{} 事件:{} EventData:{}'.format(eventid, event_time, id[eventid], EventData)
68+
print(data)
69+
else:
70+
print(data)
5271
else:
53-
print(data)
72+
if eventid in id:
73+
data = 'ID:{} 时间:{} 事件:{} EventData:{}'.format(eventid, event_time, id[eventid],EventData)
74+
print(data)
75+
else:
76+
print(data)

0 commit comments

Comments
 (0)