用powershell获取sysmon日志

想用powershell获取sysmon日志还是比较麻烦，开始以为用Get-EventLog就行，结果试了半天报错：

PS D:\> Get-EventLog -LogName Microsoft-Windows-Sysmon/Operational -Newest 20
Get-EventLog : 计算机“.”上的事件日志“Microsoft-Windows-Sysmon/Operational”不存在。
所在位置 行:1 字符: 1
+ Get-EventLog -LogName Microsoft-Windows-Sysmon/Operational -Newest 20
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-EventLog], InvalidOperationException
    + FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.PowerShell.Commands.GetEventLogCommand

上网发现大家都是用的 Get-WinEvent，看了下帮助文档，这个Cmdlet可以获取所有本地和远程计算机的日志，使用-ListLog *可以获取当前主机的所有类型的日志

PS C:\> Get-WinEvent -ListLog *

LogMode   MaximumSizeInBytes RecordCount LogName
-------   ------------------ ----------- -------
Circular            20971520       24186 Application
Circular            20971520           0 HardwareEvents
Circular             1052672           0 Internet Explorer
Circular            20971520           0 Key Management Service
Circular             1052672         117 OAlerts
Circular             1052672           0 PreEmptive
Circular            20971520       25272 Security
Circular            20971520       13277 System
Circular            15728640        4381 Windows PowerShell
Circular             1052672           0 AMSI/Operational
Circular            20971520             ForwardedEvents
Circular             1052672         200 Lenovo-Power-BaseModule/Operational
Circular            10485760           0 Microsoft-AppV-Client/Admin
Circular            10485760           0 Microsoft-AppV-Client/Operational
Circular            10485760           0 Microsoft-AppV-Client/Virtual Applications
Circular             1052672        2103 Microsoft-Client-Licensing-Platform/Admin
Circular             1052672             Microsoft-Management-UI/Admin
Circular             1052672           0 Microsoft-Rdms-UI/Admin
Circular             1052672           0 Microsoft-Rdms-UI/Operational
Circular             1052672           0 Microsoft-User Experience Virtualization-Agent 
......

根据网上的例子，使用哈希表同时指定日志类型和事件ID，可以查询sysmon的某类ID的事件日志

PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 10


   ProviderName:Microsoft-Windows-Sysmon

TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
2019/4/1 22:23:35               17 信息             Pipe Created:...
2019/4/1 22:23:35               17 信息             Pipe Created:...
2019/4/1 22:23:35               17 信息             Pipe Created:...
2019/4/1 22:23:34               17 信息             Pipe Created:...
2019/4/1 22:23:34               17 信息             Pipe Created:...
2019/4/1 22:23:34               17 信息             Pipe Created:...
2019/4/1 22:23:33               17 信息             Pipe Created:...
2019/4/1 22:23:33               17 信息             Pipe Created:...
2019/4/1 22:23:33               17 信息             Pipe Created:...
2019/4/1 22:23:33               17 信息             Pipe Created:...

接下来我希望获取日志中的其他消息，想到使用 Format-Table指定属性的方法，首先我查询到sysmon的事件ID为17的日志中的属性有：RuleName，UtcTime，ProcessGuid，ProcessId，PipeName，Image，然后用指定属性输出：

PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 10 | Format-Tab
le -Property UtcTime,processguid, processid,pipename,image -AutoSize -Wrap

UtcTime processguid ProcessId pipename image
------- ----------- --------- -------- -----
                         4140
                         4140
                         4140
                         4140
                         4140
                         4140
                         4140
                         4140
                         4140
                         4140

但是发现只有一个ProcessId有值，其他都为空！这就很奇怪。然后使用 Format-List * 获取一下日志的属性都有什么：

PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 10 | Format-List *


Message              : Pipe Created:
                       RuleName:
                       UtcTime: 2019-04-01 14:23:35.814
                       ProcessGuid: {791A80C2-1EE7-5CA2-0000-0010E60FF000}
                       ProcessId: 6724
                       PipeName: <Anonymous Pipe>
                       Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Id                   : 17
Version              : 1
Qualifiers           :
Level                : 4
Task                 : 17
Opcode               : 0
Keywords             : -9223372036854775808
RecordId             : 113253
ProviderName         : Microsoft-Windows-Sysmon
ProviderId           : 5770385f-c22a-43e0-bf4c-06f5698ffbd9
LogName              : Microsoft-Windows-Sysmon/Operational
ProcessId            : 4140
ThreadId             : 6228
MachineName          : DESKTOP-DKGHJUN
UserId               : S-1-5-18
TimeCreated          : 2019/4/1 22:23:35
ActivityId           :
RelatedActivityId    :
ContainerLog         : Microsoft-Windows-Sysmon/Operational
MatchedQueryIds      : {}
Bookmark             : System.Diagnostics.Eventing.Reader.EventBookmark
LevelDisplayName     : 信息
OpcodeDisplayName    : 信息
TaskDisplayName      : Pipe Created (rule: PipeEvent)
KeywordsDisplayNames : {}
Properties           : {System.Diagnostics.Eventing.Reader.EventProperty,
                      System.Diagnostics.Eventing.Reader.EventProperty,
                        System.Diagnostics.Eventing.Reader.EventProperty, 
                        System.Diagnostics.Eventing.Reader.EventProperty...}
......

结果发现日志的信息都在Message里面，连显示的进程ID都是错的。知道原因了，也就是说获取sysmon的日志信息的话只需要显示一条Message就够了。

PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 10 | Format-Table -Property message -Wrap

Message
-------
Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.814
ProcessGuid: {791A80C2-1EE7-5CA2-0000-0010E60FF000}
ProcessId: 6724
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Pipe Created:
RuleName:
UtcTime: 2019-04-01 14:23:35.751
ProcessGuid: {791A80C2-1EE7-5CA2-0000-00108D0AF000}
ProcessId: 856
PipeName: <Anonymous Pipe>
Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Pipe Created:

但是这种结果并不利于查看，需要在前面添加几列信息，让每一条结果能显示的更易于区分。通过 Format-List * 查看有哪些属性是比较有用的，这次选择 ID，TaskDisplayName 这两项：

PS C:\> Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational';id=17} -MaxEvents 5 | Format-Table -Property ID,TaskDisplayName,message -Wrap

Id TaskDisplayName                Message
-- ---------------                -------
17 Pipe Created (rule: PipeEvent) Pipe Created:
                                  RuleName:
                                  UtcTime: 2019-04-01 14:23:35.814
                                  ProcessGuid: {791A80C2-1EE7-5CA2-0000-0010E60FF000}
                                  ProcessId: 6724
                                  PipeName: <Anonymous Pipe>
                                  Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
17 Pipe Created (rule: PipeEvent) Pipe Created:
                                  RuleName:
                                  UtcTime: 2019-04-01 14:23:35.751
                                  ProcessGuid: {791A80C2-1EE7-5CA2-0000-00108D0AF000}
                                  ProcessId: 856
                                  PipeName: <Anonymous Pipe>
                                  Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
17 Pipe Created (rule: PipeEvent) Pipe Created:
                                  RuleName:
                                  UtcTime: 2019-04-01 14:23:35.353
                                  ProcessGuid: {791A80C2-1EE7-5CA2-0000-00103F04F000}
                                  ProcessId: 10636
                                  PipeName: <Anonymous Pipe>
                                  Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
......

但是这个结果也不好，因为获取到某个ID的日志后不能继续搜索了。

遗留了两个问题：

1. Get-EventLog和Get-WinEvent两个cmdlet的差异在哪里？
2. 如何进一步筛选sysmon日志？