# Clic derecho sobre el log -> 'Guardar todos los eventos como...' -> .evtx # Con PowerShell (más controlado): wevtutil epl Security C:\Evidence\Security_$(Get-Date -Format yyyyMMdd).evtx wevtutil epl System C:\Evidence\System_$(Get-Date -Format yyyyMMdd).evtx # Calcular hashes (cadena de custodia) Get-FileHash C:\Evidence\*.evtx -Algorithm SHA256 | Format-Table

Get-WinEvent -FilterHashtable @{{ LogName = 'Security' Id = 4624 }} | Where-Object {{ $_.Properties[8].Value -eq 10 }} | ForEach-Object {{ [PSCustomObject]@{{ Tiempo = $_.TimeCreated Usuario = $_.Properties[5].Value IP_Origen = $_.Properties[18].Value Workstation= $_.Properties[11].Value LogonID = $_.Properties[7].Value }} }} | Sort-Object Tiempo | Format-Table -AutoSize

# Indica runas, PsExec, movimiento lateral Get-WinEvent -FilterHashtable @{{ LogName='Security'; Id=4648 }} | ForEach-Object {{ [PSCustomObject]@{{ Tiempo = $_.TimeCreated Cuenta_Origen = $_.Properties[1].Value Cuenta_Objetivo = $_.Properties[5].Value Servidor_Destino = $_.Properties[8].Value Proceso = $_.Properties[11].Value }} }} | Format-Table -AutoSize

# Analizar archivo .evtx copiado de otro equipo Get-WinEvent -Path 'C:\Evidence\Security.evtx' -FilterHashtable @{{ Id = @(4624, 4625, 4648) }} | ForEach-Object {{ [PSCustomObject]@{{ Tiempo = $_.TimeCreated EventID = $_.Id Usuario = $_.Properties[5].Value IP = $_.Properties[18].Value }} }} | Export-Csv 'C:\Evidence\auth_events.csv' -NoTypeInformation

$inicio = (Get-Date).AddHours(-2) $fallos = Get-WinEvent -FilterHashtable @{{ LogName='Security'; Id=4625; StartTime=$inicio }} | ForEach-Object {{ [PSCustomObject]@{{ Tiempo = $_.TimeCreated Usuario = $_.Properties[5].Value IP_Origen = $_.Properties[19].Value SubStatus = $_.Properties[9].Value LogonType = $_.Properties[10].Value }} }} Write-Host "Total fallos: $($fallos.Count)" # Top IPs atacantes $fallos | Group-Object IP_Origen | Sort-Object Count -Desc | Select-Object -First 10 | Format-Table Count, Name -AutoSize # Top usuarios atacados $fallos | Group-Object Usuario | Sort-Object Count -Desc | Select-Object -First 10 | Format-Table Count, Name -AutoSize

# FUERZA BRUTA: muchos intentos en UN usuario desde UNA IP # SPRAYING: pocos intentos en MUCHOS usuarios desde UNA IP $fallos | Group-Object IP_Origen | ForEach-Object {{ $usuariosUnicos = ($_.Group.Usuario | Sort-Object -Unique).Count [PSCustomObject]@{{ IP = $_.Name TotalFallos = $_.Count UsuariosDistintos= $usuariosUnicos Patron = if ($usuariosUnicos -gt 10) {{ 'PASSWORD SPRAYING' }} else {{'FUERZA BRUTA'}} }} }} | Format-Table -AutoSize

# SubStatus más comunes: # 0xC000006A = Contraseña incorrecta (usuario EXISTE) # 0xC0000064 = Usuario NO existe (enumeración) # 0xC000006F = Fuera del horario permitido # 0xC0000072 = Cuenta deshabilitada # 0xC0000234 = Cuenta bloqueada (por ataques previos) $fallos | Group-Object SubStatus | Sort-Object Count -Desc | ForEach-Object {{ $sig = switch ($_.Name) {{ '0xc000006a' {{'Contraseña incorrecta (usuario existe)'}} '0xc0000064' {{'Usuario NO existe (enumeración)'}} '0xc0000072' {{'Cuenta deshabilitada'}} '0xc0000234' {{'Cuenta bloqueada (bruteforce previo)'}} default {{"Código: $($_.Name)"}} }} [PSCustomObject]@{{ Significado=$sig; Total=$_.Count }} }} | Format-Table -AutoSize

$ips_atacantes = $fallos.IP_Origen | Sort-Object -Unique $exitos = Get-WinEvent -FilterHashtable @{{ LogName='Security'; Id=4624; StartTime=$inicio }} | ForEach-Object {{ [PSCustomObject]@{{ Tiempo = $_.TimeCreated Usuario = $_.Properties[5].Value IP_Origen= $_.Properties[18].Value LogonType= $_.Properties[8].Value }} }} | Where-Object {{ $_.IP_Origen -in $ips_atacantes }} if ($exitos) {{ Write-Host "ALERTA CRITICA: login exitoso desde IP atacante!" -ForegroundColor Red $exitos | Format-Table -AutoSize }} else {{ Write-Host "Sin logins exitosos desde IPs atacantes" -ForegroundColor Green }}

$hace7dias = (Get-Date).AddDays(-7) Get-WinEvent -FilterHashtable @{{ LogName='Security'; Id=4720; StartTime=$hace7dias }} | ForEach-Object {{ [PSCustomObject]@{{ Tiempo = $_.TimeCreated Nueva_Cuenta = $_.Properties[0].Value # TargetUserName Creada_Por = $_.Properties[4].Value # SubjectUserName Logon_ID = $_.Properties[7].Value # Para correlación }} }} | Format-Table -AutoSize

# Event ID 4732 - grupo local Get-WinEvent -FilterHashtable @{{LogName='Security'; Id=4732}} | Where-Object {{ $_.Properties[2].Value -like '*Admin*' }} | ForEach-Object {{ [PSCustomObject]@{{ Tiempo = $_.TimeCreated Miembro = $_.Properties[0].Value Grupo = $_.Properties[2].Value Por_Quien = $_.Properties[6].Value }} }} | Format-Table -AutoSize # Para dominio - Event ID 4728 (grupos globales) Get-WinEvent -FilterHashtable @{{LogName='Security'; Id=4728}} | Where-Object {{ $_.Properties[2].Value -like '*Domain Admin*' }} | ForEach-Object {{ Write-Host "ALERTA: $($_.Properties[0].Value) -> $($_.Properties[2].Value)" -ForegroundColor Red }}

$logonId = '0x1a2b3c' # Del campo SubjectLogonId del evento 4720 Get-WinEvent -FilterHashtable @{{LogName='Security'; Id=4624}} | Where-Object {{ $_.Properties[7].Value -eq $logonId }} | ForEach-Object {{ Write-Host "Sesión origen:" Write-Host " Usuario: $($_.Properties[5].Value)" Write-Host " IP: $($_.Properties[18].Value)" Write-Host " Tipo: $($_.Properties[8].Value) (10=RDP, 3=Red)" Write-Host " Hora: $($_.TimeCreated)" }}

$recon = @('whoami','net user','net group','net localgroup', 'ipconfig','systeminfo','tasklist','netstat', 'nltest','wmic','reg query','dsquery') Get-WinEvent -FilterHashtable @{{ LogName='Security'; Id=4688 StartTime=(Get-Date).AddHours(-24) }} | ForEach-Object {{ $cmd = $_.Properties[8].Value $usr = $_.Properties[1].Value $padre = $_.Properties[13].Value foreach ($r in $recon) {{ if ($cmd -like "*$r*") {{ Write-Host "[RECON] $r" -ForegroundColor Yellow Write-Host " $($_.TimeCreated) | Usuario: $usr" Write-Host " Padre: $padre" Write-Host " CMD: $cmd" }} }} }}

# Ejecutables legítimos abusados con fines maliciosos $lol = @('certutil','mshta','regsvr32.exe','wscript', 'cscript','rundll32','bitsadmin','expand.exe') Get-WinEvent -FilterHashtable @{{LogName='Security'; Id=4688}} | ForEach-Object {{ $proc = [IO.Path]::GetFileName($_.Properties[5].Value).ToLower() if ($proc -in $lol) {{ [PSCustomObject]@{{ Hora = $_.TimeCreated Usuario = $_.Properties[1].Value LOLBin = $proc CmdLine = $_.Properties[8].Value Padre = $_.Properties[13].Value }} }} }} | Format-Table -AutoSize -Wrap

# -EncodedCommand (-enc) : ejecuta base64 (evasion de logging) # -WindowStyle Hidden : oculta ventana # IEX / DownloadString : descarga y ejecuta # bypass : evade política de ejecución Get-WinEvent -FilterHashtable @{{LogName='Security'; Id=4688}} | Where-Object {{ $c = $_.Properties[8].Value $c -match 'powershell' -and ( $c -match '-[Ee][Nn][Cc]' -or $c -match 'IEX|Invoke-Expression' -or $c -match 'DownloadString|DownloadFile' -or $c -match '-[Ww]indow[Ss]tyle\s+[Hh]idden' -or $c -match 'bypass' ) }} | ForEach-Object {{ Write-Host "[PS SOSPECHOSO] $($_.TimeCreated)" -ForegroundColor Red Write-Host " Usuario: $($_.Properties[1].Value)" Write-Host " CMD: $($_.Properties[8].Value)" -ForegroundColor Yellow }}

# Event ID 7045 del canal System (más detallado que 4697) Get-WinEvent -FilterHashtable @{{LogName='System'; Id=7045}} | ForEach-Object {{ [PSCustomObject]@{{ Tiempo = $_.TimeCreated Nombre = $_.Properties[0].Value # ServiceName Ruta = $_.Properties[1].Value # ImagePath Inicio = $_.Properties[2].Value # StartType Cuenta = $_.Properties[4].Value # AccountName }} }} | Sort-Object Tiempo -Desc | Format-Table -AutoSize -Wrap # RUTAS SOSPECHOSAS: # C:\Users\*\AppData\Temp\... # C:\ProgramData\... # Nombres que imitan servicios (svchost32.exe, lsass.exe)

# Event ID 4698 - Tarea programada creada Get-WinEvent -FilterHashtable @{{LogName='Security'; Id=4698}} | ForEach-Object {{ [PSCustomObject]@{{ Tiempo = $_.TimeCreated Usuario = $_.Properties[1].Value Tarea = $_.Properties[4].Value }} }} | Sort-Object Tiempo -Desc | Format-Table -AutoSize

# Event ID 1102 - Log de Seguridad borrado Get-WinEvent -FilterHashtable @{{LogName='Security'; Id=1102}} | ForEach-Object {{ Write-Host "CRITICO: Log BORRADO" -ForegroundColor Red Write-Host " Cuando: $($_.TimeCreated)" Write-Host " Por quien: $($_.Properties[1].Value)" }} # Event ID 104 - Log del Sistema borrado Get-WinEvent -FilterHashtable @{{LogName='System'; Id=104}} | ForEach-Object {{ Write-Host "CRITICO: Log SISTEMA borrado - $($_.TimeCreated)" -ForegroundColor Red }}

$inicio = (Get-Date).AddDays(-2) $IDS_SEC = @(1102,4624,4625,4648,4672,4688,4697,4698,4720,4728,4732) $IDS_SYS = @(7045,7040,104) $tl = @() foreach ($id in $IDS_SEC) {{ try {{ Get-WinEvent -FilterHashtable @{{LogName='Security';Id=$id;StartTime=$inicio}} -EA Stop | ForEach-Object {{ $tl += [PSCustomObject]@{{ Tiempo=$_.TimeCreated; EID=$id; Canal='Security' Desc=$_.Message.Split('.')[0].Trim().Substring(0,[Math]::Min(75,$_.Message.Length)) }} }} }} catch {{}} }} foreach ($id in $IDS_SYS) {{ try {{ Get-WinEvent -FilterHashtable @{{LogName='System';Id=$id;StartTime=$inicio}} -EA Stop | ForEach-Object {{ $tl += [PSCustomObject]@{{Tiempo=$_.TimeCreated;EID=$id;Canal='System' Desc=$_.Message.Split('.')[0].Trim().Substring(0,[Math]::Min(75,$_.Message.Length))}} }} }} catch {{}} }} $tl | Sort-Object Tiempo | Format-Table Tiempo,EID,Canal,Desc -AutoSize -Wrap $tl | Sort-Object Tiempo | Export-Csv 'C:\Forensics\timeline.csv' -NoTypeInformation

$logonId = '0x1234ab' # Del campo LogonID del evento 4624 sospechoso # Procesos creados en esa sesión Get-WinEvent -FilterHashtable @{{LogName='Security'; Id=4688}} | Where-Object {{ $_.Properties[3].Value -eq $logonId }} | ForEach-Object {{ Write-Host "PROCESO: $($_.Properties[5].Value)" Write-Host "CMDLINE: $($_.Properties[8].Value)" Write-Host "HORA: $($_.TimeCreated)" Write-Host "" }} # Cuentas creadas en esa sesión Get-WinEvent -FilterHashtable @{{LogName='Security'; Id=4720}} | Where-Object {{ $_.Properties[7].Value -eq $logonId }} | ForEach-Object {{ Write-Host "CUENTA CREADA: $($_.Properties[0].Value)" -ForegroundColor Red }}

# MÉTODO 1: FilterHashtable (m&aacute;s r&aacute;pido) Get-WinEvent -FilterHashtable @{{ LogName='Security'; Id=4624 StartTime=(Get-Date).AddHours(-24) }} # MÉTODO 2: FilterXml (control total con XPath) $x = '<QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[(EventID=4625)]]</Select></Query></QueryList>' Get-WinEvent -FilterXml $x # MÉTODO 3: Archivo .evtx offline Get-WinEvent -Path 'C:\Evidence\Security.evtx' -FilterHashtable @{{Id=4624}} # MÉTODO 4: Remoto (requiere WinRM) Get-WinEvent -ComputerName 'SERVER01','DC01' -FilterHashtable @{{LogName='Security';Id=4720}}

# ============================================ # TRIAJE RAPIDO DE SEGURIDAD # GhostAcademy - unfantasmaenelsistema.com # ============================================ param([int]$H=24, [string]$Equipo=$env:COMPUTERNAME) Write-Host "=== TRIAJE: $Equipo | Ultimas $H horas ==" -ForegroundColor Cyan $ini=(Get-Date).AddHours(-$H) # [1] Fallos Write-Host "`n[1] FALLOS 4625:" -ForegroundColor Yellow try {{ $f=Get-WinEvent -CN $Equipo -FH @{{LogName='Security';Id=4625;StartTime=$ini}} -EA Stop Write-Host " Total: $($f.Count)" $f|Group-Object {{$_.Properties[19].Value}}|Sort Count -Desc|Select -F 5| %{{Write-Host " IP $($_.Name): $($_.Count)"}} }} catch {{Write-Host " Sin fallos"}} # [2] Cuentas creadas Write-Host "`n[2] CUENTAS 4720:" -ForegroundColor Yellow try {{ $c=Get-WinEvent -CN $Equipo -FH @{{LogName='Security';Id=4720;StartTime=$ini}} -EA Stop if($c){{Write-Host " ALERTA: $($c.Count) cuentas!" -ForegroundColor Red $c|%{{Write-Host " $($_.Properties[0].Value) por $($_.Properties[4].Value)"}} }} else{{Write-Host " Ninguna"}} }} catch {{Write-Host " Sin acceso"}} # [3] Servicios Write-Host "`n[3] SERVICIOS 7045:" -ForegroundColor Yellow try {{ $s=Get-WinEvent -CN $Equipo -FH @{{LogName='System';Id=7045;StartTime=$ini}} -EA Stop if($s){{Write-Host " ALERTA: $($s.Count) servicios!" -ForegroundColor Red $s|%{{Write-Host " $($_.Properties[0].Value): $($_.Properties[1].Value)"}} }} else{{Write-Host " Ninguno"}} }} catch {{}} # [4] Logs borrados Write-Host "`n[4] LOGS BORRADOS:" -ForegroundColor Yellow try {{ $b=Get-WinEvent -CN $Equipo -FH @{{LogName='Security';Id=1102;StartTime=$ini}} -EA Stop if($b){{Write-Host " CRITICO: LOGS BORRADOS!" -ForegroundColor Red}} else{{Write-Host " OK"}} }} catch {{Write-Host " OK"}} Write-Host "`n=== FIN TRIAJE ===" -ForegroundColor Cyan

$servidores = @('SRV01','SRV02','DC01','FILESERVER') $resultados = $servidores | ForEach-Object -Parallel {{ $srv = $_ $ini = (Get-Date).AddHours(-24) try {{ $fallos = (Get-WinEvent -CN $srv -FH @{{ LogName='Security'; Id=4625; StartTime=$ini }} -EA Stop).Count [PSCustomObject]@{{Servidor=$srv; Fallos4625=$fallos; Estado='OK'}} }} catch {{ [PSCustomObject]@{{Servidor=$srv; Fallos4625=0; Estado='Sin acceso'}} }} }} -ThrottleLimit 5 $resultados | Sort-Object Fallos4625 -Desc | Format-Table -AutoSize