mirror of
https://github.com/microsoft/krabsetw
synced 2026-06-06 16:14:32 +00:00
John U
9863c2cb8a
* [poc] inject schema_locator * Apply suggestions from code review Co-Authored-By: Kyle Reed <kareed@kallanreed.com> * inject schema_locator [C++/CLI] * inject schema_locator into predicate * Update krabs/krabs/schema.hpp Co-Authored-By: Kyle Reed <kareed@kallanreed.com> * updated docs * updated nuspec Co-authored-by: Kyle Reed <kareed@kallanreed.com>
55 lines
2.4 KiB
C++
55 lines
2.4 KiB
C++
// Copyright (c) Microsoft. All rights reserved.
|
|
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
|
|
|
|
// This example shows how to use a UserTrace to the monitor Microsoft-Windows-Security-Auditing events
|
|
// that populate the Security EventLog.
|
|
// This is a special case due to additional security on this provider.
|
|
|
|
#include <iostream>
|
|
#include "..\..\krabs\krabs.hpp"
|
|
#include "examples.h"
|
|
|
|
void user_trace_005::start()
|
|
{
|
|
// While Adminstrator is sufficent to view the Security EventLog,
|
|
// SYSTEM is required for the Microsoft-Windows-Security-Auditing provider.
|
|
char user_name[128] = { 0 };
|
|
DWORD user_name_length = 128;
|
|
if (!GetUserNameA(user_name, &user_name_length) || !strcmp(user_name, "SYSTEM") == 0)
|
|
{
|
|
std::wcout << L"Microsoft-Windows-Security-Auditing can only be traced by SYSTEM" << std::endl;
|
|
return;
|
|
}
|
|
|
|
// Further, only one trace session is allowed for this provider.
|
|
// This session is created by the OS and is called 'EventLog-Security'.
|
|
// We can't stop() this session, but we can open() a handle to it.
|
|
krabs::user_trace trace(L"EventLog-Security");
|
|
krabs::provider<> provider(L"Microsoft-Windows-Security-Auditing");
|
|
|
|
// We also can't modify the flags of the trace session.
|
|
// This will silently fail.
|
|
provider.any((ULONGLONG)-1);
|
|
|
|
// But we can receive events - but only those configured by the audit policy.
|
|
// e.g. to enable event 4703 run -> auditpol /set /subcategory:"Token Right Adjusted Events"
|
|
provider.add_on_event_callback([](const EVENT_RECORD &record, const krabs::trace_context &trace_context) {
|
|
krabs::schema schema(record, trace_context.schema_locator);
|
|
std::wcout << L"Event " << schema.event_id();
|
|
std::wcout << L"(" << schema.event_name() << L") received." << std::endl;
|
|
|
|
if (schema.event_id() == 4703) { // "A user right was adjusted."
|
|
krabs::parser parser(schema);
|
|
std::wstring enabled_privilege_list = parser.parse<std::wstring>(L"EnabledPrivilegeList");
|
|
std::wstring disabled_privilege_list = parser.parse<std::wstring>(L"DisabledPrivilegeList");
|
|
|
|
std::wcout << L"\tEnabledPrivilegeList=" << enabled_privilege_list << std::endl;
|
|
std::wcout << L"\tDisabledPrivilegeList=" << disabled_privilege_list << std::endl;
|
|
}
|
|
});
|
|
|
|
trace.enable(provider);
|
|
|
|
trace.start();
|
|
}
|