Skip to content

Instantly share code, notes, and snippets.

@lctrcl

lctrcl/process_image_logging.ps1

Forked from mattifestation/process_image_logging.ps1
Created February 1, 2019 12:50
Show Gist options
  • Save lctrcl/9c11e0e9a1e91913e3f9a82e5ac3a1e5 to your computer and use it in GitHub Desktop.
Save lctrcl/9c11e0e9a1e91913e3f9a82e5ac3a1e5 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
process_image_logging.ps1
# These values were obtained from: logman query providers Microsoft-Windows-Kernel-Process
$WINEVENT_KEYWORD_PROCESS = 0x10
$WINEVENT_KEYWORD_IMAGE = 0x40
# Normally when you enable an analytic log, all keywords are logged which can be veeeeerrrrryy noisy.
# I'm going to limit collection to only image and process event
$KernelProcessLog = New-Object -TypeName System.Diagnostics.Eventing.Reader.EventLogConfiguration -ArgumentList 'Microsoft-Windows-Kernel-Process/Analytic'
$KernelProcessLog.ProviderKeywords = ($WINEVENT_KEYWORD_PROCESS -bor $WINEVENT_KEYWORD_IMAGE)
$KernelProcessLog.ProviderLevel = 0xFF
$KernelProcessLog.IsEnabled = $true
# Enable the log with the settings we specified
$KernelProcessLog.SaveChanges()
# Retrieve process start/stop and image/unload load events
Get-WinEvent -LogName 'Microsoft-Windows-Kernel-Process/Analytic' -Oldest
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment