Matt Hastings
f0611ac6fe
* inital commit * wc * wc * wc * wc * wc * wc * moving to module * restructing dirs * switch to module * moving lib into EventTrace module * add stop session * WIP commit * rewording * Add support for multiple ETW providers in single session * working commit * Deleting old folders and adding new functions * Adding gitignore * Starting to add pester tests * Adding more pester testing * rearrange get-etwsession function * small change to etwsession function * Add more pester testing * Updating readme * Rearranged session enumeration functions * Adds provider directory and some notes * Add in keyword object * Fix failing pester test * Fix start-session to accept object * Pester tests now invoke full etw session * small change to tests * Get-ProviderKeywords to Get-ETWProviderKeywords * First parser commit * Small update to process parser * Ignoring etl files * Adding Providers and notes on DNS * Adds DNS Event Ids and Descriptions * Adding more DNS info * Adds some PoC work for parsing DNS events to objects * Adds event parsing, but there's a bug * Add parser for kernel process * Updating function docs * Remove failing test * Starting to add network events * Adding network connection support * Small change to docs * Add Start-ETWForensicCollection function * Minor spelling fix * adding more notes to kernel process events * Adding provider exists check * Adds .DS_Store * Moves synopsis inside function * starting kernel file * Adding in file event parser * Fixing bug in process id parsing * Add logic for process reuse * Fix bug in process reuse code * Adding DLLs for kernel session * Adds DNS to Start-ETWForensicCollection * Fixing image load bug with process end time * Adding DNS to etwforensic collection and log parsing * Updating DNS parsing * Fixing bug in filtering and dns * Removing debug strings * Add in EnableVerbosity option to etwforensic func * Adding in thread start/stop events * Add in thread keyword to forensic collection func * Major reword to support thread tracking * Fixing bug in DNS tracking * fixing minor bug in thread net connections * Updating readme * small change to readme * Add in kernel session support to capture command line * Updating kernel session parsing code * Updating readme * Fixing path and infinite loop bugs * Add new write-log function for console logging * Adding support for different logging levels * fixing a bunch of bugs * Adding more example in the readme * Renaming module * Adding files for rename * Final rename commit * Adding demo content * Updating readme * More Readme updates * Readme changes * Last readme updates for the night * Adds dcdemo files * Fixing small thread parsing bug * Updating demo.txt * Adding new demo.xml * Minor tweaks to demo.txt * More demo updates * Demo all the things * Adding powershell logging * Adds compressed etl files * Updating demo materials * Demo updates * Demo tweaks * other minor demo tweaks * Adding graph function
3.5 KiB
Executable File
PSWasp
PSWasp is a PowerShell project that enables users to easily interact with Event Tracing for Windows (ETW); specifically designed for forensic collection and analysis. Originally intended as a Windows debugging utility, ETW has evolved to support a myriad of diverse use cases. Modern Windows operating systems (8.1, 2012, Win10, and Server 2016) ship with hundreds of application and kernel layer ETW providers, any of which could capture and log critical information during an investigation. PSalandar enables users to easily start and capture events from one or many ETW providers.
Requirements
- .NET 4.0 or greater
- PowerShell 3.0 or greater
External Dependencies
- PSWasp uses and ships a copy of the Microsoft's TraceEvent DLL License
Examples
List all ETW providers on a System
Get-ETWProvider
List all active ETW sessions
Get-ETWSessionNames
Enumerate details from active ETW sessions
Warning: Enumerating session details has been found to inadvertently stop ETW sessions in some cases.
Get-ETWSessionDetails
Start Forensic Collection with PSWasp
Create provider object
Defines the provider name or GUID, filtering keywords, or other filtering options
This example configures the Micorsoft-Windows-Kernel-Process provider and only enables the Process, Image, and Thread keywords
$ProviderConfig = New-ETWProviderConfig
$ProviderConfig.Name = 'Microsoft-Windows-Kernel-Process'
$ProcessRegex = '_PROCESS$|_IMAGE$|_THREAD$'
Get-ETWProviderKeywords -ProviderName $ProviderConfig.Name |
Where-Object { $_.Name -match $ProcessRegex } |
ForEach-Object { $ProviderConfig.Keywords += $_ }
Start ETW Session
Start-ETWSession -ProviderConfig $ProviderConfig -SessionName <unique session name> -OutputFile <path to etl file>
Stop ETW Session
Stop-ETWSession -SessionName <previously provided unique session name>
Parse any .ETL Log
Get-WinEvent -Path <path to ETL file> -Oldest
Start ETW forensic session with kernel session
Kernel session is an optional argument that starts a unique kernel session. Enabling this session allows for the capture of process command line arguments.
Note: Kernel session is enabled by default use -DisableKernelProvider to disable
Start-ETWForensicCollection -SessionName <unique session name> -OutputFile <path to etl file>
Parse .ETL file generated from Start-ETWForensicCollection
Will automatically identify and parse any kernel session output files from the same session
Get-ETWForensicEventLog -Path <path to ETL file>
Useful links
https://github.com/Microsoft/dotnetsamples/blob/master/Microsoft.Diagnostics.Tracing/TraceEvent/docs/TraceEvent.md https://blogs.msdn.microsoft.com/vancem/2012/12/20/using-tracesource-to-log-etw-data-to-a-file/ https://msdn.microsoft.com/en-us/library/windows/desktop/aa363668(v=vs.85).aspx https://github.com/Microsoft/perfview/blob/master/src/TraceEvent/TraceEventSession.cs https://blogs.technet.microsoft.com/office365security/hidden-treasure-intrusion-detection-with-etw-part-1/ https://blogs.technet.microsoft.com/office365security/hidden-treasure-intrusion-detection-with-etw-part-2/