Skip to content

Instantly share code, notes, and snippets.

@mattifestation

mattifestation/process_image_logging.ps1

Created January 31, 2019 17:52
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 5 You must be signed in to fork a gist
  • Save mattifestation/bab269fe32bfc2f7770d42f385343333 to your computer and use it in GitHub Desktop.
Save mattifestation/bab269fe32bfc2f7770d42f385343333 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
process_image_logging.ps1
# These values were obtained from: logman query providers Microsoft-Windows-Kernel-Process
$WINEVENT_KEYWORD_PROCESS = 0x10
$WINEVENT_KEYWORD_IMAGE = 0x40
# Normally when you enable an analytic log, all keywords are logged which can be veeeeerrrrryy noisy.
# I'm going to limit collection to only image and process event
$KernelProcessLog = New-Object -TypeName System.Diagnostics.Eventing.Reader.EventLogConfiguration -ArgumentList 'Microsoft-Windows-Kernel-Process/Analytic'
$KernelProcessLog.ProviderKeywords = ($WINEVENT_KEYWORD_PROCESS -bor $WINEVENT_KEYWORD_IMAGE)
$KernelProcessLog.ProviderLevel = 0xFF
$KernelProcessLog.IsEnabled = $true
# Enable the log with the settings we specified
$KernelProcessLog.SaveChanges()
# Retrieve process start/stop and image/unload load events
Get-WinEvent -LogName 'Microsoft-Windows-Kernel-Process/Analytic' -Oldest
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment