Skip to content

Instantly share code, notes, and snippets.

View medmondson44's full-sized avatar

Marcus Edmondson medmondson44

View GitHub Profile
medmondson44 / Get-WindowsEvents.ps1
Created December 29, 2020 14:43
This is a fork of the Endgame script scrape-events.ps1. I gave it more functionality to take any event log and to be able to query remotely or take a path to the event log. Original Endgame script cant be found here:
function Get-EventProps {
Param (
Process {
$eventXml = [xml]$event.ToXML()
$eventKeys = $eventXml.Event.EventData.Data
$Properties = @{}
medmondson44 / EventParser.ps1
Created September 22, 2019 11:22
This PowerShell script is used to parse Windows events.
Function Get-PowerShellLog {
Get-PowerShellLog extracts all PowerShell ScriptBlock Events [Evt 4104] from the Microsoft-Windows-PowerShell/Operational Event log for a specified timeframe
Query the event log and pull back all PowerShell ScriptBlock Events.
Event 4104
Query and filter
Switch to pull back PowerShell ScriptBlock Log back a desired number of minutes