Hello,
We're observing a logs coming from a windows machine for powersehel command execution, but the command is not logged in Qradar.
Any hint on this one?
<13>Jun 01 13:28:49 <removed> AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-PowerShell/Operational PluginVersion=7.3.0.41 Source=Microsoft-Windows-PowerShell Computer=<removed> OriginatingComputer=<removed>
User=SYSTEM Domain=NT AUTHORITY
EventID=4103
EventIDCode=4103
EventType=4
EventCategory=106
RecordNumber=165509
TimeGenerated=1622550252
TimeWritten=1622550252
Level=Informational Keywords=0
Task=ExecutePipeline
Opcode=20
Message=CommandInvocation(Add-Type): "Add-Type" ParameterBinding(Add-Type): name="TypeDefinition"; value="
namespace AuditEventPolicy
{
using System;
using System.Runtime.InteropServices;
public static class AuditEventPolicy
{
[StructLayout(LayoutKind.Sequential)]
internal struct LSA_UNICODE_STRING
{
public UInt16 Length;
public UInt16 MaximumLength;
public IntPtr Buffer;
public void SetTo(string str)
{
Buffer = Marshal.StringToHGlobalUni(str);
Length = (UInt16)(str.Length * System.Text.UnicodeEncoding.CharSize);
MaximumLength = (UInt16)(Length + System.Text.UnicodeEncoding.CharSize);
//Console.WriteLine("SetTo: {2} ({3}) Length: {0} Max: {1}", Length, MaximumLength, str, str.Length);
}
public override string ToString()
{
string str = Marshal.PtrToStringUni(Buffer, Length/System.Text.UnicodeEncoding.CharSize);
//Console.WriteLine("ToString: {2} ({3}) Length: {0} Max: {1}", Length, MaximumLength, str, str.Length);
return str;
}
public void Clean()
{
//Console.WriteLine("Clean Length: {0} Max: {1}", Length, MaximumLength);
if (Buffer != IntPtr.Zero)
Marshal.FreeHGlobal(Buffer);
Buffer = IntPtr.Zero;
Length = 0;
MaximumLength = 0;
}
};
[StructLayout(LayoutKind.Sequential)]
internal struct LSA_OBJECT_ATTRIBUTES
{
public int Length;
public IntPtr RootDirectory;
public LSA_UNICODE_STRING ObjectName;
public UInt32 Attributes;
public IntPtr SecurityDescriptor;
public IntPtr SecurityQualityOfService;
};
internal enum LSA_AccessPolicy : long
{
POLICY_VIEW_LOCAL_INFORMATION = 0x00000001L,
POLICY_VIEW_AUDIT_INFORMATION = 0x00000002L,
POLICY_GET_PRIVATE_INFORMATION = 0x00000004L,
POLICY_TRUST_ADMIN = 0x00000008L,
POLICY_CREATE_ACCOUNT = 0x00000010L,
POLICY_CREATE_SECRET = 0x00000020L,
POLICY_CREATE_PRIVILEGE = 0x00000040L,
POLICY_SET_DEFAULT_QUOTA_LIMITS = 0x00000080L,
POLICY_SET_AUDIT_REQUIREMENTS = 0x00000100L,
POLICY_AUDIT_LOG_ADMIN = 0x00000200L,
POLICY_SERVER_ADMIN = 0x00000400L,
POLICY_LOOKUP_NAMES = 0x00000800L,
POLICY_NOTIFICATION = 0x00001000L
};
internal enum POLICY_INFORMATION_CLASS
{
PolicyAuditLogInformation = 1,
PolicyAuditEventsInformation,
PolicyPrimaryDomainInformation,
PolicyPdAccountInformation,
PolicyAccountDomainInformation,
PolicyLsaServerRoleInformation,
PolicyReplicaSourceInformation,
PolicyDefaultQuo
#QRadar#Support#SupportMigration