base64extract inclusion of additional PowerShell EID's (4100, 4102, 403, 600)

[cyfub]

Would it be possible for base64extract to include additional event ID's from both Windows PowerShell event logs?

Microsoft-Windows-PowerShell%4Operational.evtx

• 4100
• 4102

For the above events, the EventData from "ContextInfo" would need to be parsed. There is other useful information in the event which could also be parsed, including the "Payload" which has the Error Message and Error ID.

Example EventData from 4100

{
    "EventData": {
        "Data": [
            {
                "@Name": "ContextInfo",
                "#text": "        
				Severity = Warning,
				Host Name = ConsoleHost,
				Host Version = 4.0,
				Host ID = 5f2b9c8e-1d47-4f3a-b6c2-9a7e21d4c0f8,
				Host Application = powershell -encodedcommand JABjAHIAZQBkACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQA,
				Engine Version = 4.0,
				Runspace ID = 8a1f2d5c-6b94-4e37-a9c1-3f7d82e6b0ad,				
				Pipeline ID = 1,
				Command Name = ,
				Command Type = ,
				Script Name = ,         
				Command Path = ,
				Sequence Number = 18,
				User = DOMAIN\\Username,
				Shell ID = Microsoft.PowerShell, "
            },
            {
                "@Name": "UserData"
            },
            {
                "@Name": "Payload",
                "#text": "
				Error Message = Attempting to perform the MakePath operation operation on the 'FileSystem' provider failed for path 'C:\\'. The FileSystem provider supports credentials only on the New-PSDrive cmdlet. Perform the operation again without specifying credentials.,
				Fully Qualified Error ID = NotSupported, Provider name = FileSystem, "
            }
        ]
    }
}

Example EventData from 4102

`{
    "EventData": {
        "Data": [
            {
                "@Name": "ContextInfo",
                "#text": "        
				
				
				Severity = Warning,         
				Host Name = ConsoleHost,         
				Host Version = 4.0,         
				Host ID = 5f2b9c8e-1d47-4f3a-b6c2-9a7e21d4c0f8,  
				Host Application = powershell -encodedcommand CgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgA,         
				Engine Version = 4.0,         
				Runspace ID = 8a1f2d5c-6b94-4e37-a9c1-3f7d82e6b0ad,         
				Pipeline ID = 1,     			
				Command Name = New-Object,
				Command Type = Cmdlet,         
				Script Name = C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\NetTCPIP\\Test-NetConnection.psm1,         
				Command Path = ,         
				Sequence Number = 19,         
				User = DOMAIN\\Username,         
				Shell ID = Microsoft.PowerShell, "
            },
            {
                "@Name": "UserData"
            },
            {
                "@Name": "Payload",
                "#text": "
				Error Message = Exception calling \".ctor\" with \"2\" argument(s): \"A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 999.999.99[.]999:22\", 
				Fully Qualified Error ID = ConstructorInvokedThrowException,Microsoft.PowerShell.Commands.NewObjectCommand, "
            }
        ]
    }
}`

Windows PowerShell.evtx:

• 400 is already parsed
• 403
• 600

Thank you for all the work you do on Hayabusa and supporting this great utility!

[YamatoSecurity]

@cyfub Thanks for the idea. I implemented it here: #1889
You can compile the main branch or what until the next release to check it out. Let me know if it does not work for you.