<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Event Log Forensics

## EvtxECmd (Eric Zimmerman)

```bash
# Parse single EVTX file to CSV
EvtxECmd.exe -f Security.evtx --csv . --csvf security.csv

# Parse directory of EVTX files
EvtxECmd.exe -d ./evtx_files/ --csv . --csvf all_events.csv

# Include full XML payload
EvtxECmd.exe -f Security.evtx --csv . --csvf sec.csv --inc
```

## hayabusa

```bash
# Generate CSV timeline with Sigma detections
hayabusa csv-timeline -d ./evtx_files/ -o timeline.csv

# Filter by minimum severity
hayabusa csv-timeline -d ./evtx_files/ -o critical.csv --min-level critical

# Logon event summary
hayabusa logon-summary -d ./evtx_files/ -o logons.csv

# Keyword search
hayabusa search -d ./evtx_files/ -k "mimikatz|psexec|cobalt"

# Metrics summary
hayabusa metrics -d ./evtx_files/

# Pivot keywords
hayabusa pivot-keywords-list -d ./evtx_files/ -o pivot.csv
```

## chainsaw

```bash
# Hunt with Sigma rules
chainsaw hunt ./evtx_files/ -s sigma_rules/ \
  --mapping mappings/sigma-event-logs-all.yml

# Search specific Event ID
chainsaw search ./evtx_files/ -t "Event.System.EventID: 4688"

# Dump raw events
chainsaw dump ./evtx_files/ --json

# Lateral movement detection
chainsaw hunt ./evtx_files/ -s rules/ --lateral
```

## python-evtx

```python
import Evtx.Evtx as evtx
from xml.etree import ElementTree as ET

ns = {"ns": "http://schemas.microsoft.com/win/2004/08/events/event"}

with evtx.Evtx("Security.evtx") as log:
    for record in log.records():
        root = ET.fromstring(record.xml())
        eid = root.find(".//ns:EventID", ns).text
        time = root.find(".//ns:TimeCreated", ns).get("SystemTime")
        data = {d.get("Name"): d.text
                for d in root.findall(".//ns:Data", ns)}
```

## Critical Event ID Quick Reference

### Authentication & Access
| EID | Log | Description |
|-----|-----|-------------|
| 4624 | Security | Successful logon |
| 4625 | Security | Failed logon |
| 4648 | Security | Explicit credential logon |
| 4672 | Security | Admin privilege assigned |
| 4776 | Security | NTLM authentication |

### Account & Group Changes
| EID | Log | Description |
|-----|-----|-------------|
| 4720 | Security | Account created |
| 4722 | Security | Account enabled |
| 4732 | Security | Added to local group |
| 4756 | Security | Added to universal group |

### Process & Execution
| EID | Log | Description |
|-----|-----|-------------|
| 4688 | Security | Process creation |
| 4689 | Security | Process exit |
| 1 | Sysmon | Process create (detailed) |
| 4104 | PowerShell | Script block logged |

### Anti-Forensics
| EID | Log | Description |
|-----|-----|-------------|
| 1102 | Security | Security log cleared |
| 104 | System | Any log cleared |
| 7045 | System | Service installed |
| 7040 | System | Service start type changed |

## Logon Type Reference

| Type | Name | Network | Description |
|------|------|---------|-------------|
| 2 | Interactive | No | Console/KVM |
| 3 | Network | Yes | SMB, WinRM |
| 4 | Batch | No | Scheduled task |
| 5 | Service | No | Service account |
| 7 | Unlock | No | Workstation unlock |
| 9 | NewCredentials | Yes | RunAs /netonly |
| 10 | RemoteInteractive | Yes | RDP |
| 11 | CachedInteractive | No | Cached creds (offline) |
