Skip to content

Commit

Permalink
Update Utility.ps1
Browse files Browse the repository at this point in the history
Adding full message dumping for other language that will not match the search keyword
  • Loading branch information
Mr-Un1k0d3r authored Mar 13, 2019
1 parent e042ddf commit c4b6f12
Showing 1 changed file with 14 additions and 7 deletions.
21 changes: 14 additions & 7 deletions scripts/Utility.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ function Search-EventForUser {
[Parameter(Mandatory=$False)]
[switch]$FindDC = $False,
[Parameter(Mandatory=$False)]
[switch]$FullMessage = $False,
[Parameter(Mandatory=$False)]
[string]$Username,
[Parameter(Mandatory=$False)]
[string]$Password
Expand Down Expand Up @@ -48,13 +50,18 @@ function Search-EventForUser {
if($data) {
ForEach($entry in $data) {
Write-Output "`n[+] Event found"
ForEach($Line in $entry.Message.Split("`n")) {
$Line | Select-String -Pattern "Account Name:"
$Line | Select-String -Pattern "Account Domain:"
$Line | Select-String -Pattern "Security ID:"
$Line | Select-String -Pattern "Source Network Address:"
$Line | Select-String -Pattern "Workstation Name:"
$Line | Select-String -Pattern "Process Name:"

If($FullMessage) {
Write-Output $entry.Message
} Else {
ForEach($Line in $entry.Message.Split("`n")) {
$Line | Select-String -Pattern "Account Name:"
$Line | Select-String -Pattern "Account Domain:"
$Line | Select-String -Pattern "Security ID:"
$Line | Select-String -Pattern "Source Network Address:"
$Line | Select-String -Pattern "Workstation Name:"
$Line | Select-String -Pattern "Process Name:"
}
}
}
} else {
Expand Down

0 comments on commit c4b6f12

Please sign in to comment.