What is an EVTX file? Windows Event Log files explained
An .evtx file is a Windows Event Log file. Where .evtx files are stored, what is inside (Security.evtx, System.evtx…), .evt vs .evtx, and how to open one on any OS.
DFIR blog: Windows Event Log forensics & .evtx parsing
How to collect .evtx logs from a live Windows system (4 methods)
Four ways to pull .evtx off a live Windows host: wevtutil, FTK Imager, KAPE, raw NTFS. With the chain-of-custody trade-offs for each and the commands you'll actually run.
Event ID 4625 explained: detecting brute force, sprays and enumeration
4625 is the failed-logon record. Read it right and you spot password sprays, credential stuffing, and Kerberos abuse before they turn into a success.
Event ID 1102: The audit log was cleared (what survives)
Event ID 1102 means the Windows Security audit log was cleared. See who cleared it, which fields prove it, what evidence survives and where to look next.
EVTX file format explained: chunks, templates and BinXML internals
How a .evtx file is laid out at the byte level: file header, 64 KB chunks, the template table, and the BinXML record stream that references it.
Event ID 4104: PowerShell Script Block Logging explained
Event ID 4104 records the full text of every PowerShell script block, even obfuscated or in-memory code. How to enable it, read it and hunt with it.
Event ID 7045: A service was installed in the system
Event ID 7045 (System log) records every new Windows service. The three fields that expose a malicious service (ImagePath, account, start type) and how attackers abuse it for persistence.
Sysmon Event ID 1 explained: process creation for DFIR triage
Sysmon's event 1 is the richest process-creation record Windows can produce. Here is what is in it and how to triage it fast.
Event ID 4624 explained: Windows successful logon and LogonType reference
What a 4624 record actually contains, why the LogonType field matters more than the event itself, and how to read them at scale.