Search
Run Sigma rules on EVTX in your browser
Run 2,395 SigmaHQ rules on Windows .evtx logs without installing Hayabusa or Chainsaw: in-browser Sigma matching, ATT&CK context, pivots, and your own YAML rules.
- evtx
- dfir
- threat-hunting
- sigma
- sysmon
"The description for Event ID cannot be found": fix it
Why Event Viewer says the description for an Event ID cannot be found, what %%1833-style codes mean, and how to read the event anyway, offline.
- evtx
- dfir
- event-viewer
- troubleshooting
- windows-event-log
AppLocker event logs: 8003, 8004 and what ran
Using AppLocker's event logs for DFIR — allowed vs audited vs blocked (8002/8003/8004), the script and MSI channels, and how application-control logs double as an execution record even in audit mode.
- evtx
- dfir
- applocker
- execution
- threat-hunting
Event ID 4719: audit policy tampering as an early warning
Why attackers change the audit policy to go dark, and how Event ID 4719 catches it — reading the subcategory and the success/failure changes, and pairing it with log clearing as an anti-forensics signal.
- evtx
- dfir
- anti-forensics
- audit-policy
- threat-hunting
Active Directory changes: Event ID 5136 and DCSync (4662)
Detecting AD persistence and credential-replication attacks in the directory-service logs — 5136 object modifications (ACLs, AdminSDHolder, GPO), the 5137/5141 lifecycle, and using 4662 to catch DCSync.
- evtx
- dfir
- active-directory
- persistence
- threat-hunting
Event ID 4697: a service was installed (and why it beats 7045)
The Security-log record of service installation — how 4697 differs from System 7045, the fields that expose malicious services and PsExec-style lateral movement, and why it's the more reliable of the two.
- evtx
- dfir
- persistence
- lateral-movement
- threat-hunting
File share access: Event IDs 5140 and 5145
Tracking network share and file access in the Security log — 5140 (share accessed) vs 5145 (detailed file share), spotting ADMIN$/C$ lateral movement and data staging, and managing 5145's volume.
- evtx
- dfir
- lateral-movement
- data-access
- threat-hunting
Sysmon Event ID 22: DNS queries, C2 domains and exfiltration
Using Sysmon's DNS-query event for hunting — process-attributed domain lookups, spotting C2 and DGA domains, DNS tunnelling, and the fields that make it useful.
- evtx
- dfir
- sysmon
- dns
- threat-hunting
Sysmon file and registry events: 11, 12–14, 15 and 23/26
Tracking dropped files, registry persistence, alternate data streams and self-deletion with Sysmon — FileCreate (11), registry events (12/13/14), FileCreateStreamHash (15) and FileDelete (23/26).
- evtx
- dfir
- sysmon
- persistence
- threat-hunting
Sysmon Event ID 7: image loads, DLL hijacking and sideloading
Using Sysmon's image-load event to catch DLL search-order hijacking, sideloading and unsigned modules — the fields, the signature checks that matter, and how to manage its very high volume.
- evtx
- dfir
- sysmon
- dll-hijacking
- threat-hunting
Sysmon Event ID 3: Network connection detected (C2 hunting)
Sysmon Event ID 3 logs each TCP/UDP connection with the process that made it. Fields explained, how to spot beaconing and LOLBin traffic, and how to tame the noise.
- evtx
- dfir
- sysmon
- network
- threat-hunting
Sysmon Event IDs 8 and 10: process injection and LSASS access
Detecting code injection and credential theft with Sysmon — CreateRemoteThread (8) and ProcessAccess (10), reading GrantedAccess masks against lsass.exe, and using the call trace to find unsigned modules.
- evtx
- dfir
- sysmon
- credential-theft
- threat-hunting
Event ID 4616: system time changes and timestomping
How a changed system clock undermines a timeline, and how Event ID 4616 exposes it — reading PreviousTime vs NewTime, separating benign NTP sync from anti-forensic manipulation, and the process that made the change.
- evtx
- dfir
- anti-forensics
- timeline
- threat-hunting
Event ID 3076 & 3077: WDAC Code Integrity blocks explained
Event ID 3076 is a WDAC or Smart App Control audit-mode block and 3077 an enforced block, both in CodeIntegrity/Operational. Key fields and how to triage.
- evtx
- dfir
- wdac
- code-integrity
- threat-hunting
Windows Defender event logs: detections and tampering
Reading Microsoft Defender's Operational log in DFIR — malware detections (1116/1117), real-time protection disabled (5001), and the settings changes (5007) attackers use to add exclusions and go quiet.
- evtx
- dfir
- defender
- anti-forensics
- threat-hunting
Account lockouts and password resets: 4740, 4724 and 4767
Reading account-lockout and password-change events in the Security log — 4740 (locked out) and its caller computer, 4767 (unlocked), 4723/4724 (password change vs admin reset), and what each pattern means for an investigation.
- evtx
- dfir
- account-management
- threat-hunting
How BinXML actually works: decoding the EVTX token stream
A token-by-token walkthrough of BinXML — the binary XML encoding inside .evtx records. Names, hashes, templates, the substitution array, nested fragments, and the edge cases that break parsers.
- evtx
- binxml
- file-format
- dfir
- reverse-engineering
Detecting RDP lateral movement in event logs
How attackers move host-to-host over RDP and the event-log trail it leaves — chaining RDPClient 1024 to RemoteConnectionManager 1149, spotting jump-host fan-out, restricted-admin and tunnelled RDP, and the gaps to watch for.
- evtx
- dfir
- rdp
- lateral-movement
- threat-hunting
Did someone RDP into this host? A step-by-step investigation
A practical workflow for answering 'was there a remote desktop session' from EVTX alone — which logs to pull, which event IDs to filter, how to confirm a real interactive session, and how to read the source and timing.
- evtx
- dfir
- rdp
- incident-response
- threat-hunting
Building an event-log timeline for incident response
How to turn scattered .evtx files into one defensible timeline — which events to anchor on, normalising to UTC, correlating across hosts and logs, joining sessions by LogonId, and avoiding the common timelining mistakes.
- evtx
- dfir
- timeline
- incident-response
The EVTX file format: a complete byte-level reference
A field-by-field reference for the Windows .evtx format — file header, ELFCHNK chunk header, event record, the full BinXML token and value-type tables, and a worked decode from raw bytes to rendered XML.
- evtx
- file-format
- binxml
- dfir
- reverse-engineering
- reference
Tampered event logs and what survives
How attackers clear, truncate and timestomp Windows event logs — and the byte-level tells that survive: 1102/104 clearing events, record-ID gaps, chunk CRC mismatches, dirty chunks, and records carvable from slack and unallocated space.
- evtx
- dfir
- anti-forensics
- file-format
- threat-hunting
Privileged group changes: Event IDs 4732, 4728 and 4756
Detecting privilege escalation and persistence through group membership changes in the Security log — local (4732), global (4728) and universal (4756) group additions, what the fields mean, and the create-then-add pattern.
- evtx
- dfir
- persistence
- privilege-escalation
- threat-hunting
Querying EVTX with PowerShell: Get-WinEvent, FilterHashtable and XPath
A practical guide to reading .evtx files with PowerShell — Get-WinEvent vs Get-EventLog, the fast FilterHashtable path, XPath filters for EventData fields, FilterXml, and the limitations that trip people up.
- evtx
- dfir
- powershell
- how-to
RDP forensics: the complete event-log picture
Every Windows event a Remote Desktop session leaves behind, across four logs — 1149, LocalSessionManager 21/22/24/25, Security 4624 type 10 and 4778/4779 — and how they fit together into one timeline.
- evtx
- dfir
- rdp
- lateral-movement
- threat-hunting
Scheduled task persistence: Event ID 4698 and the Task Scheduler log
How attackers use scheduled tasks for persistence and what it leaves in the event logs — Security 4698/4699/4700/4701/4702 with the full task XML, and the Task Scheduler Operational log 106/140/141/200.
- evtx
- dfir
- persistence
- scheduled-tasks
- threat-hunting
Running Sigma rules over EVTX with Chainsaw and Hayabusa
How to scan .evtx files with detection rules at scale — what Sigma is, how Chainsaw and Hayabusa apply it to event logs, when to use each, and how to fit rule-based triage into an investigation.
- evtx
- dfir
- sigma
- detection
- threat-hunting
Windows Event ID Cheat Sheet (Security, Sysmon, PowerShell)
Windows Event ID cheat sheet for DFIR and threat hunting: the Security, System, Sysmon and PowerShell IDs that matter, grouped by attack phase, each with a one-line meaning.
- evtx
- dfir
- event-id
- reference
- threat-hunting
Reading Windows logons end to end: 4624, 4625, Kerberos and NTLM
How Windows logon auditing actually fits together — logon types, 4624/4625 fields and failure codes, the Kerberos 4768/4769/4771 chain, NTLM 4776, and how the events correlate across the domain controller and the target host.
- evtx
- dfir
- logon
- kerberos
- ntlm
- threat-hunting
Event ID 5861: WMI persistence in the WMI-Activity log
Event ID 5861 (WMI-Activity/Operational) records permanent WMI event subscriptions, the __EventFilter/Consumer/Binding trio attackers use for persistence. How to read and hunt it.
- evtx
- dfir
- persistence
- wmi
- threat-hunting
Carving deleted EVTX records and recovering rolled-over logs
Signature carving EVTX records from unallocated space, pagefile, and memory — and the tools that handle malformed chunks gracefully when the live log is missing what you need.
- evtx
- carving
- dfir
- data-recovery
- anti-forensics
Detecting lateral movement in Security.evtx
How real adversary tools move host-to-host in Windows estates, and the precise event ID combinations in Security.evtx that catch PsExec, Impacket, and WMIExec.
- evtx
- lateral-movement
- dfir
- incident-response
- threat-hunting
Event log clearing and the gaps that survive
How attackers clear Windows event logs, what evidence remains on disk and in forwarded channels, and the difference between wevtutil cl and thread-suspension tools like Invoke-Phant0m.
- evtx
- anti-forensics
- dfir
- incident-response
- log-tampering
The EVTX file format, decoded
A working tour of the EVTX binary format: file header, ELFCHNK chunks, BinXML templates, substitution arrays, and why parsing this thing is harder than it looks.
- evtx
- file-format
- binxml
- dfir
- reverse-engineering
EVTX triage: what to read first when you have an hour and a host
A practitioner's order of operations for triaging Windows Event Logs during incident response — which channels matter, which event IDs lie to you, and where Sysmon does the heavy lifting.
- evtx
- incident-response
- windows-event-logs
- sysmon
- dfir
PowerShell logging: what you get with module and script block logging on
The practical difference between PowerShell module logging, script block logging, transcripts, and AMSI buffers — and the GPO settings that actually turn the useful ones on.
- evtx
- powershell
- dfir
- logging
- threat-hunting
Sysmon configuration that catches real adversaries
An opinionated take on Sysmon: which event IDs actually matter in IR, why olafhartong/sysmon-modular is the right baseline, and the configuration mistakes that blind you to real attacks.
- sysmon
- evtx
- detection-engineering
- dfir
- threat-hunting
Event ID 4663: An attempt was made to access an object
Event ID 4663 logs access to a file, folder or registry key audited by a SACL: who touched what, with which access mask. Setup, key fields and hunts.
Event ID 4672: Special privileges assigned to new logon
Event ID 4672 fires when a logon gets admin-equivalent privileges like SeDebugPrivilege. What it means, why it pairs with 4624, and how to track privileged sessions with it.
Event ID 4688: A new process has been created (command line)
Event ID 4688 logs every process creation in the Security log. How to enable command-line auditing, the fields that matter, how it compares to Sysmon Event ID 1, and triage patterns.
Event ID 4720 explained: detecting rogue account creation in AD
4720 fires every time a user account is created, local or domain. Read it with 4722, 4724, and 4732 and you catch persistence and lateral-movement accounts within minutes.
Event ID 4768: Kerberos TGT requests and AS-REP roasting
Event ID 4768: A Kerberos authentication ticket (TGT) was requested. How result codes and the pre-auth flag reveal AS-REP roasting, password spraying and delegation abuse.
Event ID 4769: Kerberos service tickets and kerberoasting
Event ID 4769: A Kerberos service ticket was requested. Which fields reveal kerberoasting (RC4 0x17 tickets), how to separate it from normal TGS noise, and how it pairs with 4768.
Event ID 7036 explained: service state changes for DFIR triage
7036 fires every time a service starts or stops. Paired with 7045 it confirms whether persistence actually ran. On its own it reveals service abuse, defense evasion, and boot anomalies.
How to open an EVTX file (Windows, Mac, Linux: 5 ways)
How to open a .evtx file: in your browser, Event Viewer, wevtutil, EvtxECmd or python-evtx. Works on Windows, macOS and Linux; pick by OS and how much you want to install.
What is an EVTX file? Windows Event Log files explained
An .evtx file is a Windows Event Log file. Where .evtx files are stored, what is inside (Security.evtx, System.evtx…), .evt vs .evtx, and how to open one on any OS.
How to collect .evtx logs from a live Windows system (4 methods)
Four ways to pull .evtx off a live Windows host: wevtutil, FTK Imager, KAPE, raw NTFS. With the chain-of-custody trade-offs for each and the commands you'll actually run.
Event ID 4625 explained: detecting brute force, sprays and enumeration
4625 is the failed-logon record. Read it right and you spot password sprays, credential stuffing, and Kerberos abuse before they turn into a success.
Event ID 1102: The audit log was cleared (what survives)
Event ID 1102 means the Windows Security audit log was cleared. See who cleared it, which fields prove it, what evidence survives and where to look next.
EVTX file format explained: chunks, templates and BinXML internals
How a .evtx file is laid out at the byte level: file header, 64 KB chunks, the template table, and the BinXML record stream that references it.
Event ID 4104: PowerShell Script Block Logging explained
Event ID 4104 records the full text of every PowerShell script block, even obfuscated or in-memory code. How to enable it, read it and hunt with it.
Event ID 7045: A service was installed in the system
Event ID 7045 (System log) records every new Windows service. The three fields that expose a malicious service (ImagePath, account, start type) and how attackers abuse it for persistence.
Sysmon Event ID 1 explained: process creation for DFIR triage
Sysmon's event 1 is the richest process-creation record Windows can produce. Here is what is in it and how to triage it fast.
Event ID 4624 explained: Windows successful logon and LogonType reference
What a 4624 record actually contains, why the LogonType field matters more than the event itself, and how to read them at scale.
Start here: a DFIR analyst's guide to .evtx
What .evtx is, which channels matter, the Event IDs to know, and where to find each one on disk. A navigational starting point for everything else on this blog.