Event Logs Windows

# Échecs de connexion des dernières 24h
Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4625
    StartTime = (Get-Date).AddHours(-24)
} | Select-Object TimeCreated, 
    @{N='User';     E={$_.Properties[5].Value}},
    @{N='Source IP';E={$_.Properties[19].Value}},
    @{N='Reason';   E={$_.Properties[8].Value}}
# Connexions réussies (hors comptes machine $)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 100 |
    Where-Object { $_.Properties[5].Value -notlike '*$' } |
    Select-Object TimeCreated,
        @{N='User';    E={$_.Properties[5].Value}},
        @{N='LogonType';E={$_.Properties[8].Value}},
        @{N='Source IP';E={$_.Properties[18].Value}}
# Services installés (potentiel malware)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} |
    Select-Object TimeCreated,
        @{N='ServiceName';E={$_.Properties[0].Value}},
        @{N='ImagePath';  E={$_.Properties[1].Value}}
# Journal effacé — alerte critique
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} |
    Select-Object TimeCreated, Message

# Lister les journaux disponibles
wevtutil el | Select-String "Security|System|Application"
# Infos sur un journal
wevtutil gl Security
# Requête simple
wevtutil qe Security /q:"*[System[EventID=4625]]" /f:text /c:10
# Requête XPath avec filtre date
wevtutil qe Security /q:"*[System[EventID=4625 and TimeCreated[@SystemTime>='2025-05-01T00:00:00']]]" /f:text
# Exporter un journal
wevtutil epl Security C:\Logs\security-backup.evtx
# Effacer un journal (admin requis)
wevtutil cl Application

<!-- Tous les échecs de connexion sur les 7 derniers jours -->
<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[EventID=4625 and TimeCreated[timediff(@SystemTime) &lt;= 604800000]]]
    </Select>
  </Query>
</QueryList>
<!-- Services créés ou modifiés -->
<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*[System[EventID=7045 or EventID=7040]]</Select>
  </Query>
</QueryList>

# Windows Event Forwarding (WEF) — configurer un collector
winrm quickconfig -q
# Sur les sources, configurer la subscription
# (via GPO ou wecutil)
wecutil cs subscription.xml
# Vérifier les subscriptions actives
wecutil es
wecutil gs "Nom-Subscription"