Windows 7: Difference between revisions
Jump to navigation
Jump to search
Created page with "=WMI Pull Event Logs= *Install (http://www.orvant.com/packages/) libwmiclient1_1.3.14-3_amd64.deb libwmiclient1-dev_1.3.14-3_amd64.deb wmi-client_1.3.14-3_amd64.deb *Enable..." |
|||
| Line 8: | Line 8: | ||
./winexe-static --debuglevel=1 -U IT%3c4bhkec //HostnameorIP "wevtutil cl Security" | ./winexe-static --debuglevel=1 -U IT%3c4bhkec //HostnameorIP "wevtutil cl Security" | ||
awk 'NR==FNR { a[$0]; next } !($0 in a)' whitelist checklist | awk 'NR==FNR { a[$0]; next } !($0 in a)' whitelist checklist | ||
==Notes== | |||
*http://www.enviris.com/blog/7-how-to-enable-wmi-on-windows-7.aspx | |||
*http://msdn.microsoft.com/en-us/library/aa394593%28v=vs.85%29.aspx | |||
nett localgroup add | |||
*https://social.technet.microsoft.com/Forums/sharepoint/en-US/0112535c-9b2c-4f9b-96d6-85cff585b20b/the-process-does-not-possess-the-sesecurityprivilege-privilege-which-is-required-for-this?forum=sharepointadminlegacy | |||
*http://community.zenoss.org/docs/DOC-4517 | |||
*http://www.forensicswiki.org/wiki/Windows_Event_Log_%28EVT%29 | |||
*http://lifehacker.com/5275652/shut-down-your-windows-pc-remotely-from-linux | |||
net rpc | |||
*http://community.zenoss.org/message/48714 | |||
*http://technet.microsoft.com/en-us/library/cc722318.aspx | |||
*https://sourceforge.net/p/winexe/winexe-waf/ci/master/tree/ | |||
*https://pzolee.blogs.balabit.com/2010/09/wmi-client-for-linux/ | |||
Revision as of 17:15, 1 November 2013
WMI Pull Event Logs
- Install (http://www.orvant.com/packages/) libwmiclient1_1.3.14-3_amd64.deb libwmiclient1-dev_1.3.14-3_amd64.deb wmi-client_1.3.14-3_amd64.deb
- Enable WMI Through Firewall on Windows
wmic -U DOMAIN/USERNAME%PASSWORD //HostnameorIP "Select * from Win32_NTLogEvent Where LogFile='Security'" | grep .*\.exe|grep 'New Process Name' > output.temp
sed 's/\sNew Process Name:\s//g' output.temp
cat output.temp | sed 's/\sNew Process Name:\s//g' | sort | uniq
./winexe-static --debuglevel=1 -U IT%3c4bhkec //HostnameorIP "wevtutil cl Security"
awk 'NR==FNR { a[$0]; next } !($0 in a)' whitelist checklist
Notes
- http://www.enviris.com/blog/7-how-to-enable-wmi-on-windows-7.aspx
- http://msdn.microsoft.com/en-us/library/aa394593%28v=vs.85%29.aspx
nett localgroup add
- https://social.technet.microsoft.com/Forums/sharepoint/en-US/0112535c-9b2c-4f9b-96d6-85cff585b20b/the-process-does-not-possess-the-sesecurityprivilege-privilege-which-is-required-for-this?forum=sharepointadminlegacy
- http://community.zenoss.org/docs/DOC-4517
- http://www.forensicswiki.org/wiki/Windows_Event_Log_%28EVT%29
- http://lifehacker.com/5275652/shut-down-your-windows-pc-remotely-from-linux
net rpc