Windows Event Logs & IIS

#Software: Microsoft Internet Information Services 10.0
#Date: 2025-04-10 14:00:00
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2025-04-10 14:05:33 10.0.0.5 GET /index.html - 443 - 203.0.113.42 Mozilla/5.0+... https://referrer.com/ 200 0 0 234

# Get last 50 errors from System log
Get-WinEvent -LogName System -MaxEvents 50 |
    Where-Object { $_.Level -eq 2 } |
    Select-Object TimeCreated, Id, Message

# Find all failed logins (EventID 4625)
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4625]]" -MaxEvents 100

# Find successful logins with details (EventID 4624)
$filter = @{
    LogName   = 'Security'
    Id        = 4624
    StartTime = (Get-Date).AddHours(-24)
}
Get-WinEvent -FilterHashtable $filter | ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
        Time        = $_.TimeCreated
        User        = $xml.Event.EventData.Data[5].'#text'
        LogonType   = $xml.Event.EventData.Data[8].'#text'
        SourceIP    = $xml.Event.EventData.Data[18].'#text'
        WorkStation = $xml.Event.EventData.Data[11].'#text'
    }
}

# Export failed logins to CSV
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4625]]" |
    Select-Object TimeCreated, Message |
    Export-Csv C:\Temp\failed_logins.csv -NoTypeInformation

# Detect new services (possible malware persistence)
Get-WinEvent -LogName System -FilterXPath "*[System[EventID=7045]]"

# Check if security log was cleared (CRITICAL)
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=1102]]"

# Find locked out accounts (4740)
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4740]]" |
    ForEach-Object {
        $xml = [xml]$_.ToXml()
        [PSCustomObject]@{
            Time       = $_.TimeCreated
            Account    = $xml.Event.EventData.Data[0].'#text'
            LockedFrom = $xml.Event.EventData.Data[1].'#text'
        }
    }

# Parse IIS logs for slow requests (>5s = 5000ms)
Get-Content "C:\inetpub\logs\LogFiles\W3SVC1\u_ex250410.log" |
    Where-Object { $_ -notlike '#*' } |
    ConvertFrom-Csv -Delimiter ' ' -Header date,time,sip,method,uri,query,sport,csuser,cip,ua,ref,status,substatus,win32status,timetaken |
    Where-Object { [int]$_.timetaken -gt 5000 } |
    Select-Object date, time, method, uri, status, timetaken |
    Sort-Object timetaken -Descending |
    Select-Object -First 20