<div id="readability-page-1" class="page"><div>
                <div id="SE-db5a8add-2eae-4605-a432-4eeeaf69a13a">
                                    <p id="SE-9c492a8e-379f-41fe-9729-f0ffd006025c"><span id="SE-3a07e131-1c06-420e-9585-7185674bcdd4"><b>@만든 목적</b></span><span id="SE-e3e43618-22ff-4b78-bcd6-97697b27141c"> : Window 기반 Storage의 Data를 수정/삭제한 사용자 Log 확인을 위해 </span></p><p id="SE-807e25da-32f0-4608-bff8-7f566a61023c"><span id="SE-690cb764-f32d-41a5-9746-5be051a06a76">​</span></p><p id="SE-908acecc-e3c1-4f31-ae1a-378024af046d"><span id="SE-1d772501-e373-4dac-a7d0-9f0f26b6e15b">​</span></p><p id="SE-7ec9dae1-6890-40f4-acd7-7996d19da80a"><span id="SE-a9ff322c-f542-4cd4-bfda-7733fb0d210a"><b>@동작 방식</b></span><span id="SE-cfd0e35d-6627-4f49-9f0e-1b7b8aa5d54b"> : 윈도우 특정 폴더 또는 파일에 감시 정책을 설정 후 Event ID 4663의 특정 Log들을 CSV 파일로 변환하여 저장</span></p><p id="SE-faf8e57f-189b-4da9-875f-220efa0e6b50"><span id="SE-4bc751d9-a65d-4308-bd9a-00ce37a5c824">​</span></p><p id="SE-4edfe0f5-b1e2-4be7-98b0-77cd87f583bc"><span id="SE-d854bf78-12d0-46e9-a74d-2d9c47689771">​</span></p><p id="SE-f80a2e2a-298c-43e1-a47d-7ea59a8d50d9"><span id="SE-5a5f6ea1-222f-4ce0-ba25-ddf01eac87a5">그럼 아래처럼 발생 일시, 사용자, 수정/삭제 파일 / 동작 등을 CSV 파일로 변환하여 확인할 수 있다</span></p>
                            </div>                <div id="SE-981684f2-aafa-4e59-9096-b8ddccf1e199">
                                <p><a href="#" onclick="return false;" data-linktype="img" data-linkdata="{&quot;id&quot; : &quot;SE-981684f2-aafa-4e59-9096-b8ddccf1e199&quot;, &quot;src&quot; : &quot;https://mblogthumb-phinf.pstatic.net/MjAyNDAxMTJfOTcg/MDAxNzA1MDM5Njk4Nzcz.Uk0YkqD7-TN1iHQfgfAF9c_ld7K6dpBcG2VACpRaLCwg.yXAFUQl844tVmL4e9fcVxtSfg4k6s3xoSY5rPgV-fkYg.PNG.appeal7712/image.png&quot;, &quot;originalWidth&quot; : &quot;950&quot;, &quot;originalHeight&quot; : &quot;108&quot;, &quot;linkUse&quot; : &quot;false&quot;, &quot;link&quot; : &quot;&quot;}">
                                        <img src="https://mblogthumb-phinf.pstatic.net/MjAyNDAxMTJfOTcg/MDAxNzA1MDM5Njk4Nzcz.Uk0YkqD7-TN1iHQfgfAF9c_ld7K6dpBcG2VACpRaLCwg.yXAFUQl844tVmL4e9fcVxtSfg4k6s3xoSY5rPgV-fkYg.PNG.appeal7712/image.png?type=w800" data-width="693" data-height="78" alt="">
                                    </a>
                                </p>
                        </div>
                <div id="SE-434be54f-0e29-4537-be2e-ab0ee6d9f49a">
                                    <p id="SE-e5f26c59-a59e-404b-b90d-677b6330146b"><span id="SE-4906dc98-5945-4982-b15a-2b11b739a683">​</span></p><p id="SE-f040241e-9012-4580-8cae-df388c5bbb95"><span id="SE-1d586f0e-e2dc-4df5-bb22-1be9f2766a26">​</span></p><p id="SE-8a2a5f53-3bf9-4f5f-8507-aa37d4c2deea"><span id="SE-7fd64b0e-fd9a-493a-b774-95bb038d16f2">​</span></p><p id="SE-a9cd1084-eb2d-4b98-b408-c5e110cd46a8"><span id="SE-6b62984a-4b58-4f5e-86fc-1dc8d045b33b"><b>@Chat GPT가 만들어준 파이썬 코드</b></span></p>
                            </div>                <div id="SE-5653f3db-0dff-43f0-bde6-c164cc2ce9f2">
                                <p><a href="#" onclick="return false;" data-linktype="img" data-linkdata="{&quot;id&quot; : &quot;SE-5653f3db-0dff-43f0-bde6-c164cc2ce9f2&quot;, &quot;src&quot; : &quot;https://mblogthumb-phinf.pstatic.net/MjAyNDAxMTJfMjU4/MDAxNzA1MDQyMjY1OTM3.5JxlYbgQDkMDtlzdKRrzEGWT9Lke-5cOjMhvr-JIm5Qg.yW1gwVIJlLSS2VIgnoiEJY0FCHPpcro00SzxIRcbSuIg.PNG.appeal7712/image.png&quot;, &quot;originalWidth&quot; : &quot;662&quot;, &quot;originalHeight&quot; : &quot;183&quot;, &quot;linkUse&quot; : &quot;false&quot;, &quot;link&quot; : &quot;&quot;}">
                                        <img src="https://mblogthumb-phinf.pstatic.net/MjAyNDAxMTJfMjU4/MDAxNzA1MDQyMjY1OTM3.5JxlYbgQDkMDtlzdKRrzEGWT9Lke-5cOjMhvr-JIm5Qg.yW1gwVIJlLSS2VIgnoiEJY0FCHPpcro00SzxIRcbSuIg.PNG.appeal7712/image.png?type=w800" data-width="662" data-height="183" alt="">
                                    </a>
                                </p>
                        </div>
                                <div id="SE-80f937c2-5c5b-4426-be7a-a40fb850c538">
                                    <p>import csv
import win32evtlog
import win32api

def get_current_username():
    return win32api.GetUserName()

def main():
    log_file_path = "C:\\event_log_4663.csv"
    target_event_id = 4663

    try:
        with open(log_file_path, mode="a", newline="") as file:
            event_log_flags = win32evtlog.EVENTLOG_BACKWARDS_READ | win32evtlog.EVENTLOG_SEQUENTIAL_READ
            hand = win32evtlog.OpenEventLog(None, "Security")
            flags = win32evtlog.EVENTLOG_BACKWARDS_READ | win32evtlog.EVENTLOG_SEQUENTIAL_READ

            events = win32evtlog.ReadEventLog(hand, event_log_flags, 0)
            while events:
                for event in events:
                    event_id = event.EventID
                    if event_id == target_event_id:
                        event_time = event.TimeGenerated.Format()
                        subject_user_name = event.StringInserts[1]  # SubjectUserName이 있는 위치로 수정

                        object_name = event.StringInserts[6]
                        access_list = ""

                        for string_insert in event.StringInserts:
                            if "%%1537" in string_insert:
                                access_list = "DELETE"
                                break

                        if access_list == "DELETE":
                            print(f"Event ID: {event_id}, Time: {event_time}, SubjectUserName: {subject_user_name}, ObjectName: {object_name}, AccessList: {access_list}")
                            file.write(f"Event ID: {event_id}, Time: {event_time}, SubjectUserName: {subject_user_name}, ObjectName: {object_name}, AccessList: {access_list}\n")

                events = win32evtlog.ReadEventLog(hand, event_log_flags, 0)

            win32evtlog.CloseEventLog(hand)
    except Exception as e:
        print(f"An exception occurred: {e}")

if __name__ == "__main__":
    main()
</p>
                                </div>                                <div id="SE-383442a3-c2d7-44f8-a166-46f021cba2ce">
                                    <p>pyinstaller --onefile --icon=C:\Users\it_youngmin_bang\Desktop\LOGO\keyring_logo_mini.ico C:\Users\it_youngmin_bang\Desktop\FileDelete_LOG.py</p>
                                </div>                                <div id="SE-1fdf2a42-76db-42b3-9df0-23fb1e0f417b">
                                <p><a href="#" onclick="return false;" data-linktype="img" data-linkdata="{&quot;id&quot; : &quot;SE-1fdf2a42-76db-42b3-9df0-23fb1e0f417b&quot;, &quot;src&quot; : &quot;https://mblogthumb-phinf.pstatic.net/MjAyNDAxMTJfNzEg/MDAxNzA1MDQyMTU2NDM4.Jg0-y-ZPqNdYTHdd-grie1zOyF31kLDziUUiYS2Awmgg.fj1nNUR5sE8vFMZIvYRkBF5iXJOfVxlw6OgJEltvYkgg.PNG.appeal7712/image.png&quot;, &quot;originalWidth&quot; : &quot;195&quot;, &quot;originalHeight&quot; : &quot;132&quot;, &quot;linkUse&quot; : &quot;false&quot;, &quot;link&quot; : &quot;&quot;}">
                                        <img src="https://mblogthumb-phinf.pstatic.net/MjAyNDAxMTJfNzEg/MDAxNzA1MDQyMTU2NDM4.Jg0-y-ZPqNdYTHdd-grie1zOyF31kLDziUUiYS2Awmgg.fj1nNUR5sE8vFMZIvYRkBF5iXJOfVxlw6OgJEltvYkgg.PNG.appeal7712/image.png?type=w800" data-width="195" data-height="132" alt="">
                                    </a>
                                </p>
                        </div>
                    </div></div>

리눅스,네트워크,모의해킹 및 보안

@만든 목적 : Window 기반 Storage의 Data를 수정/삭제한 사용자 Log 확인을 위해 @동작 방식 : 윈도우 특정 폴더 또는 파일에 감시 정책을 설정 후 Event ID 4663의 특정 Log들을 CSV 파일로 변환하여 저장 그럼 아래처럼 발생 일시, 사용자, 수정/삭제 파일 / 동작 등을 CSV 파일로 변환하여 확인할 수 있다 @Chat GPT가 만들어준 파이썬 코드 #.py @.py 파일을 exe 파일로 변환 #CMD 가끔 사용할 것 같다.

이벤트 로그 수집 스크립트 feat.ChatGPT

댓글