[파워쉘]윈도우 서버 원격 접속 텔레그램 알람

# ps1파일 생성(예 : login_push.ps1)

$Events = Get-WinEvent -FilterHashtable @


foreach($Event in $Events){

$eventXMLs = [xml]$Event.ToXml()

foreach($eventXML in $eventXMLs){

#$eventXML.Event.EventData.Data

$logs = New-Object psobject -Property @{

User = $eventXML.Event.UserData.EventXML.User

IPAddress = $eventXML.Event.UserData.EventXML.Address

TIME = $event.timecreated

EventID = $eventXMLs.Event.system.EventId

}

[array]$result += $logs | select time, user, ipaddress, @
if ($_.EventID -eq '22'){"Shell start"}
if ($_.EventID -eq '23'){"logoff"}
if ($_.EventID -eq '24'){"disconnected"}
if ($_.EventID -eq '25'){"재접속"}
}} | where-object {$_.ipaddress -ne 'LOCAL'}


}

}

$result[0]

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12


$token = "################################"

$chatId = "#################"

$message = "접속시간 : " + $result[0].time + "`n" + "접속IP : " + $result[0].ipaddress + "`n" + "접속계정 : " + $result[0].user + "`n" + $result[0].action + "하였습니다"

Invoke-RestMethod -Uri "https://api.telegram.org/bot$token/sendMessage?text=$message&chat_id=$chatId"

위 파일을 ps1로 저장하여 작업 스케줄러에 등록하면 됩니다.


# 작업스케줄러 등록

Schtasks /create /ru system /tn loginpush /tr "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -executionpolicy unrestricted -file c:\users\administrator\documents\login_push.ps1" /sc onevent /ec Microsoft-Windows-TerminalServices-LocalSessionManager/Operational /mo *[System/EventID=21]

참고 : http://lifeisju.tistory.com/entry/Powershell-Event-Log-Parsing

Powershell - Event Log Parsing