ceramicskate0 / swelf

Simple Windows Event Log Forwarder (SWELF). Its easy to use/simply works Log Forwarder and EVTX Parser. Almost in full release here at https://github.com/ceramicskate0/SWELF/releases/latest.

Like the work dont forget to hit that Star Button and Sponsor

Simple-Windows-Event-Log-Forwarder (SWELF)

Shameless plug to allow Support:

https://patreon.com/ceramicskate0

Get Latest Release

Summary:

If you can type this, Findthis ~ With this EventLog Name(Not required) ~ EventID(Not required) into a text file (Searchs.txt) you can find the logs you want from a windows machine and send just those to your SIEM.

Why SWELF and how is it diffrent from anything out there? Well, are you having the to many log issue? Or maybe just cant        
find what you want from a log forwarder? Want to quickly get the logs you want from local evtx files or eventlog service and 
then get them in the order they where made? Maybe the other log forwarders are just too complicated and you want something  
simple that can do it all? SWELF might be able to help you. You tell SWELF the the key words and/or Event Log Name and/or the 
event ID and it will find it for you. You can event tell it things like the minimum number of characters in log, or the 
maximum length of the command-line arguments, or the length of the log itself, then the SWELF app will send just that log to 
your Log Collection location from a windows machine in a variety of formats. SWELF is designed to be as small,lightweight, and 
windows native as possible with very low requirements and setup and still be a powerful and useful tool. SWELF is designed to 
put you back in control of your log data and your log forwarder as much as possible. Also, an interesting case has come up 
recently, that red teamers could use this to help simulate a SIEM on a VM for testing on an endpoint. SWELF is designed to be 
as small,lightweight, and  windows native as possible with very low requirements and setup and still be a powerful and useful 
tool.   SWELF is designed to put you back in control of your log data adn your log forwarder as much as possible. Also, an 
interesting case has come up recently, that red teamers could use this to help simulate a SIEM on a VM for testing on an 
endpoint.

Install:

Usage:

Requirements:

What can SWELF do:

1. Read, search, and forward any Windows Eventlog and/or saved evtx (that are not I.O. locked) file for everything or just the log with the data you want.

2. Read and search any local log file for everything or just the log with the data you want.

3. Read, search, and forward any 'Powershell Plugin' (after attempting to force it through Microsoft AMSI) output (ie that script you like that you cant get output from at scale) for everything or just the log with the data you want.

Want to know more or have Questions check out the WIKI:

The details:

Now almost in full release.

SWELF is designed to be a simple enough for almost anyone to use for windows event log forwarding application with some speedy IR capabilities. As a forwarder the agent will 1st search your logs for what you want, then forward just those logs. Since SWELF is early release software this means there may be bugs that exist.

But this also means im taking almost any feature request (even if you dont code), deisgn recommendations, and basically any input you think is relavent. I will take it in the form of Twitter (https://twitter.com/Ceramicskate0?lang=en) or as Issue (Feature) request here on Github.

This app is a mainly a log forwarder with the ability to search, forward, and run your plugins. This means that you can tell your log forwarding agent (SWELF) exactly what logs to forward and it wont forward the rest (This will help with that pesky "to many logs", "we cant send those logs its to much noise", or "the SIEM cant handle all the logs" issues with SIEMs and IT Departments). ;D

For example, you want powershell logs (dont lie to yourself every security person does, or at least you better). You know what you want them to have in the log, or what they should looks like, or how long they are, or some keyword, then SWELF will forward in order just those logs.

SWELF Design (After Central Configuration is Pushed)

Other SWELF related Projects

• Offical Plugin Repo

• SWELF Desktop Alerting App

• SWELF Starter Splunk Dashboard

• SWELF Sysmon Starter Config

Legal Disclaimer:

If you choose to run the software on your machine, you accept the terms of use and any potential adverse actions that may befall your system. If you use this software you do so at your own risk and the liability is then accepted by you on execution. Note that the author is not responsible for the way the product software is used and the software comes without any warrenty. If you use the software (this means execution of it on a system) you acknowledge that you accept any risk or any outcome the use of the software causes. I have NEVER authorized, condoned, or recommend the use of anything in any of my repos for any malicious reason. Do not use for evil, malicious purposes, or on machines you do not own. I recommend that you always TEST it before you use it or deploy it. Use at your own risk. THIS IS OPEN SOURCE SOFTWARE AND IS ALMOST READY FOR PRODUCTION.

                GNU AFFERO GENERAL PUBLIC LICENSE
                   Version 3, 19 November 2007

Copyright (C) 2007 Free Software Foundation, Inc. https://fsf.org/ Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.

swelf's Issues

Currently Local evtx file log reads only work for 1 file. Make it work for all files in a single Dir.

Read all EVTX files in a Dir. makes it easier for IR.

Use search commands in per log source and or eventid basis

currently search command only apply to either sysmon (as specified) or all eventlog searchs

Add tamper checks

Add checks into app to run when app is run as live mode to detect and alert admin of possible event log tampering

Make Local Log reads track place left off in log vice delete after read

Make it work like eventlog placekeeper file.

Make app a service

Make service

JSON as output option yes or no?????

Improved Security Checks for event log tampering

    public static bool Check_Windows_Event_Log_Size(string EVT_Log_Name)
    {
        //on a per log basis
        //compare original size to now size
        //if its less than windows default alert
        //also if last modified date for reg key is not as old as things around it
    }

    public static bool Check_Windows_Event_Log_Retention_Policy(string EVT_Log_Name)
    {
        //in reg key per log
        //all ffff's means no new logs added
    }

    public static bool Check_Windows_Event_Log_Has_Not_Recorded_Logs_In_X_Time(string EVT_Log_Name,int Time_of_Latest_Log)
    {
        //For a given eventlog when was the last time it was written to. Based on today - last time X. Alert yes or no.
    }

    public static bool Check_Windows_Event_Log_Popular_Event_Logs_Blank(string EVT_Log_Name)
    {
        //Popular windows event logs have nothing in them and they should
    }

Forward logs to other ports than 514

Have SWELF forward logs to other ports over UDP

Search Sysmon hash and IP on Virustotal

Search Sysmon hash and IP on Virustotal

bug When SEARCHING {TERM},{LOG NAME},{BLANK}

When leaving the 3rd comma blank or the eventid causes app crash unhandled string error

Add windows defender as log source

Microsoft-Windows-Windows Defender/Operational

Add search commands to whitelisting feature instead of just keyword

Currently the whitelist feature is only for key term and NOT commands. It should deal with commands also

Local wvtx log read function no work

What is needed for an issues (if question or comment ignore this) Please.

Issue details (Summary):

What did SWELF event log say about it:

What did SWEFL local logs say about it:

WHat dio you say about it (be constructive):

What do you think right looks like:

Attach any screenshots or log copy pastes below:

Public Release of Hash grab from logs functionality and IP grab from logs feature

Have hash grab and IP grab features dump to local file. If user wants to forward them document how the file monitor feature works and recommend using it.

OPEN QUESTION TO THE COMMUNITY

Should SWELF be able to be configured to do initial incident response via remote deployment to scan windows Event Logs utilizing its central configuration feature? Post or contact me on twitter with what you think.

SWELF loads MS AMSI for PS plugin checks

make swelf load AMSI to check PS plugins

Make local log reads search and not just fwd

Currently app does not search any local log files it reads. Needs to be able to do so

Do the first push

WRAP UP TESTING and push code.

Rewrite SWELF Eventloging

Have SWLF keep orig name, event id, and have swelf have its own event id

Redo App error logging from ground up

Currently SWELF error logging...sucks....needs to be redone

Expand API class

Expand API class

App send off log data when significant events occur

1. Settings file changed
2. Log missing

Create DEV Branch

Type the contents here.

Extract IP and File Hash's in app algo, deal with config issues to turn features on and off, what to do with log data, and pull from more than sysmon log type

Extract IP and File Hash's in app algo, deal with config issues to turn features on and off, what to do with log data, and pull from more than sysmon log type

Searching Powershell event logs

When using CommandLine=,windows powershell,{BLANK SPACE} as search nothing was returned this was due to searching raw xml output. Expected to be fixed in 0.1.0.5

Gzip or Deflate Memory contents for footprint reduction

compress contents of memory to reduce footprint

Memory Usage Reduction/Maximum efficiency

Have SWELF monitor its own memory usage and when a max percentage is used conduct process to complete work flow and have it clear the memory usage.

YOUR LOGIC SUCKS ERROR

Run the app if statement in whitelisting returns 0 everytime due to error in logic

Encrypt sensitive app config files with app on local machine when running as task

Now that POC is almost solid and app is getting closer to its first full release I want to focus on app security. That said the first and easiest way to mess the app up or abuse it is to reconfigure its settings files. A way to solve this is to encrpyt the settings files.

Add searching command commandline_contains:

gives ability for app to search only command line args for key terms

Send Logs to more than 1 host

Currently only send logs to 1 host on port 514 in various formats over udp

Error logs for eventlog missing produced when log is empty

fix coming in next version. just needs testing and time to add more to app maybe search functions for just cmd line 💃

GUI for config of app so its easy to manage settings , get notifications on desktop , and get alerts for findings in GUI

GUI for config of app so its easy to manage settings , get notifications on desktop , and get alerts for findings in GUI

SWELF Sending each log in order instead of all logs in order

SWELF was sending each log in order (done to save on memory usage,being fixed in new release). It should be sending all the logs from all the sources in order.

Add whitelist config/search file

file that is layed out like search that will be treated by app as whiteliste

SearchCommand for Sysmon logs to send event of program connecting to network (Sysmon eventid 3)

Is your feature request related to a problem? Please describe.
Powershell used as call out for initial infection delivery. need that log.

Describe the solution you'd like
Forward sysmon log for that event event id 3

Describe alternatives you've considered
none

Additional context

APP 1st run self intialize config creation-created in old format

WHen app first runs and detects that the user did not provide a config then the app will create its own hard coded config (as a default to run properly). The apps config used the old parse config and not the new ''. This is now fixed for next release. A work around is to replace ',' with '' in the config file.

Powershell Plugin Central Config Support

Verify the PS plugin feature is supported by central config feautre in new build

Update Documentation

Keep docs update with new features

Plugin to Powershell (Gonna be key word search for script output)

Plugin to Powershell (Gonna be key word search for script output)

Ability to centralize config

Sysvol is a read only Dir that all machines on a domain can read (for GPO). This would be perfect if the app could read its config from that location and execute. I will require SMB yes but that is required anyways. Dir is read only by default and only admins can change files there. This will also help with securing config file to admins.

Idea here is have app read config files from UNC path.
This could be done by local config file pointing to UNC path
Need to add feature/option in config to do this. If this is read the app will then ignore all other setting except to read UNC config

Multi Thread application

Multi Thread application

Setup as eventlog real time monitor

When the app is a service have the agent read and process in real time

Introduce powershell plugins...again.

have swelf powershell plugin functionality added back into app

Windows Event logs being sent and logged in order of only the event log source

App needs to combine all log sources to be sorted and logged by date and time of all event logs searched and sent and logged in that order

Be able to pass commandline args to app for remote usage.

SWELF initial run error code 0x1

On 1st run of published binary program exits with 0x1 error code. Main() error. error may be caused by config files not writing on 1st install correctly.

SNORT ALERT FOR SYSLOG when sending udp packets containing log data

Snort ids alerts for packets containing log data transmitted from app using "syslog" setting.

Snort Sig number:
Message........: SERVER-OTHER HP HP Intelligent Management Center syslog remote code execution attempt
Details........: https://www.snort.org/search?query=25352
dst port:514

Use Sysmon logs to search commandline arg length by char count

Sysmon can give commandline args, we can use that to get commandline arg length to detect fileless malware. We can do this by counting chars in commandline args for both parent and target commandline args.

Redo AMSI to scan all plugin input

have amsi do vetting (if win10). If not sucks for them, but do something about it. if found to be malware send log dont execute. if not do it no log.