Windows EventViewer Analysis | DFIR
In this article, we will show you some approaches to analyze some activity on Windows events.
Last Activity View
Other tools from NirSoft can be observed and downloaded here.
Evtx analysis
Create a new filter with the type of event ID or events between a specific date.
2. After create it, click on context menu and "Save As ...".
Use a specific tool to analyze the logs.
Examples
Examples
DeepBlueCLI: https://github.com/sans-blue-team/DeepBlueCLI
WELA (Windows Event Log Analyzer): https://github.com/Yamato-Security/WELA
EventID - Windows Events Search
Outlook files analysis
View .msg files (from Outlook)
LogonTracer
Installation: Usage Neo4j 4.4.26
LogonTracer:
See installation manual: https://github.com/JPCERTCC/LogonTracer/wiki/for-linux
Acess: http://localhost:8081
Now load security.evtx logs from Windows.
Import larger 'security.evtx' files and parse them before
In some cases, we need to parse evtx files because a lot of junk is imported.
I created a rust script capable of filter larger files:
We can use an auxiliary file with owned users (users line by line).
Download the binary file from releases:
Import the XML into LogonTracer
Before import the XML file, just one line needs to be updated on the logontracer.py:
After this change, upload the file and enjoy :)
Last updated