<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Windows Event Log Artifacts — API Reference

## Chainsaw Commands

### Hunt with Sigma Rules

```bash
chainsaw hunt /evidence/evtx/ \
  --sigma sigma/rules/ \
  --mapping mappings/sigma-event-logs-all.yml \
  --json --output results.json
```

### Search for Keywords

```bash
chainsaw search /evidence/evtx/ -s "mimikatz"
chainsaw search /evidence/evtx/ -s "psexec" --timestamp "2026-03-01T00:00:00"
```

## Hayabusa Commands

### CSV Timeline

```bash
hayabusa csv-timeline -d /evidence/evtx/ -o timeline.csv
hayabusa csv-timeline -d /evidence/evtx/ -o critical.csv --min-level critical
```

### JSON Timeline

```bash
hayabusa json-timeline -d /evidence/evtx/ -o timeline.jsonl
```

## PowerShell Queries

### Failed Logons (4625)

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 1000 |
  Select-Object TimeCreated,
    @{N='User';E={$_.Properties[5].Value}},
    @{N='Source';E={$_.Properties[19].Value}} |
  Group-Object Source | Sort-Object Count -Descending
```

### Lateral Movement (4624 Type 3/10)

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} |
  Where-Object { $_.Properties[8].Value -in @(3,10) } |
  Select-Object TimeCreated,
    @{N='User';E={$_.Properties[5].Value}},
    @{N='SourceIP';E={$_.Properties[18].Value}},
    @{N='LogonType';E={$_.Properties[8].Value}}
```

### New Services (7045)

```powershell
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} |
  Select-Object TimeCreated,
    @{N='Name';E={$_.Properties[0].Value}},
    @{N='Path';E={$_.Properties[1].Value}}
```

### PowerShell Script Blocks (4104)

```powershell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} |
  Select-Object TimeCreated, @{N='ScriptBlock';E={$_.Properties[2].Value}}
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `-d` | EVTX directory (Hayabusa) | `/evidence/evtx/` |
| `--sigma` | Sigma rules path (Chainsaw) | `sigma/rules/` |
| `--min-level` | Minimum alert severity | `critical`, `high`, `medium` |
| `-s` | Search string (Chainsaw) | `mimikatz` |
| `--timestamp` | Filter events after timestamp | `2026-03-01T00:00:00` |
