flashercs

$evt = Get-WinEvent -LogName Security -FilterXPath "Event[System[EventID=4625 and TimeCreated[timediff(@SystemTime)<=600000]]]" -MaxEvents 1 -ErrorAction SilentlyContinue
$csvfile = "d:\$(Get-Date -Format 'yyyyMMdd').txt"
$maxcount = 5
if ($null -ne $evt) {
  $ip = $evt.Properties[19].Value
  $username = $evt.Properties[5].Value
  $alpso = New-Object System.Collections.ArrayList
  if (Test-Path -LiteralPath $csvfile) {
    $null = Import-Csv -Path $csvfile -Encoding UTF8 -OutVariable alpso
  }
  $pso = 0 | Select-Object -Property @{n = 'IP'; e = { $ip } }, @{n = 'UserName'; e = { $username } }, @{n = 'Time'; e = { Get-Date } }
  $null = $alpso.Add($pso)
  $alpso | Export-Csv -Path $csvfile -Encoding UTF8 -NoTypeInformation
  if (@($alpso | Where-Object { $_.IP -eq $ip }).Count -ge $maxcount) {
    $firewallRuleDisplayName = "远程桌面黑名单"
    $newRemoteIP = $ip
    Get-NetFirewallRule -DisplayName $firewallRuleDisplayName | ForEach-Object {
      $addrfilter = $_ | Get-NetFirewallAddressFilter
      $arrOldRemoteIP = $addrfilter.CimInstanceProperties['RemoteAddress'].Value
      $arrNewRemoteIP = @(
        if ($null -ne $arrOldRemoteIP) { $arrOldRemoteIP }
        $newRemoteIP
      ) | Sort-Object -Unique
      $_ | Set-NetFirewallRule -RemoteAddress $arrNewRemoteIP
    }
  }
}
复制代码

flashercs

回复 3# 522235677


    改了一下