Skip to content

Instantly share code, notes, and snippets.

View jkbryan's full-sized avatar

Jon Bryan jkbryan

1 follower · 0 following
View GitHub Profile
@jkbryan
jkbryan / LogParser-Files-User.sql
Created March 9, 2019 22:00
Find strings like 'jon' or 'dave' in the exported security event log(s) held in C;\TEMP\logs
SELECT * INTO C:\TEMP\Output\output.csv
FROM C:\TEMP\Logs\*
WHERE TimeWritten > TIMESTAMP ( '2009-01-01 01:00:00', 'yyyy-MM-dd hh:mm:ss' ) AND SourceName = 'Microsoft-Windows-Security-Auditing' AND
( Strings LIKE '%jon%' OR strings LIKE '%dave%')
@jkbryan
jkbryan / LogParser-Servers-User.sql
Created March 8, 2019 21:09
Find strings like 'jon' or 'dave' in the security event log of the servers named DC01.OHOLICS.NET, DC03.OHOLICS.NET and DC03.OHOLICS.NET
SELECT * INTO C:\TEMP\Output\output.csv
FROM \\DC01.OHOLICS.NET\security;\\DC02.OHOLICS.NET\security;\\DC03.OHOLICS.NET\security
WHERE TimeWritten > TIMESTAMP ( '2009-01-01 01:00:00', 'yyyy-MM-dd hh:mm:ss' ) AND SourceName = 'Microsoft-Windows-Security-Auditing' AND
( Strings LIKE '%jon%' OR strings LIKE '%dave%')
@jkbryan
jkbryan / LogParser-Server-User.sql
Created March 8, 2019 11:25
Find strings like 'jon' or 'dave' in the security event log of a server named DC01.OHOLICS.NET
SELECT * INTO C:\TEMP\Output\output.csv
FROM \\DC01.OHOLICS.NET\security
WHERE TimeWritten > TIMESTAMP ( '2009-01-01 01:00:00', 'yyyy-MM-dd hh:mm:ss' ) AND SourceName = 'Microsoft-Windows-Security-Auditing' AND
( Strings LIKE '%jon%' OR strings LIKE '%dave%')
@jkbryan
jkbryan / LogParserRedaction.sql
Last active March 7, 2019 23:17
LogParserRedactionSQL
SELECT
EventLog,
RecordNumber,
TimeGenerated,
TimeWritten,
EventID,
EventType,
EventTypeName,
EventCategory,
EventCategoryName,
@jkbryan
jkbryan / Get-AzureNSGs.ps1
Last active February 8, 2019 21:21
A script to present Azure NSG's into a csv file
Connect-AzureRmAccount
$Subscription = "<Subscription-GUID>"
$LogFile = "C:\<PATH>\NSGs.csv"
If (Test-Path $Logfile) {
Clear-Content -Path $Logfile
}
Add-Content $LogFile "nsg,rule,protocol,SourcePortRange,DestinationPortRange,SourceAddressPrefix,DestinationAddressPrefix,SourceApplicationSecurityGroups,DestinationApplicationSecurityGroups,Access,Priority,Direction"
Set-AzureRmContext -Subscription $Subscription
$NSGs = Get-AzureRmNetworkSecurityGroup
foreach ($nsg in $NSGs) {
@jkbryan
jkbryan / Get-AzureRoutes.ps1
Created February 8, 2019 20:57
A script to present Azure Route Tables into a csv file
Connect-AzureRmAccount
$Subscription = "<Subscription-GUID>"
$LogFile = "C:\<PATH>\RouteTables.csv"
If (Test-Path $Logfile) {
Clear-Content -Path $Logfile
}
Add-Content $Logfile "Name,ResourceGroupName,Location,RouteName,Id,Etag,ProvisioningState,AddressPrefix,NextHopType,NextHopIpAddress"
Set-AzureRmContext -Subscription $Subscription
$RTs = Get-AzureRmRouteTable
ForEach ($RT in $RTs) {
@jkbryan
jkbryan / ConnectToAzureADOrAzureRM.ps1
Created January 30, 2019 23:19
Use the Service Principle created previosly to connect to services - Azure AD and AzureRM as examples
$TenantId = "<AzureADTenantID>"
$ApplicationId = "<AppID>"
$Cert=Get-ChildItem cert:\CurrentUser\My\"<CertificateThumbprint>"
# Connect to Azure AD:
Connect-AzureAD -TenantId $TenantId -ApplicationId $ApplicationId -CertificateThumbprint $Cert.Thumbprint
# e.g. Get-AzureADUsers
# Connect to AzureRM:
Connect-AzureRmAccount -CertificateThumbprint $Cert.Thumbprint -ApplicationId $ApplicationId -Tenant $TenantId -ServicePrincipal
# e.g. Get-AzureRMResourceGroup
@jkbryan
jkbryan / GrantServicePrincipleAzureSubscriptionReadAccess.ps1
Created January 30, 2019 23:12
Grants an Azure Service Principle READ access to the Subscription
$Subscription = "<Subscription-GUID>"
$ApplicationName = "<AppName>"
$ServicePrincipal = Get-AzureRMADServicePrincipal -DisplayName $ApplicationName
Set-AzureRmContext -Subscription $Subscription
$NewRole = $null
$Retries = 0;
While ($NewRole -eq $null -and $Retries -le 6) {
Sleep 15
New-AzureRMRoleAssignment -ResourceGroupName -RoleDefinitionName Reader -ServicePrincipalName $ServicePrincipal.ApplicationId | Write-Verbose -ErrorAction SilentlyContinue
$NewRole = Get-AzureRMRoleAssignment -ObjectId $ServicePrincipal.Id -ErrorAction SilentlyContinue
@jkbryan
jkbryan / CreateAzureServicePrinciple.ps1
Last active January 30, 2019 23:14
Creates an Azure Service Principle named <AppName> in the Subscription
$Subscription = "<Subscription-GUID>"
$PathToPFXCertificate = "C:\<PATH>\<CertName>.pfx"
$PFXPassword = "<Password>"
$CertPassword = ConvertTo-SecureString $PFXPassword -AsPlainText -Force
$ApplicationName = "<AppName>"
Import-Module AzureRM.Resources
Connect-AzureRmAccount
Set-AzureRmContext -Subscription $Subscription
$PFXCert = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList @($PathToPFXCertificate, $CertPassword)
$KeyValue = [System.Convert]::ToBase64String($PFXCert.GetRawCertData())
@jkbryan
jkbryan / openssl.cfg
Last active January 8, 2019 23:11
Basic OpenSSL configuration file for generating server authentication SSL certificates
#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#
# This definition stops the following lines choking if HOME isn't
# defined.
HOME = .
RANDFILE = $ENV::HOME/.rnd