flashercs

powershell获取事件IP地址

$evt=Get-WinEvent -LogName Security -FilterXPath "Event[System[EventID=4625 and TimeCreated[timediff(@SystemTime)<=600000]]]" -MaxEvents 1 -ErrorAction SilentlyContinue
if($null -ne $evt){
$evt.Properties[3].Value # IP地址可能不是这个序号
}COPY

flashercs

回复 3# 522235677

$evt=Get-WinEvent -LogName Security -FilterXPath "Event[System[EventID=4625 and TimeCreated[timediff(@SystemTime)<=600000]]]" -MaxEvents 1 -ErrorAction SilentlyContinue
if($null -ne $evt){
$evt.Properties
}COPY

flashercs

回复 5# 522235677

$evt=Get-WinEvent -LogName Security -FilterXPath "Event[System[EventID=4625 and TimeCreated[timediff(@SystemTime)<=600000]]]" -MaxEvents 1 -ErrorAction SilentlyContinue
if($null -ne $evt){
$ip=$evt.Properties[19].Value
curl.exe http://test.com?ip=$ip
}COPY

flashercs

回复 8# 522235677

"Event[System[EventID=4624 and TimeCreated[timediff(@SystemTime)<=600000]] and EventData[Data[@Name='LogonType']=10]]"COPY