Help with Get-WinEvent cmd to find when the \\*\PRINT share was accessed using a folder of logs

After 4 Hours for try , Finally it is work by one of these two commond line:

Get-WinEvent -Path “C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement*.evtx” | Where-Object { $_.Properties.Value -like ‘\*\PRINT’ } | format-list


Get-WinEvent -Path “C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement*.evtx” | Where-Object { $_.Properties.Value -like ‘\*\PRINT’ } | format-table

I dont know why this did not work for me, in the end i just opened all the logs that seemed like that could be it

ID 5142,

I use command

Get-WinEvent -Path “C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement*.evtx” |
Where-Object { $_.Properties.Value -like ‘\PRINT’ } |
Format-Table TimeCreated, Id, ProviderName, Message -AutoSize

You will see network share object was added…

that answer 1x:x0:x0

You can run this command and you will get the answer:

Get-ChildItem -Path 'C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement' | ForEach-Object {
>> $logFile = $_.FullName
>> Get-WinEvent -Path $logFile |  Where-Object { $_.Properties.Value -like '\\*\PRINT' } | Select-Object TimeCreated, ID, ProviderName, LevelDisplayName, Message | Format-Table -AutoSize}
1 Like

when forcing chatgpt to use Get-winevent i got this and it worked :
Get-WinEvent -Path (Get-Item “C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement*.evtx”).FullName | Where-Object { $.Message -like “\\PRINT*” } | Format-Table TimeCreated, Id, Message
and using Get-childitem this worked:
Get-ChildItem “C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement” -Filter *.evtx | ForEach-Object { Get-WinEvent -Path $
.FullName | Where-Object { $_.Message -like “\\PRINT*” } } | Format-Table TimeCreated, Id, Message