RsWindowsThingies

Windows の諸機能…でも Rust で

ツール

listen_mft

エントリの値の変化を監視します。

listen_mft 0.2.0
Matthew Seyer <https://github.com/forensicmatt/RsWindowsThingies>
See the differences in MFT attirbues.

USAGE:
    listen_mft.exe [OPTIONS]

FLAGS:
    -h, --help       Prints help information
    -V, --version    Prints version information

OPTIONS:
    -d, --debug <DEBUG>    Debug level to use. [possible values: Off, Error, Warn, Info, Debug, Trace]
    -f, --file <FILE>      The file to difference.

listen_events

イベントリスナーツールを使用すると、Windows イベントログをリアルタイムで表示できます。

注意：イベントログが追いつくまでに 1 分ほどかかります。これを修正するには、Windows API の実装をさらに進める必要があります。 "Waiting for new events..." というメッセージが表示されると、アクティブにリッスンしていることがわかります。

listen_events 0.3.0
Matthew Seyer <https://github.com/forensicmatt/RsWindowsThingies>

Event listener written in Rust. Output is JSONL.

This tool queries the available list of channels then creates a XPath
query and uses the Windows API to monitor for events on the applicable
channels. Use the print_channels tool to list available channels and
their configurations.

USAGE:
    listen_events.exe [FLAGS] [OPTIONS]

FLAGS:
    -h, --help          Prints help information
    -p, --historical    List historical records along with listening to new changes.
    -V, --version       Prints version information

OPTIONS:
    -c, --channel <CHANNEL>...    Specific Channel to listen to.
    -d, --debug <DEBUG>           Debug level to use. [possible values: Off, Error, Warn, Info, Debug, Trace]
        --domain <DOMAIN>         The domain to which the user account belongs. Optional.
    -f, --format <FORMAT>         Output format to use. [defaults to jsonl] [possible values: xml, jsonl]
        --server <SERVER>         The name of the remote computer to connect to.
        --sflag <SFLAG>           The authentication method to use to authenticate the user when connecting to the
                                  remote computer. [possible values: Default, Negotiate, Kerberos, NTLM]
        --user <USER>             The user name to use to connect to the remote computer.

print_channels

print_channels ツールを使用すると、チャネルとその設定をダンプできます。これにより、システムで利用可能なチャネルとその構成設定を特定するのに役立ちます。これは主に、イベント監視ツールで監視するチャネルを特定するために使用されるライブラリコンポーネントのインターフェースです。

使い方

print_channels 0.2.0
Matthew Seyer <https://github.com/forensicmatt/RsWindowsThingies>
Print Channel Propperties.

USAGE:
    print_channels.exe [OPTIONS]

FLAGS:
    -h, --help       Prints help information
    -V, --version    Prints version information

OPTIONS:
    -d, --debug <DEBUG>      Debug level to use. [possible values: Off, Error, Warn, Info, Debug, Trace]
        --domain <DOMAIN>    The domain to which the user account belongs. Optional.
    -f, --format <FORMAT>    Output format. (defaults to text) [possible values: text, jsonl]
        --server <SERVER>    The name of the remote computer to connect to.
        --sflag <SFLAG>      The authentication method to use to authenticate the user when connecting to the remote
                             computer. [possible values: Default, Negotiate, Kerberos, NTLM]
        --user <USER>        The user name to use to connect to the remote computer.

例

テキスト出力の例です。（jsonl でも出力できます）

========================================================
Channel: Windows PowerShell
========================================================
EvtChannelConfigAccess: "O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0x2;;;S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)"
EvtChannelConfigClassicEventlog: true
EvtChannelConfigEnabled: true
EvtChannelConfigIsolation: 0
EvtChannelConfigOwningPublisher: ""
EvtChannelConfigType: 0
EvtChannelLoggingConfigAutoBackup: false
EvtChannelLoggingConfigLogFilePath: "%SystemRoot%\\System32\\Winevt\\Logs\\Windows PowerShell.evtx"
EvtChannelLoggingConfigMaxSize: 15728640
EvtChannelLoggingConfigRetention: false
EvtChannelPublishingConfigBufferSize: 64
EvtChannelPublishingConfigClockType: 0
EvtChannelPublishingConfigControlGuid: null
EvtChannelPublishingConfigFileMax: 1
EvtChannelPublishingConfigKeywords: null
EvtChannelPublishingConfigLatency: 1000
EvtChannelPublishingConfigLevel: null
EvtChannelPublishingConfigMaxBuffers: 64
EvtChannelPublishingConfigMinBuffers: 0
EvtChannelPublishingConfigSidType: 1

print_publishers

print_publishers ツールを使用すると、パブリッシャーとその設定をダンプできます。これにより、システムで利用可能なパブリッシャーとその構成設定を特定するのに役立ちます。これは主に、監視目的で存在するプロバイダーを特定するために使用されるライブラリコンポーネントのインターフェースです。

使い方

print_publishers 0.1.0
Matthew Seyer <https://github.com/forensicmatt/RsWindowsThingies>
Print Publisher Propperties.

USAGE:
    print_publishers.exe [OPTIONS]

FLAGS:
    -h, --help       Prints help information
    -V, --version    Prints version information

OPTIONS:
    -d, --debug <DEBUG>             Debug level to use. [possible values: Off, Error, Warn, Info, Debug, Trace]
        --domain <DOMAIN>           The domain to which the user account belongs. Optional.
    -f, --format <FORMAT>           Output format. (defaults to text) [possible values: text, jsonl]
    -p, --provider <PROVIDER>...    Specific Provider.
        --server <SERVER>           The name of the remote computer to connect to.
        --sflag <SFLAG>             The authentication method to use to authenticate the user when connecting to the
                                    remote computer. [possible values: Default, Negotiate, Kerberos, NTLM]
        --user <USER>               The user name to use to connect to the remote computer.

例

テキスト出力の例です。（jsonl でも出力できます）

----------------------------------------------
Publisher: Microsoft-Windows-Kernel-Process
GUID: 22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716
----------------------------------------------
Resource File Path: C:\WINDOWS\system32\Microsoft-Windows-System-Events.dll
Parameter File Path: Null
Message File Path: C:\WINDOWS\system32\Microsoft-Windows-System-Events.dll
Help Link: https://go.microsoft.com/fwlink/events.asp?CoName=Microsoft%20Corporation&ProdName=Microsoft%c2%ae%20Windows%c2%ae%20Operating%20System&ProdVer=10.0.18362.1&FileName=Microsoft-Windows-System-Events.dll&FileVer=10.0.18362.1
Publisher Message: Microsoft-Windows-Kernel-Process
--- Channels ---
0000000000000000: Microsoft-Windows-Kernel-Process/Analytic 
--- Keywords ---
0000000000000010: WINEVENT_KEYWORD_PROCESS 
0000000000000020: WINEVENT_KEYWORD_THREAD 
0000000000000040: WINEVENT_KEYWORD_IMAGE 
0000000000000080: WINEVENT_KEYWORD_CPU_PRIORITY 
0000000000000100: WINEVENT_KEYWORD_OTHER_PRIORITY 
0000000000000200: WINEVENT_KEYWORD_PROCESS_FREEZE 
0000000000000400: WINEVENT_KEYWORD_JOB 
0000000000000800: WINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS 
0000000000001000: WINEVENT_KEYWORD_JOB_IO 
0000000000002000: WINEVENT_KEYWORD_WORK_ON_BEHALF 
0000000000004000: WINEVENT_KEYWORD_JOB_SILO 
--- Operations ---
0000000000000000: win:Info [Info]
0000000000010000: win:Start [Start]
0000000000020000: win:Stop [Stop]
--- Levels ---
0000000000000004: win:Informational [Information]
--- Tasks ---
0000000000000001: ProcessStart 
0000000000000002: ProcessStop 
0000000000000003: ThreadStart 
0000000000000004: ThreadStop 
0000000000000005: ImageLoad 
0000000000000006: ImageUnload 
0000000000000007: CpuBasePriorityChange 
0000000000000008: CpuPriorityChange 
0000000000000009: PagePriorityChange 
000000000000000A: IoPriorityChange 
000000000000000B: ProcessFreeze 
000000000000000D: JobStart 
000000000000000E: JobTerminate 
000000000000000F: ProcessRundown 
0000000000000010: PsDiskIoAttribution 
0000000000000011: PsIoRateControl 
0000000000000012: ThreadWorkOnBehalfUpdate 
0000000000000013: JobServerSiloStart

RsWindowsThingies

人気

RsWindowsThingies

ツール

listen_mft

listen_events

print_channels

使い方

例

print_publishers

使い方

例