<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 -->
<!-- NERF is a trademark of defconxt. -->
---
name: analyzing-windows-event-log-artifacts
description: >-
  Analyzes Windows Event Log artifacts using Chainsaw, Hayabusa, and native
  PowerShell to detect authentication attacks, persistence mechanisms, lateral
  movement, and privilege escalation from EVTX files.
domain: cybersecurity
subdomain: incident-response
tags:
  - windows-event-logs
  - EVTX
  - chainsaw
  - hayabusa
  - sigma-rules
  - log-analysis
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1070.001"]
---

# Analyzing Windows Event Log Artifacts

## Overview

Windows Event Logs are the primary audit trail for Windows systems. During
incident response, EVTX analysis reveals authentication attacks (brute force,
pass-the-hash), lateral movement (RDP, PsExec, WMI), persistence installation
(services, scheduled tasks), and privilege escalation. This skill covers rapid
triage with Chainsaw and Hayabusa, deep analysis with PowerShell, and timeline
reconstruction from multiple EVTX sources.

Key log channels: Security (4624/4625/4688), System (7045/7036), PowerShell
(4104), Sysmon (1/3/7/11/13), and Task Scheduler (106/200/201).

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Chainsaw | Fast EVTX hunting with Sigma | GitHub release binary |
| Hayabusa | EVTX timeline generator | GitHub release binary |
| EvtxECmd | EVTX parser (EZ tools) | Eric Zimmerman tools |
| PowerShell | Native log analysis | Pre-installed on Windows |
| Sigma rules | Detection signatures | `git clone https://github.com/SigmaHQ/sigma` |

## Key Concepts

### Critical Event IDs

| Event ID | Log | Significance |
|----------|-----|-------------|
| 4624 | Security | Successful logon (check logon type) |
| 4625 | Security | Failed logon attempt |
| 4648 | Security | Explicit credential logon (runas) |
| 4672 | Security | Special privileges assigned |
| 4688 | Security | Process creation (if audit enabled) |
| 4698 | Security | Scheduled task created |
| 4720 | Security | User account created |
| 4732 | Security | Member added to local group |
| 7045 | System | Service installed |
| 1 | Sysmon | Process creation with hashes |
| 3 | Sysmon | Network connection |
| 7 | Sysmon | Image loaded (DLL) |
| 11 | Sysmon | File creation |
| 4104 | PowerShell | Script block logging |

### Logon Types

| Type | Description | Lateral Movement? |
|------|-------------|-------------------|
| 2 | Interactive (console) | No |
| 3 | Network (SMB, mapped drive) | Yes |
| 4 | Batch (scheduled task) | Possible |
| 7 | Unlock (screen unlock) | No |
| 9 | NewCredentials (runas /netonly) | Yes |
| 10 | RemoteInteractive (RDP) | Yes |

## Workflow

### Step 1 — Collect EVTX Files

```bash
# Copy from live system
robocopy C:\Windows\System32\winevt\Logs\ D:\evidence\evtx\ *.evtx /Z

# Copy specific critical logs
Copy-Item C:\Windows\System32\winevt\Logs\Security.evtx D:\evidence\evtx\
Copy-Item C:\Windows\System32\winevt\Logs\System.evtx D:\evidence\evtx\
Copy-Item C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon*.evtx D:\evidence\evtx\
Copy-Item C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell*.evtx D:\evidence\evtx\
```

### Step 2 — Rapid Triage with Chainsaw

```bash
# Hunt with Sigma rules
chainsaw hunt /evidence/evtx/ \
  --sigma sigma/rules/ \
  --mapping mappings/sigma-event-logs-all.yml \
  --output /evidence/chainsaw_results.json \
  --json

# Search for specific patterns
chainsaw search /evidence/evtx/ -s "mimikatz"
chainsaw search /evidence/evtx/ -s "psexec" --timestamp "2026-03-01T00:00:00"
```

### Step 3 — Generate Timeline with Hayabusa

```bash
# Full timeline CSV
hayabusa csv-timeline -d /evidence/evtx/ -o /evidence/timeline.csv

# Filtered by severity
hayabusa csv-timeline -d /evidence/evtx/ -o /evidence/critical.csv \
  --min-level critical

# JSON output for ingestion
hayabusa json-timeline -d /evidence/evtx/ -o /evidence/timeline.jsonl
```

### Step 4 — Deep Analysis with PowerShell

```powershell
# Failed logons with source IPs
Get-WinEvent -Path D:\evidence\evtx\Security.evtx -FilterHashtable @{Id=4625} |
  Select-Object TimeCreated,
    @{N='User';E={$_.Properties[5].Value}},
    @{N='Source';E={$_.Properties[19].Value}},
    @{N='LogonType';E={$_.Properties[10].Value}} |
  Group-Object Source | Sort-Object Count -Descending

# Lateral movement detection (Type 3 + 10 logons)
Get-WinEvent -Path D:\evidence\evtx\Security.evtx -FilterHashtable @{Id=4624} |
  Where-Object { $_.Properties[8].Value -in @(3,10) } |
  Select-Object TimeCreated,
    @{N='User';E={$_.Properties[5].Value}},
    @{N='Source';E={$_.Properties[18].Value}},
    @{N='LogonType';E={$_.Properties[8].Value}}

# New services installed (persistence)
Get-WinEvent -Path D:\evidence\evtx\System.evtx -FilterHashtable @{Id=7045} |
  Select-Object TimeCreated,
    @{N='ServiceName';E={$_.Properties[0].Value}},
    @{N='ImagePath';E={$_.Properties[1].Value}}
```

### Step 5 — Correlate Across Logs

```bash
# Merge Hayabusa timeline with Chainsaw findings
# Sort by timestamp to build unified attack timeline
cat /evidence/timeline.csv | sort -t, -k1 > /evidence/sorted_timeline.csv

# Extract unique source IPs from lateral movement events
grep "LogonType.*\(3\|10\)" /evidence/timeline.csv | \
  cut -d, -f5 | sort -u > /evidence/lateral_sources.txt
```

## Detection

```yaml
title: Windows Event Log Artifacts Detection
id: dc85f5b5-d3a9-421e-b2e7-ddbacac79150
status: experimental
description: Detects suspicious activity related to analyzing windows event log artifacts techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*windows*"
  condition: selection
level: high
tags:
  - attack.t1070.001
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] All critical EVTX channels collected (Security, System, Sysmon, PowerShell)
- [ ] Chainsaw hunt completed with current Sigma rules
- [ ] Hayabusa timeline generated and sorted chronologically
- [ ] Failed logon patterns analyzed for brute force indicators
- [ ] Lateral movement logon types (3, 10) identified and source IPs extracted
- [ ] New service installations and scheduled tasks reviewed
- [ ] PowerShell script block logs examined for encoded commands
- [ ] Timeline correlated across multiple log sources

## References

- Chainsaw: https://github.com/WithSecureLabs/chainsaw
- Hayabusa: https://github.com/Yamato-Security/hayabusa
- SANS Windows Forensic Analysis Poster
- MITRE ATT&CK T1021 (Remote Services)
- MITRE ATT&CK T1547 (Boot or Logon Autostart Execution)
- Microsoft Event ID Reference: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing
