Skip to content

PowerShellMethodAuditor listens to the PowerShell ETW provider and logs PowerShell method invocations.

License

Notifications You must be signed in to change notification settings

zacbrown/PowerShellMethodAuditor

Repository files navigation

Introduction

This is an example project for demonstrating how to use krabsetw and its .NET bindings to consume events from the Microsoft-Windows-PowerShell Operational log.

The Microsoft-Windows-PowerShell Operational log exposes a number of events through the event log as well as many others which are not written to the Event Log and only available through ETW. This example project shows how to parse EID 7937, "PowerShell Method Invocation."

After loading the project in Visual Studio 2015 and compiling it,.you should be able to run it. You'll then need to open a powershell.exe console and run a function (e.g. Write-Host). You should then see something similar to the following:

example

Requirements

  • .NET 4.5.2 (krabsetw .NET bindings will work on 4.5 though)
  • Visual Studio 2015
  • Windows 7 or higher - tested on Windows 10 (64 bit required)

About

PowerShellMethodAuditor listens to the PowerShell ETW provider and logs PowerShell method invocations.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages