Loading_
Loading_
Pulls the eleven event IDs that matter after a suspected compromise, correlates them into a timeline, and flags logon anomalies, cleared logs and service installs.
#Requires -Version 5.1<#.SYNOPSIS Collects and correlates the Windows event IDs that matter after a suspected compromise. .DESCRIPTION Read-only. Safe on a live host. Builds a single timeline across hosts and applies the correlations a responder makes by hand. .EXAMPLE .\Invoke-EventTriage.ps1 -ComputerName DC01,FS01 -Hours 72#>[CmdletBinding()]param( [string[]] $ComputerName = @($env:COMPUTERNAME), [int] $Hours = 72, [string] $OutputPath = ".\event-triage") New-Item -ItemType Directory -Path $OutputPath -Force | Out-Null$since = (Get-Date).AddHours(-$Hours) # The eleven that tell the story$EventMap = @{ 4624 = "Successful logon" 4625 = "Failed logon" 4648 = "Explicit credential logon (runas / lateral)"127 more lines behind the library licence
Invoke-EventTriage.ps1 · 6.1 KB · 2 dependencies documented
This one is behind the licence because it is the kind of script that does real damage when it is wrong — and the version above has already been broken and fixed by two engineers in a live estate.
After an incident nobody has time to read Event Viewer. What you need is the small set of IDs that tell the story — 4624/4625 for logons, 4720 for account creation, 7045 for service install, 1102 for a cleared log, 4698 for a new scheduled task.
This collects them across a set of hosts, normalises them into a single timeline, and applies the correlations a responder would make by hand: a 4720 followed by a 4732 adding that account to Administrators, a 4625 storm followed by a successful 4624 from the same source.
Output is a CSV timeline plus a findings list. It is read-only and safe to run on a live host during an investigation.
| Name | Type | Required | Description |
|---|---|---|---|
ComputerName | string[] | Optional | Hosts to collect from. |
Hours | int | Optional | Look-back window, default 72. |
The platform turns any script into a governed automation — versioned, gated, audited and reversible.