One Day Sec

Can I achieve the same functionality as SharpSniper using built-in Windows tools?

Yes, you can use wevtutil.exe or PowerShell scripts. For example, with wevtutil you can run 'wevtutil qe security /format:text /q:"Event[System[(EventID=4624)] and EventData[Data[@Name='TargetUserName']='testb']]"|find "Source Network Address"' to extract IPs. Similarly, PowerShell cmdlets like Get-WinEvent can be used with FilterXPath or -FilterXml. The article Analysis of SharpSniper Exploitation provides detailed commands and examples.
wevtutilPowerShellGet-WinEventSource Network Address

Browse all Q&A →