# hunting

```
et-eventlog -log security | where-object {$_.TimeGenerated -gt (get-date).adddays(-5) -AND $_.EntryType -eq 'SuccessAudit' –AND  (($_.EventID -eq "5145" -AND $_.Message -match "\\\\\*\\ADMIN\$|\\\\\*\\C\$|\\\\\*\\IPC\$"  -AND $_.Message -match "\%\%4417") -OR ($_.EventID -eq "4674" -AND $_.Message -match "SeTakeOwnershipPrivilege|SeDebugPrivilege|SeTcbPrivilege") -OR ($_.EventID -eq "4688"  -AND $_.

```

{% embed url="https://www.ldap389.info/en/2013/06/17/powershell-forensic-onliners-regex-get-eventlog/" %}

{% embed url="https://devblogs.microsoft.com/scripting/use-powershell-to-perform-offline-analysis-of-security-logs/" %}
