Qlog：一款功能強(qiáng)大的Windows安全日志工具
作者：Alpha_h4ck
Qlog是一款功能強(qiáng)大的Windows安全日志工具，該工具可以為Windows操作系統(tǒng)上的安全相關(guān)事件提供豐富的事件日志記錄功能。
關(guān)于Qlog
Qlog是一款功能強(qiáng)大的Windows安全日志工具，該工具可以為Windows操作系統(tǒng)上的安全相關(guān)事件提供豐富的事件日志記錄功能。該工具目前仍處于積極開發(fā)狀態(tài)，當(dāng)前版本為Alpha版本。Qlog沒有使用API鉤子技術(shù)，也不需要在目標(biāo)系統(tǒng)上安裝驅(qū)動程序，Qlog指揮使用ETW檢索遙測數(shù)據(jù)。當(dāng)前版本的Qlog僅支持“進(jìn)程創(chuàng)建”事件，之后還會添加更多豐富的事件支持。Qlog可以看作為Windows服務(wù)運(yùn)行，但也可以在控制臺模式下運(yùn)行，因此我們可以將豐富的事件信息直接傳輸?shù)娇刂婆_進(jìn)行處理。
工作機(jī)制
Qlog可以從ETW讀取數(shù)據(jù)，并將豐富的事件信息寫入Qlog的事件通道，工具將會創(chuàng)建并使用名為“QMonitor”的新事件源，并寫入Windows事件日志中。
以下是Qlog的事件處理順序：
- 創(chuàng)建ETW會話，并訂閱相關(guān)內(nèi)核和用戶區(qū)ETW Provider;
- 從ETW提供程序讀取事件;
- 豐富的事件支持;
- 將豐富的事件寫入事件日志通道QLOG;
工具依賴&安裝&使用
Qlog的運(yùn)行需要在本地系統(tǒng)中安裝并配置好.NET Framework >= 4.7.2環(huán)境。
接下來，我們需要使用下列命令將該項目克隆至本地：
- git clone https://github.com/threathunters-io/QLOG.git
接下來，我們可以使用下列命令以交互式終端模式運(yùn)行Qlog：
- qlog.exe
或者，以Windows服務(wù)的方式運(yùn)行：
- #安裝服務(wù)
- qlog.exe -i
- #卸載服務(wù)
- qlog.exe -u
進(jìn)程處理事件數(shù)據(jù)輸出
- {
- "EventGuid": "68795fe8-67e7-410b-a5c0-8364746d7ffe",
- "StartTime": "2021-07-11T11:06:56.9621746+02:00",
- "QEventID": 100,
- "QType": "Process Create",
- "Username": "TESTOS\\TESTUSER",
- "Imagefilename": "TEAMS.EXE",
- "KernelImagefilename": "TEAMS.EXE",
- "OriginalFilename": "TEAMS.EXE",
- "Fullpath": "C:\\Users\\TESTUSER\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe",
- "PID": 21740,
- "Commandline": "\"C:\\Users\\TESTUSER\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe\" --type=renderer --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --field-trial-handle=1668,499009601563875864,12511830007210419647,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=de --enable-wer --ms-teams-less-cors=522133263 --app-user-model-id=com.squirrel.Teams.Teams --app-path=\"C:\\Users\\jocke",
- "Modulecount": 41,
- "TTPHash": "42AC63285408F5FD91668B16F8E9157FD97046AB63E84117A14E31A188DDC62F",
- "Imphash": "F14F00FA1D4C82B933279C1A28957252",
- "sha256": "155625190ECAA90E596CB258A07382184DB738F6EDB626FEE4B9652FA4EC1CC2",
- "md5": "9453BC2A9CC489505320312F4E6EC21E",
- "sha1": "7219CB54AC535BA55BC1B202335A6291FDC2D76E",
- "ProcessIntegrityLevel": "None",
- "isOndisk": true,
- "isRunning": true,
- "Signed": "Signature valid",
- "AuthenticodeHash": "B8AD58EE5C35B3F80C026A318EEA34BABF6609C077CB3D45AEE69BF5C9CF8E11",
- "Signatures": [
- {
- "Subject": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "Issuer": "CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "NotBefore": "15.12.2020 22:24:20",
- "NotAfter": "02.12.2021 22:24:20",
- "DigestAlgorithmName": "SHA256",
- "Thumbprint": "E8C15B4C98AD91E051EE5AF5F524A8729050B2A2",
- "TimestampSignatures": [
- {
- "Subject": "CN=Microsoft Time-Stamp Service, OU=Thales TSS ESN:3BBD-E338-E9A1, OU=Microsoft America Operations, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "Issuer": "CN=Microsoft Time-Stamp PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "NotBefore": "12.11.2020 19:26:02",
- "NotAfter": "11.02.2022 19:26:02",
- "DigestAlgorithmName": "SHA256",
- "Thumbprint": "E8220CE2AAD2073A9C8CD78752775E29782AABE8",
- "Timestamp": "15.06.2021 00:39:50 +02:00"
- }
- ]
- },
- {
- "Subject": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "Issuer": "CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "NotBefore": "15.12.2020 22:31:47",
- "NotAfter": "02.12.2021 22:31:47",
- "DigestAlgorithmName": "SHA256",
- "Thumbprint": "C774204049D25D30AF9AC2F116B3C1FB88EE00A4",
- "TimestampSignatures": [
- {
- "Subject": "CN=Microsoft Time-Stamp Service, OU=Thales TSS ESN:F87A-E374-D7B9, OU=Microsoft Operations Puerto Rico, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "Issuer": "CN=Microsoft Time-Stamp PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "NotBefore": "14.01.2021 20:02:23",
- "NotAfter": "11.04.2022 21:02:23",
- "DigestAlgorithmName": "SHA256",
- "Thumbprint": "ED2C601EDD49DD2A934D2AB32DCACC19940161EF",
- "Timestamp": "15.06.2021 00:39:53 +02:00"
- }
- ]
- }
- ],
- "ParentProcess": {
- "EventGuid": null,
- "StartTime": "2021-07-11T09:54:28.9558001+02:00",
- "QEventID": 100,
- "QType": "Process Create",
- "Username": "TEST-OS\\TESTUSER",
- "Imagefilename": "",
- "KernelImagefilename": "",
- "OriginalFilename": "TEAMS.EXE",
- "Fullpath": "C:\\Users\\TESTUSER\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe",
- "PID": 16232,
- "Commandline": "C:\\Users\\TESTUSER\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe ",
- "Modulecount": 162,
- "TTPHash": "",
- "Imphash": "F14F00FA1D4C82B933279C1A28957252",
- "sha256": "155625190ECAA90E596CB258A07382184DB738F6EDB626FEE4B9652FA4EC1CC2",
- "md5": "9453BC2A9CC489505320312F4E6EC21E",
- "sha1": "7219CB54AC535BA55BC1B202335A6291FDC2D76E",
- "ProcessIntegrityLevel": "Medium",
- "isOndisk": true,
- "isRunning": true,
- "Signed": "Signature valid",
- "AuthenticodeHash": "B8AD58EE5C35B3F80C026A318EEA34BABF6609C077CB3D45AEE69BF5C9CF8E11",
- "Signatures": [
- {
- "Subject": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "Issuer": "CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "NotBefore": "15.12.2020 22:24:20",
- "NotAfter": "02.12.2021 22:24:20",
- "DigestAlgorithmName": "SHA256",
- "Thumbprint": "E8C15B4C98AD91E051EE5AF5F524A8729050B2A2",
- "TimestampSignatures": [
- {
- "Subject": "CN=Microsoft Time-Stamp Service, OU=Thales TSS ESN:3BBD-E338-E9A1, OU=Microsoft America Operations, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "Issuer": "CN=Microsoft Time-Stamp PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "NotBefore": "12.11.2020 19:26:02",
- "NotAfter": "11.02.2022 19:26:02",
- "DigestAlgorithmName": "SHA256",
- "Thumbprint": "E8220CE2AAD2073A9C8CD78752775E29782AABE8",
- "Timestamp": "15.06.2021 00:39:50 +02:00"
- }
- ]
- },
- {
- "Subject": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "Issuer": "CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "NotBefore": "15.12.2020 22:31:47",
- "NotAfter": "02.12.2021 22:31:47",
- "DigestAlgorithmName": "SHA256",
- "Thumbprint": "C774204049D25D30AF9AC2F116B3C1FB88EE00A4",
- "TimestampSignatures": [
- {
- "Subject": "CN=Microsoft Time-Stamp Service, OU=Thales TSS ESN:F87A-E374-D7B9, OU=Microsoft Operations Puerto Rico, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "Issuer": "CN=Microsoft Time-Stamp PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
- "NotBefore": "14.01.2021 20:02:23",
- "NotAfter": "11.04.2022 21:02:23",
- "DigestAlgorithmName": "SHA256",
- "Thumbprint": "ED2C601EDD49DD2A934D2AB32DCACC19940161EF",
- "Timestamp": "15.06.2021 00:39:53 +02:00"
- }
- ]
- }
- ],
- "ParentProcess": null
- }
- }
項目地址
Qlog：【GitHub傳送門】
參考資料：https://threathunters.io/
責(zé)任編輯：趙寧寧
來源：
FreeBuf
