Windows 7
WMI Pull Event Logs
- Install (http://www.orvant.com/packages/) libwmiclient1_1.3.14-3_amd64.deb libwmiclient1-dev_1.3.14-3_amd64.deb wmi-client_1.3.14-3_amd64.deb
- Enable WMI Through Firewall on Windows
wmic -U DOMAIN/USERNAME%PASSWORD //HostnameorIP "Select * from Win32_NTLogEvent Where LogFile='Security'" | grep .*\.exe|grep 'New Process Name' > output.temp
sed 's/\sNew Process Name:\s//g' output.temp
cat output.temp | sed 's/\sNew Process Name:\s//g' | sort | uniq
./winexe-static --debuglevel=1 -U IT%3c4bhkec //HostnameorIP "wevtutil cl Security"
awk 'NR==FNR { a[$0]; next } !($0 in a)' whitelist checklist
Notes
- http://www.enviris.com/blog/7-how-to-enable-wmi-on-windows-7.aspx
- http://msdn.microsoft.com/en-us/library/aa394593%28v=vs.85%29.aspx
nett localgroup add
- https://social.technet.microsoft.com/Forums/sharepoint/en-US/0112535c-9b2c-4f9b-96d6-85cff585b20b/the-process-does-not-possess-the-sesecurityprivilege-privilege-which-is-required-for-this?forum=sharepointadminlegacy
- http://community.zenoss.org/docs/DOC-4517
- http://www.forensicswiki.org/wiki/Windows_Event_Log_%28EVT%29
- http://lifehacker.com/5275652/shut-down-your-windows-pc-remotely-from-linux
net rpc