# Z9 | PowerShell Script Analyzer

**URL:** <https://onehack.st/t/z9-powershell-script-analyzer/255602>\
**Category:** Tools & Scripts\
**Tags:** programming\
**Created:** [September 22, 2023, 11:10am UTC](https://onehack.st/t/z9-powershell-script-analyzer/255602 "2023-09-22T11:10:54Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [September 22, 2023, 11:10am UTC](https://onehack.st/t/z9-powershell-script-analyzer/255602/1 "2023-09-22T11:10:55Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/a/8/a857b13d30dd5991abe05942079fba1630c12d77.png)

# [z9 PowerShell Log Analyzer](https://github.com/Sh1n0g1/z9#z9-powershell-log-analyzer)

[Japanese](https://github.com/Sh1n0g1/z9/blob/main/README-ja.md)

[![Z9 Logo](https://github.com/Sh1n0g1/z9/raw/main/img/logo.png)](https://github.com/Sh1n0g1/z9/blob/main/img/logo.png)

## [Abstract](https://github.com/Sh1n0g1/z9#abstract)

This tools detects the artifact of the PowerShell based malware from the eventlog of PowerShell logging.  
[Online Demo](https://z9.shino.club/)

## [Install](https://github.com/Sh1n0g1/z9#install)

```auto
git clone https://github.com/Sh1n0g1/z9

```

## [How to use](https://github.com/Sh1n0g1/z9#how-to-use)

```auto
usage: z9.py [-h] [--output OUTPUT] [-s] [--no-viewer] [--utf8] input

positional arguments:
  input Input file path

options:
  -h, --help show this help message and exit
  --output OUTPUT, -o OUTPUT
                        Output file path
  -s, --static Enable Static Analysis mode
  --no-viewer Disable opening the JSON viewer in a web browser
  --utf8 Read scriptfile in utf-8 (deprecated)

```

### [Analyze Event Logs (Recommended)](https://github.com/Sh1n0g1/z9#analyze-event-logs-recommended)

```auto
python z9.py <input file> -o <output json>
python z9.py <input file> -o <output json> --no-viewer

```

| Arguments | Meaning |
| --- | --- |
| `input file` | XML file exported from eventlog |
| `-o output json` | filename of z9 result |
| `--no-viewer ` | do not open the viewer |

Example)

```auto
python z9.py util\log\mwpsop.xml -o sample1.json

```

### [Analyze PowerShell File Statically](https://github.com/Sh1n0g1/z9#analyze-powershell-file-statically)

- This approach will only do the static analysis and may not provide a proper result especially when the sample is obfuscated.

```auto
python z9.py <input file> -o <output json> -s
python z9.py <input file> -o <output json> -s --utf8
python z9.py <input file> -o <output json> -s --no-viewer

```

| Arguments | Meaning |
| --- | --- |
| `input file` | PowerShell file to be analyzed |
| `-o output json` | filename of z9 result |
| `-s` | perform static analysis |
| `--utf8` | specify when the input file is in UTF-8 |
| `--no-viewer ` | do not open the viewer |

Example)

```auto
python z9.py malware.ps1 -o sample1.json -s

```

## [How to prepare the XML file](https://github.com/Sh1n0g1/z9#how-to-prepare-the-xml-file)

### [Enable PowerShell Logging](https://github.com/Sh1n0g1/z9#enable-powershell-logging)

1. Right-click and merge this registry file:[`util/enable_powershell_logging.reg`](https://github.com/Sh1n0g1/z9/blob/main/util/enable_powershell_logging.reg) .
2. Reboot the PC
3. All powershell execution will be logged in eventlog

### [Export Eventlog to XML](https://github.com/Sh1n0g1/z9#export-eventlog-to-xml)

1. Execute this batch file:[`util/collect_psevent.bat`](https://github.com/Sh1n0g1/z9/blob/main/util/collect_psevent.bat) .
2. The XML files will be created under `util/log` directory.
3. Both XML file can be parsed by this tool.

### [How to Delete the Existing Eventlog](https://github.com/Sh1n0g1/z9#how-to-delete-the-existing-eventlog)

- Execute this batch file:[`util/collect_psevent.bat`](https://github.com/Sh1n0g1/z9/blob/main/util/clear_psevent.bat) with “Run as Admin”

## [Authors](https://github.com/Sh1n0g1/z9#authors)

[hanataro-miz](https://github.com/hanataro-miz)  
[si-tm](https://github.com/si-tm)  
[take32457](https://github.com/take32457)  
[Bigdrea6](https://github.com/Bigdrea6)  
[azaberrypi](https://github.com/azaberrypi)  
[Sh1n0g1](https://github.com/Sh1n0g1)

## GitHub:

> **[GitHub - Sh1n0g1/z9: PowerShell Script Analyzer](https://github.com/Sh1n0g1/z9)**
>
> PowerShell Script Analyzer