KStrike

Stand-alone parser for User Access Logging from Server 2012 and newer systems

BriMor Labs

KStrike

This script will parse data from the User Access Logging files contained on Windows Server 2012 and newer systems, found under the path "\Windows\System32\Logfiles\SUM" (please visit the KPMG blog post at https://advisory.kpmg.us/blog/2021/digital-forensics-incident-response.html for more details. For documentation on these files, please visit the official documentation page at https://docs.microsoft.com/en-us/windows-server/administration/user-access-logging/manage-user-access-logging

Usage

Run the script from the command line, afer you have extracted the database files from the SUM folder. This script is written for Python2. Python3 support is on the roadmap.

This script will parse on-disk User Access Logging found on Windows Server 2012
and later systems, found under the path "\Windows\System32\Logfiles\SUM"
The output is double pipe || delimited

Example usage: KStrike.py SYSTEMNAME\Current.mdb > Current_mdb.txt

This script has been tested on the following systems:

Windows
macOS
*nix

REQUIREMENTS:

libesedb (pyesedb) (https://github.com/libyal/libesedb)

Logging system for the TPC software.

tpc_logger Logging system for the TPC software. The TPC Logger class provides a singleton for logging information within C++ code or in the python API

1 Jan 10, 2022

A lightweight logging library for python applications

cakelog a lightweight logging library for python applications This is a very small logging library to make logging in python easy and simple. config o

2 Jan 5, 2022

Outlog it's a library to make logging a simple task

outlog Outlog it's a library to make logging a simple task!. I'm a lazy python user, the times that i do logging on my apps it's hard to do, a lot of

2 Mar 5, 2022

metovlogs is a very simple logging library

metovlogs is a very simple logging library. Setup is one line, then you can use it as a drop-in print replacement. Sane and useful log format out of the box. Best for small or early projects.

1 Mar 1, 2022

A Python package which supports global logfmt formatted logging.

Python Logfmter A Python package which supports global logfmt formatted logging. Install $ pip install logfmter Usage Before integrating this library,

15 Dec 29, 2022

Log processor for nginx or apache that extracts user and user sessions and calculates other types of useful data for bot detection or traffic analysis

1 Nov 11, 2021

Comments

Add excel and json conversion to generated text file

This modification will convert the generated text file by KStrike into excel file or json file. This change has not modified or alter the original programme flow. Frist generate text file using python KStrike.py Current.mdb > SYSNAME_Current.txt . Then if you want to convert excel run python KStrike.py --excel NameOfTheTextFile OutputFileName . For json run python KStrike.py --json NameOfTheTextFile OutputFileName . Example Excel - python KStrike.py --excel SYSNAME_Current Excel_Out Json - python KStrike.py --json SYSNAME_Current Json_Out

opened by manushadilan 0