Execution
Windows event logs (EVTX)
Windows event log cheat sheet: EVTX locations, must-know event IDs for logons, processes, services and log clearing, retention, audit policy and parsing tools.
- Location
- C:\Windows\System32\winevt\Logs\*.evtx
- Proves
- Logons, process creation, service and task installs, log clearing, and much more
- Timestamps
- TimeCreated SystemTime as FILETIME, UTC (Event Viewer shows local time); some EventData fields hold local-time strings
- Retention
- Circular by default, oldest overwritten at max size (about 20 MB for Security, System, Application on 7+); clearing leaves 1102/104
- Access
- Administrator; .evtx files locked by the Event Log service: export with wevtutil epl, or copy via raw NTFS or VSS (KAPE EventLogs)
- Type
- Event log
- Windows
- XPVista / 78 / 8.11011
- KAPE target
- EventLogs
- Velociraptor
- Windows.Triage.Targets:EventLogs
Tools
Compare all tools- EVTX ParserIn browser
- EvtxECmdCLI
- ChainsawCLI · open source
- HayabusaCLI · open source
- Event ViewerGUI · built into Windows
- python-evtxLibrary · open source
What it is
Windows records events from the OS, services and applications in event logs. Since Windows Vista they are binary XML files (.evtx), one per channel: the classic Security, System and Application logs plus hundreds of Microsoft-Windows-*/Operational channels. They are the backbone of most intrusion timelines: authentication, process creation, persistence, remote access and the attacker's attempts to clear their tracks.
Location
| Windows version | Path | Format |
|---|---|---|
| XP / Server 2003 | C:\Windows\System32\config\AppEvent.Evt, SecEvent.Evt, SysEvent.Evt | EVT (legacy binary) |
| Vista / 7 / 8 / 10 / 11 | C:\Windows\System32\winevt\Logs\*.evtx | EVTX |
Channel Microsoft-Windows-TerminalServices-LocalSessionManager/Operational becomes the file Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx (/ is written as %4). The configured path and size of each log are in SYSTEM\CurrentControlSet\Services\EventLog\<log> and SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels.
What it proves
Depending on the audit policy and installed components, event logs show who logged on, from where and how, which processes ran (with command lines), which services and scheduled tasks were created, RDP and PowerShell activity, Defender detections, USB connections and log clearing. They rarely show file contents or file access unless object-access auditing is configured.
Key fields
| Field | Meaning |
|---|---|
EventID | Numeric event ID, meaningful only together with the provider |
Provider / Channel | Source and log the event belongs to |
TimeCreated SystemTime | When the event was logged |
EventRecordID | Sequential record number within the log |
Computer | Host name |
Security UserID | SID of the account that generated the event (when present) |
EventData | Event-specific fields (TargetUserName, LogonType, IpAddress, NewProcessName, CommandLine…) |
Must-know events:
| Log | ID | Meaning |
|---|---|---|
| Security | 4624 / 4625 | Successful / failed logon (see logon type) |
| Security | 4634 / 4647 | Logoff / user-initiated logoff |
| Security | 4648 | Logon with explicit credentials (runas, lateral movement tools) |
| Security | 4672 | Special privileges assigned to a new logon (admin-level session) |
| Security | 4688 / 4689 | Process created / exited (requires process-creation auditing) |
| Security | 4697 | Service installed (requires security-system-extension auditing) |
| Security | 4698 / 4702 | Scheduled task created / updated (requires object-access auditing) |
| Security | 4720 / 4726 | User account created / deleted |
| Security | 4732 | Member added to a security-enabled local group (e.g. Administrators) |
| Security | 1102 | Security log cleared |
| System | 104 | A log (other than Security) cleared |
| System | 7045 | New service installed |
| System | 7036 | Service entered running / stopped state |
| System | 6005 / 6006 | Event Log service started / stopped (boot / clean shutdown) |
Channel-specific IDs are covered on the RDP, PowerShell, scheduled tasks, Defender and USB pages.
Timestamps
| Timestamp | Set when | Format | Pitfalls |
|---|---|---|---|
TimeCreated SystemTime | Event written by the provider | FILETIME, UTC | Event Viewer displays it in the viewer's local time zone; exported CSVs may too |
Fields inside EventData | Provider-specific | Varies | Some providers log local-time strings |
.evtx $SI times | File changes | NTFS, UTC | Say nothing about individual events |
Retention and clearing
- Each log has a maximum size and, by default, overwrites the oldest events when full. On Windows 7 and later the default is about 20 MB for
Security,SystemandApplication; busy servers or domain controllers can roll over the Security log in hours. - Clearing a log leaves 1102 (Security) or 104 (System) behind, with the account that did it.
- Gaps in
EventRecordID, a log starting long after the last boot, or a stopped Event Log service (missing 6005/6006 pairs) point to tampering. - Many useful events require audit policy (
auditpol) or GPO settings: 4688 needs Audit Process Creation, and the command line needs Include command line in process creation events.
Collection
- KAPE target:
EventLogs(all.evtx, plus.evton legacy systems);EventLogs-RDPfor an RDP-focused subset. - Velociraptor (
Windows.Triage.Targets):EventLogs;Windows.EventLogs.EvtxandWindows.Sigma.EventLogsquery them live. - Built-in (administrator):
wevtutil epl Security E:\case\Security.evtx
wevtutil gl Security
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625} -MaxEvents 50
auditpol /get /category:*
Parsing tools
- EvtxECmd (Eric Zimmerman):
EvtxECmd.exe -d E:\case\Logs --csv E:\outnormalizes events with maps into CSV for Timeline Explorer. - Chainsaw (WithSecure) and Hayabusa (Yamato Security): fast Sigma-based hunting over folders of EVTX files.
- python-evtx (Willi Ballenthin) and Velociraptor
Windows.EventLogs.Evtx: scripted access. - Event Viewer: fine for a handful of events; use Filter Current Log and Save Filtered Log File As.
Investigation tips
- Start with authentication: 4624 by logon type, source IP and workstation name; type 3 and type 10 logons from unexpected hosts are the classic lateral movement trail.
- Chain 4624 → 4672 → 4688 by
TargetLogonId/SubjectLogonIdto see what an elevated session did. - Hunt persistence with 7045 / 4697 (services) and 4698 (tasks) around the intrusion window.
- Treat 1102 and 104 as high-priority evidence of anti-forensics, then look for surviving copies in shadow copies, SIEM forwarding and backups.
- Always normalize to UTC before merging with other artifacts in a super timeline.
Related artifacts
- RDP connection artifactsRDP forensics cheat sheet: target-side event IDs (4624 type 10, 1149, 21–25, 131) and source-side traces (Terminal Server Client keys, Default.rdp, 1024).
- PowerShell logs and historyPowerShell forensics: 4103/4104 script block logs, 400/403/800 engine events, PSReadLine ConsoleHost_history.txt, transcripts and logging policy keys.
- Scheduled TasksScheduled tasks cheat sheet: task XML and .job files, TaskCache registry keys, DynamicInfo times, hidden tasks, TaskScheduler and 4698 events.
- Windows ServicesWindows services cheat sheet: Services key values (ImagePath, Start, Type, ServiceDll), 7045 and 4697 install events, PsExec traces and pitfalls.
- Microsoft Defender logs and quarantineMicrosoft Defender forensics: Operational events 1116/1117/5001/5007, MPLog files, DetectionHistory, encrypted quarantine, exclusion keys and tampering traces.
- USB device historyUSB forensics cheat sheet: USBSTOR and USB keys, serial numbers, first and last connection times, drive letters, volume serials, setupapi.dev.log and event IDs.
- Sysmon Event LogSysmon cheat sheet: Operational log location, key event IDs, ProcessGuid and hash correlation, config in the registry, tampering signs and parsing tools.
- IIS Web Server LogsIIS logs cheat sheet: W3C log location per site, UTC timestamps, default fields, HTTPERR, applicationHost.config and how to hunt webshells on Windows servers.
- OpenSSH Server and ClientOpenSSH on Windows cheat sheet: sshd event log, sshd_config and host keys, authorized_keys persistence, known_hosts, client traces and reverse tunnels.
- NTDS.dit and domain controllersNTDS.dit cheat sheet: the Active Directory database, what it proves, theft traces on a DC, and the Kerberos, NTLM and DCSync event IDs investigators need.
Glossary terms
- Windows event IDThe number identifying an event type within a given provider; it only has meaning when paired with its provider and log channel.
- Logon typeThe numeric field in logon events 4624 and 4625 that says how an account logged on: console, network, service, RDP, cached and more.
- Lateral movementAn attacker moving from one compromised host to others in the network, using RDP, SMB, PsExec, WMI, WinRM or remote tasks and services.
- Anti-forensicsTechniques used to destroy, hide or falsify evidence, such as log clearing, timestomping, wiping and deleting shadow copies or the USN journal.
- Event Tracing for Windows (ETW)The kernel-level tracing framework in which providers emit events to sessions; it feeds the event logs, .etl files and security tools.
Guides
- Building a Super Timeline with PlasoBuild and filter a Windows super timeline with Plaso: log2timeline, psteal and psort flags, time zones, MACB, Timeline Explorer, EZ Tools CSVs and pivoting.
- Getting Started with Windows ForensicsStart Windows DFIR the right way: investigative mindset, order of volatility, what to collect, the key evidence areas, free tools and a first-48-hours plan.
- Active Directory Forensics: Domain Controller Event LogsInvestigate domain controllers: Kerberos and NTLM events, account and group changes, DCSync 4662, directory changes, GPO abuse, NTDS.dit theft, forged tickets.