<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-event-log-forensics
description: >-
  Windows Event Log forensic analysis including Security, System, Application,
  PowerShell, and Sysmon log parsing, logon event correlation, lateral movement
  detection, log clearing detection, and automated analysis using EvtxECmd,
  hayabusa, chainsaw, and python-evtx.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - event-logs
  - evtx
  - windows-security
  - logon-events
  - sysmon
  - hayabusa
  - chainsaw
  - lateral-movement
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1070.001", "T1078", "T1021"]
  nist-csf: ["RS.AN-3", "DE.AE-3"]
  frameworks: ["NIST SP 800-86", "NIST SP 800-92"]
---

# Analyzing Event Log Forensics

## Overview

Windows Event Logs (.evtx) are essential forensic artifacts containing
security events, system activity, application behavior, and PowerShell
execution records. This skill covers critical Event IDs for incident
response, logon type analysis, lateral movement detection, log clearing
indicators, and automated hunting with hayabusa and chainsaw.

## Prerequisites

- EvtxECmd (Eric Zimmerman) or `python-evtx`
- hayabusa for Sigma-based EVTX hunting
- chainsaw for rapid triage
- Event logs from forensic image: `C:\Windows\System32\winevt\Logs\`

```bash
pip install python-evtx
```

## Key Concepts

### Critical Event IDs

**Security Log (Security.evtx):**

| EID | Description | Forensic Use |
|-----|-------------|-------------|
| 4624 | Successful logon | Track access, lateral movement |
| 4625 | Failed logon | Brute force, password spraying |
| 4634/4647 | Logoff | Session duration |
| 4648 | Explicit credential logon | RunAs, pass-the-hash |
| 4672 | Special privileges assigned | Admin logon detection |
| 4688 | Process creation | Command execution (if audit enabled) |
| 4698/4702 | Scheduled task created/updated | Persistence |
| 4720 | User account created | Account creation |
| 4732 | Member added to local group | Privilege escalation |
| 1102 | Audit log cleared | Anti-forensics |

**Logon Types:**

| Type | Description | Significance |
|------|-------------|-------------|
| 2 | Interactive (console) | Physical or RDP logon |
| 3 | Network | SMB, network share access |
| 4 | Batch | Scheduled task |
| 5 | Service | Service account |
| 7 | Unlock | Screen unlock |
| 8 | NetworkCleartext | IIS basic auth |
| 9 | NewCredentials | RunAs /netonly |
| 10 | RemoteInteractive | RDP |
| 11 | CachedInteractive | Cached credentials |

**Sysmon (Microsoft-Windows-Sysmon/Operational.evtx):**

| EID | Description |
|-----|-------------|
| 1 | Process creation (full command line, hashes) |
| 3 | Network connection |
| 7 | Image loaded (DLL) |
| 8 | CreateRemoteThread |
| 10 | ProcessAccess (credential dumping) |
| 11 | File create |
| 12/13/14 | Registry events |
| 22 | DNS query |

**PowerShell (Microsoft-Windows-PowerShell/Operational.evtx):**

| EID | Description |
|-----|-------------|
| 4103 | Module logging |
| 4104 | Script block logging (full script content) |
| 4105/4106 | Script start/stop |

## Workflow

### Step 1: Extract Event Logs

```bash
# From mounted forensic image
cp -r /mnt/evidence/Windows/System32/winevt/Logs/ ./evtx_files/

# Key log files:
# Security.evtx, System.evtx, Application.evtx
# Microsoft-Windows-Sysmon%4Operational.evtx
# Microsoft-Windows-PowerShell%4Operational.evtx
# Microsoft-Windows-TaskScheduler%4Operational.evtx
# Microsoft-Windows-TerminalServices-RDPClient%4Operational.evtx
```

### Step 2: Automated Hunting with hayabusa

```bash
# Scan all EVTX files with Sigma rules
hayabusa csv-timeline -d ./evtx_files/ -o timeline.csv

# Filter by severity
hayabusa csv-timeline -d ./evtx_files/ -o critical.csv --min-level critical

# Logon summary
hayabusa logon-summary -d ./evtx_files/ -o logons.csv

# Pivot keywords search
hayabusa search -d ./evtx_files/ -k "mimikatz|psexec|cobalt"
```

### Step 3: Chainsaw Rapid Triage

```bash
# Hunt with Sigma rules
chainsaw hunt ./evtx_files/ -s sigma_rules/ --mapping mappings/sigma-event-logs-all.yml

# Search for specific patterns
chainsaw search ./evtx_files/ -t "Event.System.EventID: 4688"

# Dump all events to JSON
chainsaw dump ./evtx_files/ --json
```

### Step 4: Python EVTX Analysis

```python
import Evtx.Evtx as evtx
import json
from xml.etree import ElementTree as ET

def parse_evtx(evtx_path: str, event_ids: list[int] | None = None,
               limit: int = 1000) -> list[dict]:
    events = []
    with evtx.Evtx(evtx_path) as log:
        for record in log.records():
            try:
                root = ET.fromstring(record.xml())
                ns = {"ns": "http://schemas.microsoft.com/win/2004/08/events/event"}
                eid = int(root.find(".//ns:EventID", ns).text)
                if event_ids and eid not in event_ids:
                    continue
                time_created = root.find(".//ns:TimeCreated", ns).get("SystemTime", "")
                event_data = {}
                for data in root.findall(".//ns:Data", ns):
                    name = data.get("Name", "")
                    event_data[name] = data.text or ""
                events.append({
                    "event_id": eid,
                    "timestamp": time_created,
                    "data": event_data,
                })
                if len(events) >= limit:
                    break
            except Exception:
                continue
    return events

# Example: Extract logon events
logons = parse_evtx("Security.evtx", event_ids=[4624, 4625])
for logon in logons:
    d = logon["data"]
    print(f"EID:{logon['event_id']} | {logon['timestamp']} | "
          f"User:{d.get('TargetUserName')} | Type:{d.get('LogonType')} | "
          f"Source:{d.get('IpAddress')}")
```

### Step 5: Lateral Movement Detection

```python
def detect_lateral_movement(evtx_path: str) -> list[dict]:
    """Detect lateral movement indicators from Security.evtx."""
    events = parse_evtx(evtx_path, event_ids=[4624, 4648, 4672])
    lateral = []
    for e in events:
        d = e["data"]
        logon_type = d.get("LogonType", "")
        if logon_type in ("3", "10"):
            src_ip = d.get("IpAddress", "")
            if src_ip and src_ip not in ("-", "127.0.0.1", "::1"):
                lateral.append({
                    "timestamp": e["timestamp"],
                    "event_id": e["event_id"],
                    "user": d.get("TargetUserName", ""),
                    "source_ip": src_ip,
                    "logon_type": logon_type,
                    "type_desc": "Network" if logon_type == "3" else "RDP",
                })
    return lateral
```

## Detection

```yaml
title: Event Log Forensics Detection
id: 20aaf715-24a5-4dcf-a285-202e367e1033
status: experimental
description: Detects suspicious activity related to analyzing event log forensics techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*event*"
  condition: selection
level: medium
tags:
  - attack.t1070.001
  - attack.t1078
  - attack.t1021
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] Event logs extracted from all relevant channels
- [ ] Security log analyzed for logon events (4624/4625) with type correlation
- [ ] Log clearing events (EID 1102, 104) identified
- [ ] Process creation events (EID 4688, Sysmon 1) reviewed
- [ ] PowerShell script blocks (EID 4104) extracted and analyzed
- [ ] Lateral movement indicators correlated across source/destination
- [ ] Timeline of security events reconstructed

## References

- [hayabusa](https://github.com/Yamato-Security/hayabusa)
- [chainsaw](https://github.com/WithSecureLabs/chainsaw)
- [EvtxECmd — Eric Zimmerman](https://ericzimmerman.github.io/)
- [python-evtx](https://github.com/williballenthin/python-evtx)
- [SANS Windows Event Log Poster](https://www.sans.org/posters/windows-forensic-analysis/)
