Individual skill
extracting-windows-event-logs-artifacts
Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.
internal/tools/skills/data/digital-forensics/extracting-windows-event-logs-artifacts/SKILL.md
Source commit d42f381ad34843e71a42658e5c57290c713e85af
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 7, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,313
- Repository last updated
- Nov 7, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- cybersecurity Repository topic
- security Repository topic
- bug-bounty Repository topic
- automation Repository topic
- autonomous-pentesting Repository topic
- ai-agent Repository topic
- ai-security Repository topic
- ethical-hacking Repository topic
- golang Repository topic
- penetration-testing Repository topic
- forensics Declared skill tag
- windows-event-logs Declared skill tag
- evtx Declared skill tag
- chainsaw Declared skill tag
- hayabusa Declared skill tag
- sigma-rules Declared skill tag
- incident-response Declared skill tag
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# Extracting Windows Event Logs Artifacts
## When to Use
- When investigating security incidents on Windows systems through event log analysis
- For detecting lateral movement, privilege escalation, and persistence mechanisms
- When performing threat hunting across Windows event log data
- During compliance audits requiring review of authentication and access events
- When building forensic timelines from Windows system activity
## Detection Gaps & Validation
- **Cleared and rolled logs are the primary gap.** Look for Security EID **1102** (audit log cleared) and System EID **104** (log cleared); but a careful attacker stops the EventLog service or selectively removes records, leaving *no* 1102. Detect this by scanning for **gaps in the EventRecordID sequence**, not just a missing-clear assumption.
- **Audit policy controls what exists.** Command-line in 4688 requires `ProcessCreationIncludeCmdLine_Enabled`; object access (4663) and many 4769/4662 events are off by default. Empty results often mean "not audited," not "did not happen."
- **Rollover/overwrite:** the default `Security.evtx` is small and wraps by size, so older events during a long dwell time may be gone. Note the earliest record date to bound your visibility window.
- **Sysmon is not guaranteed:** rich process/network/EID 1,3,11 evidence only exists if Sysmon was deployed; do not assume it.