diff --git a/EventFinder.sln b/EventFinder.sln new file mode 100644 index 0000000..8a81e5a --- /dev/null +++ b/EventFinder.sln @@ -0,0 +1,25 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 15 +VisualStudioVersion = 15.0.28307.329 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "EventFinder", "EventFinder\EventFinder.csproj", "{36E134C0-5B86-418D-B42D-65B6C38DE1ED}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Release|Any CPU = Release|Any CPU + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {36E134C0-5B86-418D-B42D-65B6C38DE1ED}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {36E134C0-5B86-418D-B42D-65B6C38DE1ED}.Debug|Any CPU.Build.0 = Debug|Any CPU + {36E134C0-5B86-418D-B42D-65B6C38DE1ED}.Release|Any CPU.ActiveCfg = Release|Any CPU + {36E134C0-5B86-418D-B42D-65B6C38DE1ED}.Release|Any CPU.Build.0 = Release|Any CPU + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {E9386A7E-FD13-4BBD-A686-1721B28B9736} + EndGlobalSection +EndGlobal diff --git a/EventFinder/App.config b/EventFinder/App.config new file mode 100644 index 0000000..8cd6e46 --- /dev/null +++ b/EventFinder/App.config @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + \ No newline at end of file diff --git a/EventFinder/EventFinder.csproj b/EventFinder/EventFinder.csproj new file mode 100644 index 0000000..c33b43a --- /dev/null +++ b/EventFinder/EventFinder.csproj @@ -0,0 +1,132 @@ + + + + + + + Debug + AnyCPU + {36E134C0-5B86-418D-B42D-65B6C38DE1ED} + WinExe + EventFinder + EventFinder + v4.6.1 + 512 + true + true + publish\ + true + Disk + false + Foreground + 7 + Days + false + false + true + 0 + 1.0.0.%2a + false + false + true + + + + + AnyCPU + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + + + AnyCPU + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + + + + ..\packages\CsvHelper.12.1.1\lib\net45\CsvHelper.dll + + + + + ..\packages\System.ValueTuple.4.5.0\lib\net461\System.ValueTuple.dll + + + + + + + + + + + + + + + Form1.cs + + + + + Form1.cs + + + ResXFileCodeGenerator + Resources.Designer.cs + Designer + + + True + Resources.resx + + + + + SettingsSingleFileGenerator + Settings.Designer.cs + + + True + Settings.settings + True + + + + + + + + False + Microsoft .NET Framework 4.6.1 %28x86 and x64%29 + true + + + False + .NET Framework 3.5 SP1 + false + + + + + + + + + This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. + + + + + + + \ No newline at end of file diff --git a/EventFinder/Form1.Designer.cs b/EventFinder/Form1.Designer.cs new file mode 100644 index 0000000..06db3a1 --- /dev/null +++ b/EventFinder/Form1.Designer.cs @@ -0,0 +1,149 @@ +namespace EventFinder +{ + partial class FindEvents + { + /// + /// Required designer variable. + /// + private System.ComponentModel.IContainer components = null; + + /// + /// Clean up any resources being used. + /// + /// true if managed resources should be disposed; otherwise, false. + protected override void Dispose(bool disposing) + { + if (disposing && (components != null)) + { + components.Dispose(); + } + base.Dispose(disposing); + } + + #region Windows Form Designer generated code + + /// + /// Required method for Designer support - do not modify + /// the contents of this method with the code editor. + /// + private void InitializeComponent() + { + this.StartButton = new System.Windows.Forms.Button(); + this.EndButton = new System.Windows.Forms.Button(); + this.StartInput = new System.Windows.Forms.TextBox(); + this.EndInput = new System.Windows.Forms.TextBox(); + this.FindEventsButton = new System.Windows.Forms.Button(); + this.StatusOutput = new System.Windows.Forms.Label(); + this.EventRangeBox = new System.Windows.Forms.GroupBox(); + this.Status = new System.Windows.Forms.GroupBox(); + this.EventRangeBox.SuspendLayout(); + this.Status.SuspendLayout(); + this.SuspendLayout(); + // + // StartButton + // + this.StartButton.Location = new System.Drawing.Point(6, 37); + this.StartButton.Name = "StartButton"; + this.StartButton.Size = new System.Drawing.Size(123, 52); + this.StartButton.TabIndex = 0; + this.StartButton.Text = "Start Time"; + this.StartButton.UseVisualStyleBackColor = true; + this.StartButton.Click += new System.EventHandler(this.StartButton_Click); + // + // EndButton + // + this.EndButton.Location = new System.Drawing.Point(6, 95); + this.EndButton.Name = "EndButton"; + this.EndButton.Size = new System.Drawing.Size(123, 53); + this.EndButton.TabIndex = 1; + this.EndButton.Text = "End Time"; + this.EndButton.UseVisualStyleBackColor = true; + this.EndButton.Click += new System.EventHandler(this.EndButton_Click); + // + // StartInput + // + this.StartInput.Location = new System.Drawing.Point(153, 48); + this.StartInput.Name = "StartInput"; + this.StartInput.Size = new System.Drawing.Size(256, 29); + this.StartInput.TabIndex = 2; + // + // EndInput + // + this.EndInput.Location = new System.Drawing.Point(153, 106); + this.EndInput.Name = "EndInput"; + this.EndInput.Size = new System.Drawing.Size(256, 29); + this.EndInput.TabIndex = 3; + // + // FindEventsButton + // + this.FindEventsButton.Location = new System.Drawing.Point(142, 198); + this.FindEventsButton.Name = "FindEventsButton"; + this.FindEventsButton.Size = new System.Drawing.Size(147, 51); + this.FindEventsButton.TabIndex = 4; + this.FindEventsButton.Text = "Find Events"; + this.FindEventsButton.UseVisualStyleBackColor = true; + this.FindEventsButton.Click += new System.EventHandler(this.FindEventsButton_Click); + // + // StatusOutput + // + this.StatusOutput.AutoSize = true; + this.StatusOutput.Location = new System.Drawing.Point(16, 35); + this.StatusOutput.Name = "StatusOutput"; + this.StatusOutput.Text = "Checking for administrator rights..."; + this.StatusOutput.Size = new System.Drawing.Size(0, 25); + this.StatusOutput.TabIndex = 5; + // + // EventRangeBox + // + this.EventRangeBox.Controls.Add(this.StartButton); + this.EventRangeBox.Controls.Add(this.EndButton); + this.EventRangeBox.Controls.Add(this.StartInput); + this.EventRangeBox.Controls.Add(this.EndInput); + this.EventRangeBox.Location = new System.Drawing.Point(12, 13); + this.EventRangeBox.Name = "EventRangeBox"; + this.EventRangeBox.Size = new System.Drawing.Size(423, 168); + this.EventRangeBox.TabIndex = 6; + this.EventRangeBox.TabStop = false; + this.EventRangeBox.Text = "Event Range"; + // + // Status + // + this.Status.Controls.Add(this.StatusOutput); + this.Status.Location = new System.Drawing.Point(18, 268); + this.Status.Name = "Status"; + this.Status.Size = new System.Drawing.Size(403, 147); + this.Status.TabIndex = 7; + this.Status.TabStop = false; + this.Status.Text = "Status"; + // + // FindEvents + // + this.AutoScaleDimensions = new System.Drawing.SizeF(11F, 24F); + this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; + this.ClientSize = new System.Drawing.Size(447, 427); + this.Controls.Add(this.FindEventsButton); + this.Controls.Add(this.EventRangeBox); + this.Controls.Add(this.Status); + this.Name = "FindEvents"; + this.Text = "FindEvents"; + this.EventRangeBox.ResumeLayout(false); + this.EventRangeBox.PerformLayout(); + this.Status.ResumeLayout(false); + this.Status.PerformLayout(); + this.ResumeLayout(false); + + } + + #endregion + + private System.Windows.Forms.Button StartButton; + private System.Windows.Forms.Button EndButton; + private System.Windows.Forms.TextBox StartInput; + private System.Windows.Forms.TextBox EndInput; + private System.Windows.Forms.Button FindEventsButton; + private System.Windows.Forms.Label StatusOutput; + private System.Windows.Forms.GroupBox EventRangeBox; + private System.Windows.Forms.GroupBox Status; + } +} + diff --git a/EventFinder/Form1.cs b/EventFinder/Form1.cs new file mode 100644 index 0000000..b20f3b3 --- /dev/null +++ b/EventFinder/Form1.cs @@ -0,0 +1,181 @@ +using System; +using System.Collections.Generic; +using System.ComponentModel; +using System.Data; +using System.Drawing; +using System.Linq; +using System.Text; +using System.Threading.Tasks; +using System.Diagnostics.Eventing.Reader; // I think this will be needed? +using System.Diagnostics; +using System.Xml; +using System.Xml.Linq; +using System.Text.RegularExpressions; +using System.Windows.Forms; +using System.IO; +using CsvHelper; + +public class Record +{ + public string Message { get; set; } + public string SystemTime { get; set; } + public string Id { get; set; } + public string Version { get; set; } + public string Qualifiers { get; set; } + public string Level { get; set; } + public string Task { get; set; } + public string Opcode { get; set; } + public string Keywords { get; set; } + public string RecordId { get; set; } + public string ProviderName { get; set; } + public string ProviderID { get; set; } + public string LogName { get; set; } + public string ProcessId { get; set; } + public string ThreadId { get; set; } + public string MachineName { get; set; } + public string UserID { get; set; } + public string TimeCreated { get; set; } + public string ActivityId { get; set; } + public string RelatedActivityId { get; set; } + public string Hashcode { get; set; } + public string MatchedQueryIds { get; set; } + public string LevelDisplayName { get; set; } + public string OpcodeDisplayName { get; set; } + public string TaskDisplayName { get; set; } + +} + + +namespace EventFinder +{ + public partial class FindEvents : Form + { + public FindEvents() + { + InitializeComponent(); + + + + EventLogSession session = new EventLogSession(); + var providers = session.GetProviderNames().ToList(); + Regex rgx = new Regex(@"^Security$"); + bool AdminFlag = false; + + foreach (string provider in providers) + { + if (rgx.IsMatch(provider)) + { + AdminFlag = true; + } + } + + if (AdminFlag) + { + StatusOutput.Text = "Security log found!\nYou are likely administrator"; + StatusOutput.ForeColor = System.Drawing.Color.Green; + } else + { + StatusOutput.Text = "Unable to read Security log.\nAre you administrator?"; + StatusOutput.ForeColor = System.Drawing.Color.Red; + } + } + + private void StartButton_Click(object sender, EventArgs e) + { + string CurrentTime = DateTime.Now.ToString("MM/dd/yyyy HH:mm:ss"); + StartInput.Text = CurrentTime; + } + + private void EndButton_Click(object sender, EventArgs e) + { + string CurrentTime = DateTime.Now.ToString("MM/dd/yyyy HH:mm:ss"); + EndInput.Text = CurrentTime; + } + + private void FindEventsButton_Click(object sender, EventArgs e) + { + FindEventsButton.Enabled = false; + + + + + + // Variables we will need + DateTime StartTime = DateTime.ParseExact(StartInput.Text, "MM/dd/yyyy HH:mm:ss", null); + DateTime EndTime = DateTime.ParseExact(EndInput.Text, "MM/dd/yyyy HH:mm:ss", null); + string RunTime = DateTime.Now.ToString("yyyyMMdd_HHmmss"); + string DesktopPath = Environment.GetFolderPath(Environment.SpecialFolder.Desktop); + EventLogSession Session = new EventLogSession(); + var Providers = Session.GetProviderNames().ToList(); + + var query = string.Format(@"*[System[TimeCreated[@SystemTime >= '{0}']]] and *[System[TimeCreated[@SystemTime <= '{1}']]]", StartTime.ToString("o"), EndTime.ToString("o")); + + List records = new List { }; + + foreach (var Provider in Providers) + { + try + { + EventLogQuery eventlogQuery = new EventLogQuery(Provider, PathType.LogName, query); + EventLogReader eventlogReader = new EventLogReader(eventlogQuery); + + for (EventRecord eventRecord = eventlogReader.ReadEvent(); null != eventRecord; eventRecord = eventlogReader.ReadEvent()) + { + // Get the SystemTime from the event record XML + var xml = XDocument.Parse(eventRecord.ToXml()); + XNamespace ns = xml.Root.GetDefaultNamespace(); + + // Collect ALL THE THINGS! + string Message = eventRecord.FormatDescription(); + string SystemTime = xml.Root.Element(ns + "System").Element(ns + "TimeCreated").Attribute("SystemTime").Value; + string Id = eventRecord.Id.ToString(); + string Version = eventRecord.Version.ToString(); + string Qualifiers = eventRecord.Qualifiers.ToString(); + string Level = eventRecord.Level.ToString(); + string Task = eventRecord.Task.ToString(); + string Opcode = eventRecord.Opcode.ToString(); + string Keywords = eventRecord.Keywords.ToString(); + string RecordId = eventRecord.RecordId.ToString(); + string ProviderName = eventRecord.ProviderName; + string ProviderID = eventRecord.ProviderId.ToString(); + string LogName = eventRecord.LogName; + string ProcessId = eventRecord.ProcessId.ToString(); + string ThreadId = eventRecord.ThreadId.ToString(); + string MachineName = eventRecord.MachineName; + string UserID = eventRecord.UserId?.ToString(); + string TimeCreated = eventRecord.TimeCreated.ToString(); + string ActivityId = eventRecord.ActivityId.ToString(); + string RelatedActivityId = eventRecord.RelatedActivityId.ToString(); + string Hashcode = eventRecord.GetHashCode().ToString(); + string LevelDisplayName = eventRecord.LevelDisplayName; + string OpcodeDisplayName = eventRecord.OpcodeDisplayName; + string TaskDisplayName = eventRecord.TaskDisplayName; + + // Add them to the record. The things equal the things. + records.Add(new Record() { Message = Message, SystemTime = SystemTime, Id = Id, Version = Version, Qualifiers = Qualifiers, Level = Level, Task = Task, Opcode = Opcode, Keywords = Keywords, RecordId = RecordId, ProviderName = ProviderName, ProviderID = ProviderID, LogName = LogName, ProcessId = ProcessId, ThreadId = ThreadId, MachineName = MachineName, UserID = UserID, TimeCreated = TimeCreated, ActivityId = ActivityId, RelatedActivityId = RelatedActivityId, Hashcode = Hashcode, LevelDisplayName = LevelDisplayName, OpcodeDisplayName = OpcodeDisplayName, TaskDisplayName = TaskDisplayName }); + } + + } catch (EventLogNotFoundException) + { + // No events found - Nothing to be done + } catch (EventLogException) + { + // Error Reading Provider - Nothing to be done + } + + + } + + records.OrderBy(x => x.SystemTime); + + using (var writer = new StreamWriter(DesktopPath + "\\Logs_Runtime_" + RunTime + ".csv", append: true)) + using (var csv = new CsvWriter(writer)) + { + csv.Configuration.ShouldQuote = (field, context) => true; + csv.WriteRecords(records); + } + + FindEventsButton.Enabled = true; + } + } +} diff --git a/EventFinder/Form1.resx b/EventFinder/Form1.resx new file mode 100644 index 0000000..1af7de1 --- /dev/null +++ b/EventFinder/Form1.resx @@ -0,0 +1,120 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + text/microsoft-resx + + + 2.0 + + + System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + \ No newline at end of file diff --git a/EventFinder/ILMerge.props b/EventFinder/ILMerge.props new file mode 100644 index 0000000..aaadb12 --- /dev/null +++ b/EventFinder/ILMerge.props @@ -0,0 +1,67 @@ + + + + + + + + + + + true + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/EventFinder/ILMergeOrder.txt b/EventFinder/ILMergeOrder.txt new file mode 100644 index 0000000..3fda7f5 --- /dev/null +++ b/EventFinder/ILMergeOrder.txt @@ -0,0 +1,4 @@ +# this file contains the partial list of the merged assemblies in the merge order +# you can fill it from the obj\CONFIG\PROJECT.ilmerge generated on every build +# and finetune merge order to your satisfaction + diff --git a/EventFinder/Program.cs b/EventFinder/Program.cs new file mode 100644 index 0000000..6840118 --- /dev/null +++ b/EventFinder/Program.cs @@ -0,0 +1,22 @@ +using System; +using System.Collections.Generic; +using System.Linq; +using System.Threading.Tasks; +using System.Windows.Forms; + +namespace EventFinder +{ + static class Program + { + /// + /// The main entry point for the application. + /// + [STAThread] + static void Main() + { + Application.EnableVisualStyles(); + Application.SetCompatibleTextRenderingDefault(false); + Application.Run(new FindEvents()); + } + } +} diff --git a/EventFinder/Properties/AssemblyInfo.cs b/EventFinder/Properties/AssemblyInfo.cs new file mode 100644 index 0000000..a341111 --- /dev/null +++ b/EventFinder/Properties/AssemblyInfo.cs @@ -0,0 +1,36 @@ +using System.Reflection; +using System.Runtime.CompilerServices; +using System.Runtime.InteropServices; + +// General Information about an assembly is controlled through the following +// set of attributes. Change these attribute values to modify the information +// associated with an assembly. +[assembly: AssemblyTitle("EventFinder")] +[assembly: AssemblyDescription("")] +[assembly: AssemblyConfiguration("")] +[assembly: AssemblyCompany("")] +[assembly: AssemblyProduct("EventFinder")] +[assembly: AssemblyCopyright("Copyright © 2019")] +[assembly: AssemblyTrademark("")] +[assembly: AssemblyCulture("")] + +// Setting ComVisible to false makes the types in this assembly not visible +// to COM components. If you need to access a type in this assembly from +// COM, set the ComVisible attribute to true on that type. +[assembly: ComVisible(false)] + +// The following GUID is for the ID of the typelib if this project is exposed to COM +[assembly: Guid("36e134c0-5b86-418d-b42d-65b6c38de1ed")] + +// Version information for an assembly consists of the following four values: +// +// Major Version +// Minor Version +// Build Number +// Revision +// +// You can specify all the values or you can default the Build and Revision Numbers +// by using the '*' as shown below: +// [assembly: AssemblyVersion("1.0.*")] +[assembly: AssemblyVersion("1.0.0.0")] +[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/EventFinder/Properties/Resources.Designer.cs b/EventFinder/Properties/Resources.Designer.cs new file mode 100644 index 0000000..9aa6819 --- /dev/null +++ b/EventFinder/Properties/Resources.Designer.cs @@ -0,0 +1,71 @@ +//------------------------------------------------------------------------------ +// +// This code was generated by a tool. +// Runtime Version:4.0.30319.42000 +// +// Changes to this file may cause incorrect behavior and will be lost if +// the code is regenerated. +// +//------------------------------------------------------------------------------ + +namespace EventFinder.Properties +{ + + + /// + /// A strongly-typed resource class, for looking up localized strings, etc. + /// + // This class was auto-generated by the StronglyTypedResourceBuilder + // class via a tool like ResGen or Visual Studio. + // To add or remove a member, edit your .ResX file then rerun ResGen + // with the /str option, or rebuild your VS project. + [global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")] + [global::System.Diagnostics.DebuggerNonUserCodeAttribute()] + [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] + internal class Resources + { + + private static global::System.Resources.ResourceManager resourceMan; + + private static global::System.Globalization.CultureInfo resourceCulture; + + [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")] + internal Resources() + { + } + + /// + /// Returns the cached ResourceManager instance used by this class. + /// + [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] + internal static global::System.Resources.ResourceManager ResourceManager + { + get + { + if ((resourceMan == null)) + { + global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("EventFinder.Properties.Resources", typeof(Resources).Assembly); + resourceMan = temp; + } + return resourceMan; + } + } + + /// + /// Overrides the current thread's CurrentUICulture property for all + /// resource lookups using this strongly typed resource class. + /// + [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] + internal static global::System.Globalization.CultureInfo Culture + { + get + { + return resourceCulture; + } + set + { + resourceCulture = value; + } + } + } +} diff --git a/EventFinder/Properties/Resources.resx b/EventFinder/Properties/Resources.resx new file mode 100644 index 0000000..af7dbeb --- /dev/null +++ b/EventFinder/Properties/Resources.resx @@ -0,0 +1,117 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + text/microsoft-resx + + + 2.0 + + + System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + \ No newline at end of file diff --git a/EventFinder/Properties/Settings.Designer.cs b/EventFinder/Properties/Settings.Designer.cs new file mode 100644 index 0000000..b12fadc --- /dev/null +++ b/EventFinder/Properties/Settings.Designer.cs @@ -0,0 +1,30 @@ +//------------------------------------------------------------------------------ +// +// This code was generated by a tool. +// Runtime Version:4.0.30319.42000 +// +// Changes to this file may cause incorrect behavior and will be lost if +// the code is regenerated. +// +//------------------------------------------------------------------------------ + +namespace EventFinder.Properties +{ + + + [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] + [global::System.CodeDom.Compiler.GeneratedCodeAttribute("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "11.0.0.0")] + internal sealed partial class Settings : global::System.Configuration.ApplicationSettingsBase + { + + private static Settings defaultInstance = ((Settings)(global::System.Configuration.ApplicationSettingsBase.Synchronized(new Settings()))); + + public static Settings Default + { + get + { + return defaultInstance; + } + } + } +} diff --git a/EventFinder/Properties/Settings.settings b/EventFinder/Properties/Settings.settings new file mode 100644 index 0000000..3964565 --- /dev/null +++ b/EventFinder/Properties/Settings.settings @@ -0,0 +1,7 @@ + + + + + + + diff --git a/EventFinder/packages.config b/EventFinder/packages.config new file mode 100644 index 0000000..9b7a705 --- /dev/null +++ b/EventFinder/packages.config @@ -0,0 +1,7 @@ + + + + + + + \ No newline at end of file