Daniel Roberson
  • Posts
  • About
  • Notes
  • Projects
  • Time
  • Posts
    About
    Notes
    Projects
    Time

Windows Event Log

0001-01-01

Windows Event Logs are a proprietary format for log files on Microsoft Windows systems. They typically have a file extension of .evt or .evtx and are found at C:\Windows\System32\winevt\Logs\

These can be viewed with the built in Event Viewer tool on Windows or with third-party tools such as Event Log Explorer.

https://eventlogxp.com/

There are a few ways to access evt/evtx files on Linux: https://softwarerecs.stackexchange.com/questions/17590/how-to-view-evtx-files-on-linux-windows-event-log

python-evtx libevtx-utils package https://github.com/omerbenamram/EVTX rust crate evtx/evtx_dump Super Speedy Syslog Searcher (s4) https://crates.io/crates/super-speedy-syslog-searcher


Links to this note

  • incidentresponse-luttgens2014
  • hackingteamwriteup-fisher2016
  • borges2021
  • sysmon

Recent Posts

Linux Persistence: Modular Software

2025-04-17 DFIR CTF persistence linux persistence apache asterisk

Linux Persistence: Web Shells

2025-04-16 DFIR persistence webshell linux persistence webshell apache nginx PHP

Linux Persistence: Rootkits

2025-04-15 DFIR persistence rootkit LKM linux persistence LKM rootkit LD_PRELOAD kprobe ftrace ld.so hooking

Linux Persistence: Processes

2025-04-11 DFIR persistence processes linux persistence processes

Defanging Linux LKM Rootkits With cleanup_module()

2025-04-05 Linux LKM rootkits EDR hooks incident response Linux LKM rootkit


Home

About

Notes

Projects

Time

© All rights reserved. Powered by Hugo and Erblog.