03 · Event Logs
Windows Event Log Forensics: EVTX, Event IDs and Hunting
A practitioner guide to Windows event logs: EVTX format, key channels, Security and Sysmon event IDs, audit policy, cleared-log recovery and hunting tools.
Area 03
Event Logs
Event logs turn activity into timestamps you can defend. This area covers the EVTX format and retention, the Security, System and operational channels that matter, audit policy gaps, Sysmon and PowerShell logging, and how to hunt at scale with EvtxECmd, Hayabusa and Chainsaw.
Key sources
- Security.evtx
- Sysmon
- 4624 / 4688
Guides in this area
03 · Event Logs
Active Directory Forensics: Domain Controller Event Logs
Investigate domain controllers: Kerberos and NTLM events, account and group changes, DCSync 4662, directory changes, GPO abuse, NTDS.dit theft, forged tickets.
Artifact cheat sheets
Location by Windows version, what each artifact proves, its timestamps and the tools to parse it.
- Windows event logs (EVTX)Windows event log cheat sheet: EVTX locations, must-know event IDs for logons, processes, services and log clearing, retention, audit policy and parsing tools.
- PowerShell logs and historyPowerShell forensics: 4103/4104 script block logs, 400/403/800 engine events, PSReadLine ConsoleHost_history.txt, transcripts and logging policy keys.
- Event Trace Logs (ETL files)ETL files cheat sheet: what ETW trace logs are, forensically useful .etl files (WDI boot traces, Wifi.etl, DiagTrack), collection, tracerpt and etl-parser.
- Microsoft Defender logs and quarantineMicrosoft Defender forensics: Operational events 1116/1117/5001/5007, MPLog files, DetectionHistory, encrypted quarantine, exclusion keys and tampering traces.
- Sysmon Event LogSysmon cheat sheet: Operational log location, key event IDs, ProcessGuid and hash correlation, config in the registry, tampering signs and parsing tools.
- Windows Firewall LogsWindows Firewall cheat sheet: pfirewall.log format and defaults, rule change events 2004-2006, WFP audit 5156/5157, rules in the registry and netsh abuse.
- IIS Web Server LogsIIS logs cheat sheet: W3C log location per site, UTC timestamps, default fields, HTTPERR, applicationHost.config and how to hunt webshells on Windows servers.
- NTDS.dit and domain controllersNTDS.dit cheat sheet: the Active Directory database, what it proves, theft traces on a DC, and the Kerberos, NTLM and DCSync event IDs investigators need.