Run Sigma rules on EVTX in your browser
Run 2,395 SigmaHQ rules on Windows .evtx logs without installing Hayabusa or Chainsaw: in-browser Sigma matching, ATT&CK context, pivots, and your own YAML rules.
DFIR blog: Windows Event Log forensics & .evtx parsing
Short notes on the Windows Event Log binary format, common forensic event IDs, and triage workflows.
"The description for Event ID cannot be found": fix it
Why Event Viewer says the description for an Event ID cannot be found, what %%1833-style codes mean, and how to read the event anyway, offline.
AppLocker event logs: 8003, 8004 and what ran
Using AppLocker's event logs for DFIR — allowed vs audited vs blocked (8002/8003/8004), the script and MSI channels, and how application-control logs double as an execution record even in audit mode.
Event ID 4719: audit policy tampering as an early warning
Why attackers change the audit policy to go dark, and how Event ID 4719 catches it — reading the subcategory and the success/failure changes, and pairing it with log clearing as an anti-forensics signal.
Active Directory changes: Event ID 5136 and DCSync (4662)
Detecting AD persistence and credential-replication attacks in the directory-service logs — 5136 object modifications (ACLs, AdminSDHolder, GPO), the 5137/5141 lifecycle, and using 4662 to catch DCSync.
Event ID 4697: a service was installed (and why it beats 7045)
The Security-log record of service installation — how 4697 differs from System 7045, the fields that expose malicious services and PsExec-style lateral movement, and why it's the more reliable of the two.
File share access: Event IDs 5140 and 5145
Tracking network share and file access in the Security log — 5140 (share accessed) vs 5145 (detailed file share), spotting ADMIN$/C$ lateral movement and data staging, and managing 5145's volume.
Sysmon Event ID 22: DNS queries, C2 domains and exfiltration
Using Sysmon's DNS-query event for hunting — process-attributed domain lookups, spotting C2 and DGA domains, DNS tunnelling, and the fields that make it useful.
Sysmon file and registry events: 11, 12–14, 15 and 23/26
Tracking dropped files, registry persistence, alternate data streams and self-deletion with Sysmon — FileCreate (11), registry events (12/13/14), FileCreateStreamHash (15) and FileDelete (23/26).