从 System.Diagnostics.EventLogEntry 获取事件的详细信息

Question

我正在编写一个 PowerShell 脚本来监视一些事件日志条目。我能够订阅安全日志并在记录其中一个事件时触发脚本块。但是，我找不到如何从事件对象中获取相关数据。我正在与之交互的事件对象的类型为System.Diagnostics.EventLogEntry。我检查了该类的documentation 并使用脚本块将所有可用属性写入控制台：

$CredentialGuardEventIds = 5379,5381,5382
$SecurityLog = Get-EventLog -List | Where-Object {$_.Log -eq 'Security'}

Register-ObjectEvent -InputObject $SecurityLog -SourceIdentifier NewCredentialEvent -EventName EntryWritten -Action {
    $entry = $event.SourceEventArgs.Entry
    if ($CredentialGuardEventIds -contains $entry.EventID) {
        Write-Host "Event $($entry.EventID) occured"
        Write-Host "CanRaiseEvents: $($entry.CanRaiseEvents)"
        Write-Host "Category: $($entry.Category)"
        Write-Host "CategoryNumber: $($entry.CategoryNumber)"
        Write-Host "Container: $($entry.Container)"
        Write-Host "Data: $($entry.Data)"
        Write-Host "DesignMode: $($entry.DesignMode)"
        Write-Host "EntryType: $($entry.EntryType)"
        Write-Host "EventID: $($entry.EventID)"
        Write-Host "Events: $($entry.Events)"
        Write-Host "Index: $($entry.Index)"
        Write-Host "InstanceId: $($entry.InstanceId)"
        Write-Host "MachineName: $($entry.MachineName)"
        Write-Host "Message: $($entry.Message)"
        Write-Host "ReplacementStrings: $($entry.ReplacementStrings)"
        Write-Host "Site: $($entry.Site)"
        Write-Host "Source: $($entry.Source)"
        Write-Host "TimeGenerated: $($entry.TimeGenerated)"
        Write-Host "TimeWritten: $($entry.TimeWritten)"
        Write-Host "UserName: $($entry.UserName)"
    }
}

输出以下数据：

CanRaiseEvents:
Category: (13824)
CategoryNumber: 13824
Container:
Data:
DesignMode:
EntryType: SuccessAudit
EventID: 5381
Events:
Index: 771286
InstanceId: 5381
MachineName: REDACTED
Message: Vault credentials were read.

Subject:
        Security ID:            S-1-5-26-2325928431-9938217593-9384716351-3004
        Account Name:           redacted
        Account Domain:         REDACTED
        Logon ID:               0x44d9f

This event occurs when a user enumerates stored vault credentials.
ReplacementStrings: S-1-5-21-2356930457-929305828-1234252251-1534 redacted REDACTED 0x3459f 142 6 2019-09-20T23:33:31.671135000Z 15136
Site:
Source: Microsoft-Windows-Security-Auditing
TimeGenerated: 09/24/2019 21:26:27
TimeWritten: 09/24/2019 21:26:27
UserName:

但是，我感兴趣的数据出现在事件查看器的“详细信息”选项卡中：

如何从 System.Diagnostics.EventLogEntry 对象访问详细信息窗格中的数据？

注意

相关事件是在最近发布的 Windows 10（我相信是 1903 年）中添加的，并且与 Windows Defender Credential Guard 有关。我找不到太多关于它们的文档，但可以在此处找到关于为什么添加它们的好视频：https://www.youtube.com/watch?v=1JJAob5fkWs&t=736s

Answer 1

在我看来，信息在 message 属性中，但我没有您要查找的事件。

Answer 2

虽然我没有带有这些 ID 的事件，但下面的演示代码应该会让您有所了解。
使用Get-WinEvent，您可以获得这样的 XML 数据：

$result = Get-WinEvent -FilterHashtable @{LogName="Security";Id=4624} -MaxEvents 100 | ForEach-Object {
    # convert the event to XML and grab the Event node
    $eventXml = ([xml]$_.ToXml()).Event

    # get the 'TargetDomainName' value and check it does not start with 'NT AUTHORITY'
    $domain = $eventXml.EventData.Data[$dataItems['TargetDomainName']].'#text'
    if ($domain -ne 'NT AUTHORITY' ) {
        [PSCustomObject]@{
            Domain    = $domain
            UserName  = $eventXml.EventData.Data[$dataItems['TargetUserName']].'#text'
            UserSID   = $eventXml.EventData.Data[$dataItems['TargetUserSid']].'#text'
            LogonType = $logonTypes[[int]$eventXml.EventData.Data[$dataItems['LogonType']].'#text'] 
            Date      = [DateTime]$eventXml.System.TimeCreated.SystemTime
            Computer  = $eventXml.System.Computer
        }
    }
}

$result | Format-Table -AutoSize

希望有帮助

Answer 3

Get-EventLog 为您提供事件的事件日志消息。 您尝试提取的数据是事件清单的一部分，不会显示在日志消息中。 要获取此数据，请使用“Get-WinEvent”。

$result = Get-WinEvent -FilterHashtable @{LogName="Security";Id=5381} -MaxEvents 100 | ForEach-Object {
    # convert the event to XML and extract properties
    $eventXml = ([xml]$_.ToXml()).Event
    $domain = $eventXml.EventData.Data[$dataItems['CountOfCredentialsReturned']].'#text'
}

$result | Format-Table -AutoSize