From 6f44189b6eae262d925d2efe261bae85e74833aa Mon Sep 17 00:00:00 2001
From: "Mr.Un1k0d3r" <mr.un1k0d3r@gmail.com>
Date: Wed, 4 Aug 2021 10:29:48 -0400
Subject: [PATCH] Update Utility.ps1

---
 scripts/Utility.ps1 | 76 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/scripts/Utility.ps1 b/scripts/Utility.ps1
index 7fd6f16..28e3703 100644
--- a/scripts/Utility.ps1
+++ b/scripts/Utility.ps1
@@ -1,5 +1,81 @@
 # Mr.Un1k0d3r RingZer0 Team
 
+function Search-EventForUserByIP{
+
+	param(
+	[Parameter(Mandatory=$True, ValueFromPipeline=$true)]
+	[string]$IP,
+	[Parameter(Mandatory=$False)]
+	[string]$ComputerName = (Get-Item env:COMPUTERNAME).Value,
+	[Parameter(Mandatory=$False)]
+	[switch]$FindDC = $False,
+	[Parameter(Mandatory=$False)]
+	[switch]$FullMessage = $False,
+	[Parameter(Mandatory=$False)]
+	[string]$Username,
+	[Parameter(Mandatory=$False)]
+	[string]$Password
+	)
+	
+	BEGIN {
+		if($Username -ne "") {
+			$SecurePassword = ConvertTo-SecureString $Password -AsPlainText -Force
+			$Creds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $Username, $SecurePassword
+		}	
+	}
+	
+	PROCESS {
+		[System.Collections.ArrayList]$dcs = @() 
+		if($FindDC) {
+			Write-Output "[+] Enumerating all the DCs"
+			ForEach($dc in [DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().DomainControllers) {
+				Write-Output "[+] DC found: $($dc.Name)"
+				$dcs.Add($dc.Name) | Out-Null
+			}
+		} else {
+			$dcs.Add($ComputerName) | Out-Null
+		}
+		
+		ForEach($dc in $dcs) {
+			ForEach($item in $IP) {
+				Write-Output "[+] Parsing $($dc) Logs looking for $($item)"
+				if($Creds) {
+					Write-Output "[*] Remotely authenticated as $($Username)"
+				$xmlFilter = "<QueryList><Query Id=""0"" Path=""Security""><Select Path=""Security"">*[EventData[Data[@Name=""IpAddress""] and(Data=""$($item)"")]]</Select></Query></QueryList>";
+					$data = Get-WinEvent -FilterXml $xmlFilter -ComputerName $dc -ErrorAction SilentlyContinue -Credential $Creds | Select Message;
+				} else {
+					$xmlFilter = "<QueryList><Query Id=""0"" Path=""Security""><Select Path=""Security"">*[EventData[Data[@Name=""IpAddress""] and(Data=""$($item)"")]]</Select></Query></QueryList>";
+					$data = Get-WinEvent -FilterXml $xmlFilter -ComputerName $dc -ErrorAction SilentlyContinue | Select Message;				
+				}
+				if($data) {
+					ForEach($entry in $data) {
+						Write-Output "`n[+] Event found" 
+						
+						If($FullMessage) {
+							Write-Output $entry.Message
+						} Else {
+							ForEach($Line in $entry.Message.Split("`n")) {
+								$Line | Select-String -Pattern "Account Name:"
+								$Line | Select-String -Pattern "Account Domain:"
+								$Line | Select-String -Pattern "Security ID:"
+								$Line | Select-String -Pattern "Source Network Address:"
+								$Line | Select-String -Pattern "Workstation Name:"
+								$Line | Select-String -Pattern "Process Name:"
+							}
+						}
+					}
+				} else {
+					Write-Output "[-] No event found on $($dc)..."
+				}
+			}
+		}
+	}
+	
+	END {
+		Write-Output "[+] Process completed..."
+	}
+}
+
 function Search-EventForUserByDomain {
 
 	param(