Help with Get-WinEvent cmd to find when the \\*\PRINT share was accessed using a folder of logs

HTB Content Academy
37

After 4 Hours for try , Finally it is work by one of these two commond line:

Get-WinEvent -Path “C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement*.evtx” | Where-Object { $_.Properties.Value -like ‘\*\PRINT’ } | format-list

OR

Get-WinEvent -Path “C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement*.evtx” | Where-Object { $_.Properties.Value -like ‘\*\PRINT’ } | format-table

38

I dont know why this did not work for me, in the end i just opened all the logs that seemed like that could be it

ID 5142,

39

I use command

Get-WinEvent -Path “C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement*.evtx” |
Where-Object { $_.Properties.Value -like ‘\PRINT’ } |
Format-Table TimeCreated, Id, ProviderName, Message -AutoSize

You will see network share object was added…

that answer 1x:x0:x0

40

You can run this command and you will get the answer:

Get-ChildItem -Path 'C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement' | ForEach-Object {
>> $logFile = $_.FullName
>> Get-WinEvent -Path $logFile |  Where-Object { $_.Properties.Value -like '\\*\PRINT' } | Select-Object TimeCreated, ID, ProviderName, LevelDisplayName, Message | Format-Table -AutoSize}
1 Like
41

when forcing chatgpt to use Get-winevent i got this and it worked :
Get-WinEvent -Path (Get-Item “C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement*.evtx”).FullName | Where-Object { $.Message -like “\\PRINT*” } | Format-Table TimeCreated, Id, Message
and using Get-childitem this worked:
Get-ChildItem “C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement” -Filter *.evtx | ForEach-Object { Get-WinEvent -Path $.FullName | Where-Object { $_.Message -like “\\PRINT*” } } | Format-Table TimeCreated, Id, Message

42

Answer Q1 GetWin Event
Answer Q1 GetWin Event1342×324 81.8 KB

43

Added where? when I run the previously mentioned command I get nothing on the powershell window… :frowning:

44

PS C:\Tools\GhostPack Compiled Binaries>$SearchString="\\*\PRINT"

PS C:\Tools\GhostPack Compiled Binaries> Get-WinEvent -Path 'C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement\*.evtx' | Where-Object{$_.Message -like "*$SearchString*"}

45

Hi Alharbi1980,

Hate to say it but in my case none of the tips/ideas/etc posted on this subject worked for me, none of the command listed here worked.
They run, no errors, just an empty prompt, no output, as if it ran successfully but there was no data to output!!!
I even opened every .evtx file inside C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement and did a search for \\PRINT’ and no luck, no results!!

Anyway, thank you every one for the posts!!!

Cheers,

46

Use this query to solve the task:

Get-WinEvent -Path ‘C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement*.evtx’ | Where-Object { $_.Properties.Value -like ‘\*\PRINT’ } | Select-Object TimeCreated, ID, ProviderName, LevelDisplayName, Message | Format-Table -AutoSize

47

A farily easy task make sure u read every thing
command : Get-WinEvent -Path ‘C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement*.evtx’|Where-Object{$_.Message -like “\Print”}|Select-Object TimeCreated,Message|Format-Table -AutoSize

  • __* exist between on the sides of \Print
48

Asterisks were lost after posting, correct syntax:

Get-WinEvent -Path 'C:\Tools\chainsaw\EVTX-ATTACK-SAMPLES\Lateral Movement\*.evtx' | Where-Object{$_.Message -like "*\Print*"}|Select-Object TimeCreated,Message|Format-Table -AutoSize