Sitemap
All pages on the site.
Home
DFIR blog: Windows Event Log forensics & .evtx parsing
- Run Sigma rules on EVTX in your browser
- "The description for Event ID cannot be found": fix it
- AppLocker event logs: 8003, 8004 and what ran
- Event ID 4719: audit policy tampering as an early warning
- Active Directory changes: Event ID 5136 and DCSync (4662)
- Event ID 4697: a service was installed (and why it beats 7045)
- File share access: Event IDs 5140 and 5145
- Sysmon Event ID 22: DNS queries, C2 domains and exfiltration
- Sysmon file and registry events: 11, 12–14, 15 and 23/26
- Sysmon Event ID 7: image loads, DLL hijacking and sideloading
- Sysmon Event ID 3: Network connection detected (C2 hunting)
- Sysmon Event IDs 8 and 10: process injection and LSASS access
- Event ID 4616: system time changes and timestomping
- Event ID 3076 & 3077: WDAC Code Integrity blocks explained
- Windows Defender event logs: detections and tampering
- Account lockouts and password resets: 4740, 4724 and 4767
- How BinXML actually works: decoding the EVTX token stream
- Detecting RDP lateral movement in event logs
- Did someone RDP into this host? A step-by-step investigation
- Building an event-log timeline for incident response
- The EVTX file format: a complete byte-level reference
- Tampered event logs and what survives
- Privileged group changes: Event IDs 4732, 4728 and 4756
- Querying EVTX with PowerShell: Get-WinEvent, FilterHashtable and XPath
- RDP forensics: the complete event-log picture
- Scheduled task persistence: Event ID 4698 and the Task Scheduler log
- Running Sigma rules over EVTX with Chainsaw and Hayabusa
- Windows Event ID Cheat Sheet (Security, Sysmon, PowerShell)
- Reading Windows logons end to end: 4624, 4625, Kerberos and NTLM
- Event ID 5861: WMI persistence in the WMI-Activity log
- Carving deleted EVTX records and recovering rolled-over logs
- Detecting lateral movement in Security.evtx
- Event log clearing and the gaps that survive
- The EVTX file format, decoded
- EVTX triage: what to read first when you have an hour and a host
- PowerShell logging: what you get with module and script block logging on
- Sysmon configuration that catches real adversaries
- Event ID 4663: An attempt was made to access an object
- Event ID 4672: Special privileges assigned to new logon
- Event ID 4688: A new process has been created (command line)
- Event ID 4720 explained: detecting rogue account creation in AD
- Event ID 4768: Kerberos TGT requests and AS-REP roasting
- Event ID 4769: Kerberos service tickets and kerberoasting
- Event ID 7036 explained: service state changes for DFIR triage
- How to open an EVTX file (Windows, Mac, Linux: 5 ways)
- What is an EVTX file? Windows Event Log files explained
- How to collect .evtx logs from a live Windows system (4 methods)
- Event ID 4625 explained: detecting brute force, sprays and enumeration
- Event ID 1102: The audit log was cleared (what survives)
- EVTX file format explained: chunks, templates and BinXML internals
- Event ID 4104: PowerShell Script Block Logging explained
- Event ID 7045: A service was installed in the system
- Sysmon Event ID 1 explained: process creation for DFIR triage
- Event ID 4624 explained: Windows successful logon and LogonType reference
- Start here: a DFIR analyst's guide to .evtx