Skip to content

Instantly share code, notes, and snippets.

@et0x
Last active September 11, 2016 04:33
Show Gist options
  • Save et0x/c651f935140a028487b0297857682bdd to your computer and use it in GitHub Desktop.
Save et0x/c651f935140a028487b0297857682bdd to your computer and use it in GitHub Desktop.
View events generated (good for forensic research) when actions occur. Just run Get-EventDiff then press another key to stop listening.
function Get-EventDiff
{
$startTime = [datetime]::Now
Write-Warning "Press any key to stop listening for generated events ..."
$Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") | Out-Null
# set an endtime in case the Get-WinEvent query takes a few seconds to complete
$endTime = [datetime]::Now
Get-WinEvent -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt $startTime -and $_.TimeCreated -lt $endTime }
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment