Skip to content

Instantly share code, notes, and snippets.

@bobalob
Last active September 16, 2020 19:15
Show Gist options
  • Save bobalob/6279124f97dbdc776024bc000565287d to your computer and use it in GitHub Desktop.
Save bobalob/6279124f97dbdc776024bc000565287d to your computer and use it in GitHub Desktop.
Param(
[Parameter(Mandatory=$true)]
[String]
$computerName,
[Int]
$maxEvents = 1000
)
$commands = @()
(Invoke-Command -ArgumentList $maxEvents -ScriptBlock {
Get-WinEvent -MaxEvents $Args[0] -FilterHashTable @{ LogName = "Security"; ID = 4688 }
} -ComputerName $computerName ) |
Foreach-Object {
$commands += $_
$time = $_.TimeCreated ; $_.Message -split "\n" } |
Where-Object { $_ -match "Process Command Line" } |
Foreach-Object { $command = ([String]$_ -split ":",2)[1].Trim()
Write-Host "[$($time)] $($command)"
}
# Or 1 liner
# $commands = @() ; (Invoke-Command -ScriptBlock {Get-WinEvent -MaxEvents 1000 -FilterHashTable @{ LogName = "Security"; ID = 4688 }} -ComputerName $computerName ) | % { $commands += $_ ; $time = $_.TimeCreated ; $_.Message -split "\n" } | ? { $_ -match "Process Command Line" } | % { $command = ([String]$_ -split ":",2)[1].Trim() ; Write-Host "[$($time)] $($command)" }
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment