[FilterXPath]的搜索结果

...WinEvent中的FilterXPath过日志进行筛选，格式打印 删除操作码为0x10000，可对其进行筛选 二、文件审核设置 2.1 开启文件系统审核功能 secpol.msc Advanced Audit Policy Configuration Object Access Audit File System [x] Configure the following audit events: [x] Success [x] Failure 2.2 建立共享文件夹 Folder Properties Sharing Choose people to share with Everyone 2.3 设置文件夹审核的用户组 Folder Properties Security Advanced Auditing Add user 2.4 设置日志路径及大小 Event Viewer Windows Logs Security Log Properties Log Path: E:\FileLog\Security.evtx Maximum log size(KB): 512000 [x] Archive the log when full,do not overwrite events 三、方法 筛选事件ID为4460日志 PS C:\Windows\system32> Get-WinEvent -LogName Security -FilterXPath "[System[EventID=4660]]"ProviderName: Microsoft-Windows-Security-AuditingTimeCreated Id LevelDisplayName Message----------- -- ---------------- -------5/22/2018 10:01:37 AM 4660 Information An object was deleted....5/22/2018 9:03:11 AM 4660 Information An object was deleted.... 筛选文件删除日志 PS C:\Windows\system32> Get-WinEvent -LogName "Security" -FilterXPath "[EventData[Data[@Name='AccessMask']='0x10000']]"ProviderName: Microsoft-Windows-Security-AuditingTimeCreated Id LevelDisplayName Message----------- -- ---------------- -------5/22/2018 10:01:37 AM 4663 Information An attempt was made to access an object....5/22/2018 9:03:11 AM 4663 Information An attempt was made to access an object.... 筛选指定用户文件删除日志 PS C:\Windows\system32> Get-WinEvent -LogName "Security" -FilterXPath "[EventData[Data[@Name='AccessMask']='0x10000']] and [EventData[Data[@Name='SubjectUserName']='lxy']]"ProviderName: Microsoft-Windows-Security-AuditingTimeCreated Id LevelDisplayName Message----------- -- ---------------- -------5/22/2018 9:03:11 AM 4663 Information An attempt was made to access an object.... 以变量方式筛选指定用户文件删除日志 PS C:\Windows\system32> $AccessMask='0x10000'PS C:\Windows\system32> $UserName='lxy'PS C:\Windows\system32> Get-WinEvent -LogName "Security" -FilterXPath "[EventData[Data[@Name='AccessMask']='$AccessMask']] and [EventData[Data[@Name='SubjectUserName']='$UserName']]"ProviderName: Microsoft-Windows-Security-AuditingTimeCreated Id LevelDisplayName Message----------- -- ---------------- -------5/22/2018 9:03:11 AM 4663 Information An attempt was made to access an object.... 从保存的文件筛选文件删除日志 PS C:\Users\F2844290> Get-WinEvent -Path 'C:\Users\F2844290\Desktop\SaveSec.evtx' -FilterXPath "[EventData[Data[@Name='AccessMask']='0x10000']]"PS C:\Windows\system32> $AccessMask='0x10000' 筛选10分钟内发生的安全性日志 XML中时间计算单位为ms，10minute=60 10 1000=600000 PS C:\Windows\system32> Get-WinEvent -LogName Security -FilterXPath "[System[TimeCreated[timediff(@SystemTime) < 600000]]]"ProviderName: Microsoft-Windows-Security-AuditingTimeCreated Id LevelDisplayName Message----------- -- ---------------- -------5/22/2018 4:11:30 PM 4663 Information An attempt was made to access an object....5/22/2018 4:11:30 PM 4663 Information An attempt was made to access an object....5/22/2018 4:11:30 PM 4663 Information An attempt was made to access an object....5/22/2018 4:11:30 PM 4663 Information An attempt was made to access an object.... 其它筛选方法 若有语法不明之处，可参考日志管理器中筛选当前日志的XML方法。 删除超过60天的存档日志并记录 Get-ChildItem E:\FileLog\Archive-Security- | Where-Object {if(( (get-date) - $_.CreationTime).TotalDays -gt 60 ){Remove-Item $_.FullName -ForceWrite-Output "$(Get-Date -UFormat "%Y/%m%d")t$_.Name" >>D:\RoMove-Archive-Logs.txt} } 四、其它文件 文件删除日志结构 Log Name: SecuritySource: Microsoft-Windows-Security-AuditingDate: 5/22/2018 9:03:11 AMEvent ID: 4663Task Category: File SystemLevel: InformationKeywords: Audit SuccessUser: N/AComputer: IDX-ST-05Description:An attempt was made to access an object.Subject:Security ID: IDX-ST-05\lxyAccount Name: lxyAccount Domain: IDX-ST-05Logon ID: 0x2ed3b8Object:Object Server: SecurityObject Type: FileObject Name: C:\Data\net.txtHandle ID: 0x444Process Information:Process ID: 0x4Process Name: Access Request Information:Accesses: DELETEAccess Mask: 0x10000Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /><EventID>4663</EventID><Version>0</Version><Level>0</Level><Task>12800</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2018-05-22T01:03:11.876720000Z" /><EventRecordID>1514</EventRecordID><Correlation /><Execution ProcessID="4" ThreadID="72" /><Channel>Security</Channel><Computer>IDX-ST-05</Computer><Security /></System><EventData><Data Name="SubjectUserSid">S-1-5-21-1815651738-4066643265-3072818021-1004</Data><Data Name="SubjectUserName">lxy</Data><Data Name="SubjectDomainName">IDX-ST-05</Data><Data Name="SubjectLogonId">0x2ed3b8</Data><Data Name="ObjectServer">Security</Data><Data Name="ObjectType">File</Data><Data Name="ObjectName">C:\Data\net.txt</Data><Data Name="HandleId">0x444</Data><Data Name="AccessList">%%1537</Data><Data Name="AccessMask">0x10000</Data><Data Name="ProcessId">0x4</Data><Data Name="ProcessName"></Data></EventData></Event> 文件操作码表 File ReadAccesses: ReadData (or ListDirectory)AccessMask: 0x1File WriteAccesses: WriteData (or AddFile)AccessMask: 0x2File DeleteAccesses: DELETEAccessMask: 0x10000File RenameAccesses: DELETEAccessMask: 0x10000File CopyAccesses: ReadData (or ListDirectory)AccessMask: 0x1File Permissions ChangeAccesses: WRITE_DACAccessMask: 0x40000File Ownership ChangeAccesses: WRITE_OWNERAccessMask: 0x80000 转载于:https://blog.51cto.com/linxy/2119150 本篇文章为转载内容。原文链接：https://blog.csdn.net/weixin_34112900/article/details/92532120。 该文由互联网用户投稿提供，文中观点代表作者本人意见，并不代表本站的立场。 作为信息平台，本站仅提供文章转载服务，并不拥有其所有权，也不对文章内容的真实性、准确性和合法性承担责任。 如发现本文存在侵权、违法、违规或事实不符的情况，请及时联系我们，我们将第一时间进行核实并删除相应内容。