windows-event-log-investigation - Defensive Windows security lab that collects and a

项目说明

Windows Event Log In

A defensi lab that collects Windows events, normalizes them to
JSONL, detects suspicious activity, and produces an incident-style timeline.
The project uses PowerShell and the Python standard library.

Use it only on systems and event data you own or are authorized to in.

Security Notice

This repository is an educational defensi lab, not a production
SIEM or incident-response system. Run the collection and acti
scripts only on systems you own or are explicitly authorized to test. Review
event exports before sharing because they can contain usernames, hostnames, IP
addresses, commands, and other sensitive data. Published samples are synthetic.

Do not deploy this project in production.

Objective

Practice the complete workflow a junior SOC analyst would follow:

1. Collect relevant host e without changing audit policy.
2. Preser event fields for repeatable analysis.
3. Identify authentication attacks and suspicious system changes.
4. Produce a timeline and clearly separate detections from conclusions.
5. Document gaps, false-positi, and next steps.

What it detects

| Rule | Windows events | Purpose |
|---|---|---|
| AUTH-BRUTE-FORCE | 4625 | Repeated failures against one account and source |
| AUTH-PASSWORD-SPRAY | 4625 | One source failing across multiple accounts |
| AUTH-SUCCESS-AFTER-FAILURES | 4624, 4625 | Successful access after repeated failures |
| ACCOUNT-CREATED / ACCOUNT-DELETED | 4720, 4726 | Account lifecycle changes |
| GROUP-MEMBERSHIP-ADDED | 4728, 4732, 4756 | Addition to security-enabled groups |
| POWERSHELL-SUSPICIOUS-CONTENT | 4103, 4104 | Potentially risky PowerShell content |
| PROCESS-LOLBIN | 4688 | Execution of commonly abused Windows utilities |
| SER | 7045 | New service installation or persistence lead |

These are triage rules. A match is not proof of malicious activity.

Project contents

Quick demonstration

Run the included sanitized scenario:

Write a redacted Markdown report:

The scenario contains fictional RFC 5737 documentation IP addresses and a
fictional Windows host. It exercises brute-force, password-spray,
success-after-failures, account creation, pri membership,
suspicious PowerShell, risky utility, and ser detections.

Collect real Windows events

The collector does not enable logging, create accounts, change policy, or
generate failed logons. It only reads requested channels:

Then analyze the local e:

The Security channel normally requires an elevated PowerShell session. The
collector continues with accessible channels, emits a warning for every failed
channel, and refuses to claim success if none can be queried.

For automation, add -FailOnCollectionError to return a failure after
preserving the partial e file whenever a channel or record could not be
collected.

To collect a narrower set:

-IncludeMessage adds rendered event messages. It is disabled by default
because messages may duplicate data and increase exposure.

Privacy and e handling

Windows logs may contain usernames, IP addresses, computer names, commands,
paths, and other sensiti. Raw collection output is placed under
.private/, which is excluded from Git. Review every artifact before sharing.

Use --redact when generating Markdown or JSON for broader sharing. It removes
the input path and pseudonymizes sensiti entities consistently while
retaining analytical relationships. Redaction is a sharing aid, not a forensic
anonymization guarantee.

Analyzer options

Exit codes:

Input is newline-delimited JSON. Each event requires timestamp, e,
provider, channel, and a string-to-string data object. Timestamps must
include a timezone. Input is limited to 100 MiB total, 2 MiB per line, and
100,000 events. The analyzer refuses to use the input e file as its
output path. Markdown report fields are escaped and common URL schemes defanged;
JSON output preserves the original parsed .

Run the tests

GitHub Actions tests Python 3.10 and 3.13 on both Windows and Ubuntu and parses
both PowerShell scripts for syntax errors.

Local performed

This de machine exposed the Application, System, and PowerShell
Operational channels. Real Event 4104 records were confirmed in the PowerShell
Operational log. The non-elevated session could not access the Security log;
that limitation is reported rather than hidden. No raw host logs are committed.

In limitations

项目信息

开发语言：Python

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Defensive Windows security lab that collects and analyzes event logs, detects suspicious activity, and generates incident timelines.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。