Utilizing Windows PowerShell 

for Host-based IDS 
Log Monitoring

Presentation Topics

• PowerShell
• My Implementation

PowerShell

What is PowerShell

From Wikipedia:

1) Windows PowerShell is a task automation and configuration management framework from Microsoft, consisting of a command-line shell and associated scripting language built on the .NET Framework.

2) object-oriented interface where you can interact with .NET classes (or COM/WMI objects)

Basic Components

Application Host Console

Scripting Environment

PowerShell

What is PowerShell for?

Advanced Users and Administrators

    Windows PowerShell is powerful tool where:

    -  you can deal with any kind of task,

    -  as many times as you will be requested to

    -  reducing repetitiveness by writing & using scripts & modules

    -  giving best results

    -  with one tool in use: PowerShell

PowerShell

PowerShell vs CMD   

implementing if stats, for while

variables

casts everything

object-oriented

scripts

.NET Framework

extendable

use pipes

adopts all CMD commands

batch

predefined commands

complicated

PowerShell

Verb-Noun cmdlet pattern

Get-Verb

Get-Command -Noun * | select Noun

cmdlet structure

Verb-Noun -Parameter inputValue

PowerShell

Object Oriented Interface

get-process | get -member

get-date | get-member

[ipaddress]$sampleIp = "192.168.1.1" | gm

access properties & and methods

PowerShell

Help System

Get-Help Get-Help

Get-Help Get-Process

help *process

help *event*

help Get-Service -Full
other type of view:
Detailed, Examples

Get-Help cmdlet ("help" alias)

Help is updatable:

Get the latest and greatest help by typing:

"Update-Help"

Command Help

Conceptual Help

Get-Help about_*

PowerShell

The Pipeline

Connecting Commands

PowerShell

Doing Administration

Where-Object

Group-Object

Sort-Object

Select-Object

PowerShell

Doing Administration (2)

ConvertTo-Csv
ConvertTo-Html
ConvertTo-Json
ConvertTo-Xml

Export-Csv

Export-Clixml

Out-File

Compare-Object

PowerShell

Extending the Shell

Create Scripts

Create Modules

PowerShell

Security Concerns

Basic Security cmdlets

Firewall Configuration

Access Control
Event Log access

PowerShell

Security Concerns (2)

Host Intrusion Detection System

My implementation

Utilizing Windows PowerShell

for Host-based IDS

Log Monitoring

My implementation

Overview

• Creating SQL Database
• Getting Events & Parsing Events
• Parsing Critical Security Events
• Storing Parsed Events in Database
• Monitoring Database Filling
• Log Visualization (3 panels)
• Getting and Display some Critical Information
• Get Database information directly from the GUI
• Make SQL Queries directrly from the GUI
• Get Database  Table and Show at a Grid View Window
• Export Database Table to CSV
• Export Database Table to HTM

My implementation

Overview

My implementation

Overview

Modules:

LogAnalysis

LogDatabase

Scripts:

ScheduleLogs.ps1
JobScheduler.ps1

LogVisualization.ps1

My implementation

My Git Hub PowerShell Repository

My Git Hub PowerShell Repository:

http://github.com/greekit/PowerShell