admin/itm4n-PrivescCheck
1
0
Fork 0
mirror of https://github.com/itm4n/PrivescCheck synced 2026-06-08 14:54:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Get-EventLog with Get-WinEvent to avoid unhandled errors

Browse Source
This commit is contained in:
itm4n
2026-01-30 09:49:50 +01:00
parent dc80e357ce
commit 2147cec9bc
4 changed files with 31 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build/Seed.txt
+1 -1
View File
@@ -1 +1 @@
333376526
1603595244
info/CHANGELOG.md
+6
View File
@@ -1,5 +1,11 @@
# Changelog
## 2026-01-30
### Fixed
- Replace Get-EventLog with Get-WinEvent to avoid unhandled errors generated by the former.
## 2026-01-29
### Added
src/check/Credentials.ps1
+13 -18
View File
@@ -810,30 +810,25 @@ function Invoke-ScomRunAsAccountCredentialCheck {
process {
$AllResults = @()
$Accounts = @()
$OperationsManagerEventLogs = Get-WinEvent -LogName "Operations Manager" -ErrorAction SilentlyContinue
try {
$OperationsManagerEventLogs = Get-EventLog -LogName "Operations Manager"
$Accounts = @()
foreach ($OperationsManagerEventLog in $OperationsManagerEventLogs) {
foreach ($OperationsManagerEventLog in $OperationsManagerEventLogs) {
if ($OperationsManagerEventLog.Message -match ".*on the RunAs account (.+) for management group") {
if ($OperationsManagerEventLog.Message -match ".*on the RunAs account (.+) for management group") {
$AccountName = $Matches[1]
if ($Accounts -contains $AccountName) { continue }
$Accounts += $AccountName
$AccountName = $Matches[1]
if ($Accounts -contains $AccountName) { continue }
$Accounts += $AccountName
$Result = New-Object -TypeName PSObject
$Result | Add-Member -MemberType "NoteProperty" -Name "EventID" -Value $OperationsManagerEventLog.EventID
$Result | Add-Member -MemberType "NoteProperty" -Name "TimeGenerated" -Value $(Convert-DateToString -Date $OperationsManagerEventLog.TimeGenerated -IncludeTime)
$Result | Add-Member -MemberType "NoteProperty" -Name "Account" -Value $AccountName
$Result | Add-Member -MemberType "NoteProperty" -Name "Message" -Value $OperationsManagerEventLog.Message
$AllResults += $Result
}
$Result = New-Object -TypeName PSObject
$Result | Add-Member -MemberType "NoteProperty" -Name "Id" -Value $OperationsManagerEventLog.Id
$Result | Add-Member -MemberType "NoteProperty" -Name "TimeCreated" -Value $(Convert-DateToString -Date $OperationsManagerEventLog.TimeCreated -IncludeTime)
$Result | Add-Member -MemberType "NoteProperty" -Name "Account" -Value $AccountName
$Result | Add-Member -MemberType "NoteProperty" -Name "Message" -Value $OperationsManagerEventLog.Message
$AllResults += $Result
}
}
catch {
Write-Verbose "Event log 'Operations Manager' not found."
}
$CheckResult = New-Object -TypeName PSObject
$CheckResult | Add-Member -MemberType "NoteProperty" -Name "Result" -Value $AllResults
src/check/Misc.ps1
+11 -19
View File
@@ -110,40 +110,32 @@ function Invoke-SystemStartupHistoryCheck {
[UInt32] $BaseSeverity
)
$Results = @()
process {
$Results = @()
try {
$TimeSpanInDays = 31
$SystemStartupHistoryResult = New-Object -TypeName System.Collections.ArrayList
$SystemStartupHistoryResult = @()
$StartDate = (Get-Date).AddDays(-$TimeSpanInDays)
$EndDate = Get-Date
$StartupEvents = Get-EventLog -LogName "System" -EntryType "Information" -After $StartDate -Before $EndDate | Where-Object { $_.EventID -eq 6005 }
$StartupEvents = Get-WinEvent -LogName "System" -ErrorAction SilentlyContinue | Where-Object { ($_.Id -eq 6005) -and ($_.TimeCreated -ge $StartDate) -and ($_.TimeCreated -le $EndDate) }
$EventNumber = 1
foreach ($StartupEvent in $StartupEvents) {
$Result = New-Object -TypeName PSObject
$Result | Add-Member -MemberType "NoteProperty" -Name "Index" -Value $EventNumber
$Result | Add-Member -MemberType "NoteProperty" -Name "Time" -Value "$(Convert-DateToString -Date $StartupEvent.TimeGenerated -IncludeTime)"
[void] $SystemStartupHistoryResult.Add($Result)
$Result | Add-Member -MemberType "NoteProperty" -Name "Time" -Value "$(Convert-DateToString -Date $StartupEvent.TimeCreated -IncludeTime)"
$SystemStartupHistoryResult += $Result
$EventNumber += 1
}
$Results += $SystemStartupHistoryResult | Select-Object -First 10
}
catch {
# We might get an "access denied"
Write-Verbose "Error while querying the Event Log."
}
$Result = New-Object -TypeName PSObject
$Result | Add-Member -MemberType "NoteProperty" -Name "Result" -Value $Results
$Result | Add-Member -MemberType "NoteProperty" -Name "Severity" -Value $(if ($Results) { $BaseSeverity } else { $script:SeverityLevel::None })
$Result
$Result = New-Object -TypeName PSObject
$Result | Add-Member -MemberType "NoteProperty" -Name "Result" -Value $Results
$Result | Add-Member -MemberType "NoteProperty" -Name "Severity" -Value $(if ($Results) { $BaseSeverity } else { $script:SeverityLevel::None })
$Result
}
}
function Invoke-SystemDriveCheck {