forensicmatt/rswindowsthingiesRust 기반 Windows 포렌식 툴킷으로 실시간 MFT 모니터링, 이벤트 로그 스트리밍 및 채널 열거를 지원하며, 라이브 시스템 분석 및 사고 대응을 가능하게 합니다.
Windows Thingies... 하지만 Rust로
항목의 값 변경을 관찰합니다.
listen_mft 0.2.0
Matthew Seyer <https://github.com/forensicmatt/RsWindowsThingies>
See the differences in MFT attirbues.
USAGE:
listen_mft.exe [OPTIONS]
FLAGS:
-h, --help Prints help information
-V, --version Prints version information
OPTIONS:
-d, --debug <DEBUG> Debug level to use. [possible values: Off, Error, Warn, Info, Debug, Trace]
-f, --file <FILE> The file to difference.
이벤트 수신 도구를 사용하면 Windows 이벤트 로그를 실시간으로 볼 수 있습니다.
참고: 이벤트 로그가 따라잡는 데 1분 정도 걸립니다. 이를 해결하려면 Windows API를 더 구현해야 합니다. "Waiting for new events..." 메시지가 나타나면 활성 상태로 수신 중임을 알 수 있습니다.
listen_events 0.3.0
Matthew Seyer <https://github.com/forensicmatt/RsWindowsThingies>
Event listener written in Rust. Output is JSONL.
This tool queries the available list of channels then creates a XPath
query and uses the Windows API to monitor for events on the applicable
channels. Use the print_channels tool to list available channels and
their configurations.
USAGE:
listen_events.exe [FLAGS] [OPTIONS]
FLAGS:
-h, --help Prints help information
-p, --historical List historical records along with listening to new changes.
-V, --version Prints version information
OPTIONS:
-c, --channel <CHANNEL>... Specific Channel to listen to.
-d, --debug <DEBUG> Debug level to use. [possible values: Off, Error, Warn, Info, Debug, Trace]
--domain <DOMAIN> The domain to which the user account belongs. Optional.
-f, --format <FORMAT> Output format to use. [defaults to jsonl] [possible values: xml, jsonl]
--server <SERVER> The name of the remote computer to connect to.
--sflag <SFLAG> The authentication method to use to authenticate the user when connecting to the
remote computer. [possible values: Default, Negotiate, Kerberos, NTLM]
--user <USER> The user name to use to connect to the remote computer.
print_channels 도구를 사용하면 채널과 해당 구성을 덤프할 수 있습니다. 이는 시스템에서 사용 가능한 채널과 구성 설정을 식별하는 데 도움이 됩니다. 주로 이벤트 모니터링 도구에서 모니터링할 채널을 설정하는 데 사용되는 라이브러리 구성 요소의 인터페이스 역할을 합니다.
print_channels 0.2.0
Matthew Seyer <https://github.com/forensicmatt/RsWindowsThingies>
Print Channel Propperties.
USAGE:
print_channels.exe [OPTIONS]
FLAGS:
-h, --help Prints help information
-V, --version Prints version information
OPTIONS:
-d, --debug <DEBUG> Debug level to use. [possible values: Off, Error, Warn, Info, Debug, Trace]
--domain <DOMAIN> The domain to which the user account belongs. Optional.
-f, --format <FORMAT> Output format. (defaults to text) [possible values: text, jsonl]
--server <SERVER> The name of the remote computer to connect to.
--sflag <SFLAG> The authentication method to use to authenticate the user when connecting to the remote
computer. [possible values: Default, Negotiate, Kerberos, NTLM]
--user <USER> The user name to use to connect to the remote computer.
다음은 텍스트 출력의 예시입니다. (jsonl로 출력할 수도 있습니다)
========================================================
Channel: Windows PowerShell
========================================================
EvtChannelConfigAccess: "O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0x2;;;S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)"
EvtChannelConfigClassicEventlog: true
EvtChannelConfigEnabled: true
EvtChannelConfigIsolation: 0
EvtChannelConfigOwningPublisher: ""
EvtChannelConfigType: 0
EvtChannelLoggingConfigAutoBackup: false
EvtChannelLoggingConfigLogFilePath: "%SystemRoot%\\System32\\Winevt\\Logs\\Windows PowerShell.evtx"
EvtChannelLoggingConfigMaxSize: 15728640
EvtChannelLoggingConfigRetention: false
EvtChannelPublishingConfigBufferSize: 64
EvtChannelPublishingConfigClockType: 0
EvtChannelPublishingConfigControlGuid: null
EvtChannelPublishingConfigFileMax: 1
EvtChannelPublishingConfigKeywords: null
EvtChannelPublishingConfigLatency: 1000
EvtChannelPublishingConfigLevel: null
EvtChannelPublishingConfigMaxBuffers: 64
EvtChannelPublishingConfigMinBuffers: 0
EvtChannelPublishingConfigSidType: 1
print_publishers 도구를 사용하면 게시자와 해당 구성을 덤프할 수 있습니다. 이는 시스템에서 사용 가능한 게시자와 구성 설정을 식별하는 데 도움이 됩니다. 주로 모니터링 목적으로 어떤 공급자가 있는지 파악하는 데 사용되는 라이브러리 구성 요소의 인터페이스 역할을 합니다.
print_publishers 0.1.0
Matthew Seyer <https://github.com/forensicmatt/RsWindowsThingies>
Print Publisher Propperties.
USAGE:
print_publishers.exe [OPTIONS]
FLAGS:
-h, --help Prints help information
-V, --version Prints version information
OPTIONS:
-d, --debug <DEBUG> Debug level to use. [possible values: Off, Error, Warn, Info, Debug, Trace]
--domain <DOMAIN> The domain to which the user account belongs. Optional.
-f, --format <FORMAT> Output format. (defaults to text) [possible values: text, jsonl]
-p, --provider <PROVIDER>... Specific Provider.
--server <SERVER> The name of the remote computer to connect to.
--sflag <SFLAG> The authentication method to use to authenticate the user when connecting to the
remote computer. [possible values: Default, Negotiate, Kerberos, NTLM]
--user <USER> The user name to use to connect to the remote computer.
다음은 텍스트 출력의 예시입니다. (jsonl로 출력할 수도 있습니다)
----------------------------------------------
Publisher: Microsoft-Windows-Kernel-Process
GUID: 22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716
----------------------------------------------
Resource File Path: C:\WINDOWS\system32\Microsoft-Windows-System-Events.dll
Parameter File Path: Null
Message File Path: C:\WINDOWS\system32\Microsoft-Windows-System-Events.dll
Help Link: https://go.microsoft.com/fwlink/events.asp?CoName=Microsoft%20Corporation&ProdName=Microsoft%c2%ae%20Windows%c2%ae%20Operating%20System&ProdVer=10.0.18362.1&FileName=Microsoft-Windows-System-Events.dll&FileVer=10.0.18362.1
Publisher Message: Microsoft-Windows-Kernel-Process
--- Channels ---
0000000000000000: Microsoft-Windows-Kernel-Process/Analytic
--- Keywords ---
0000000000000010: WINEVENT_KEYWORD_PROCESS
0000000000000020: WINEVENT_KEYWORD_THREAD
0000000000000040: WINEVENT_KEYWORD_IMAGE
0000000000000080: WINEVENT_KEYWORD_CPU_PRIORITY
0000000000000100: WINEVENT_KEYWORD_OTHER_PRIORITY
0000000000000200: WINEVENT_KEYWORD_PROCESS_FREEZE
0000000000000400: WINEVENT_KEYWORD_JOB
0000000000000800: WINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS
0000000000001000: WINEVENT_KEYWORD_JOB_IO
0000000000002000: WINEVENT_KEYWORD_WORK_ON_BEHALF
0000000000004000: WINEVENT_KEYWORD_JOB_SILO
--- Operations ---
0000000000000000: win:Info [Info]
0000000000010000: win:Start [Start]
0000000000020000: win:Stop [Stop]
--- Levels ---
0000000000000004: win:Informational [Information]
--- Tasks ---
0000000000000001: ProcessStart
0000000000000002: ProcessStop
0000000000000003: ThreadStart
0000000000000004: ThreadStop
0000000000000005: ImageLoad
0000000000000006: ImageUnload
0000000000000007: CpuBasePriorityChange
0000000000000008: CpuPriorityChange
0000000000000009: PagePriorityChange
000000000000000A: IoPriorityChange
000000000000000B: ProcessFreeze
000000000000000D: JobStart
000000000000000E: JobTerminate
000000000000000F: ProcessRundown
0000000000000010: PsDiskIoAttribution
0000000000000011: PsIoRateControl
0000000000000012: ThreadWorkOnBehalfUpdate
0000000000000013: JobServerSiloStart