[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EV58DM716V2TCEWA6DRE7B":3,"skill-same:01M6EV58DM716V2TCEWA6DRE7B":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M6EV58DM716V2TCEWA6DRE7B","extracting-windows-event-logs-artifacts",null,"Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.","luokai0\u002Fai-agent-skills-by-luo-kai","luokai0","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F266954973?v=4","01M6E16VNT42JB8B3X3254QWJ7","luo kai","01M6E16VTFVP6S5XJF1V1MPV90",14,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fextracting-windows-event-logs-artifacts\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"windows","extracting","event","extracting windows event logs artifacts","logs","artifacts","forensics","incident-response","event-logs","escalation","sigma-rules","windows-event-logs","evtx","chainsaw","hayabusa","analyze","Rules","incident","detect","cybersecurity","2026-11-10 10:12:30",false,"---\nname: extracting-windows-event-logs-artifacts\ndescription: Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags: [forensics, windows-event-logs, evtx, chainsaw, hayabusa, sigma-rules, incident-response]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Extracting Windows Event Logs Artifacts\n\n## When to Use\n- When investigating security incidents on Windows systems through event log analysis\n- For detecting lateral movement, privilege escalation, and persistence mechanisms\n- When performing threat hunting across Windows event log data\n- During compliance audits requiring review of authentication and access events\n- When building forensic timelines from Windows system activity\n\n## Prerequisites\n- Windows Event Log files (EVTX format) from forensic image or live system\n- Chainsaw, Hayabusa, or EvtxECmd for parsing and detection\n- Sigma rules for automated threat detection\n- Understanding of critical Windows Event IDs\n- Python with python-evtx or evtx library for custom parsing\n- PowerShell for live system analysis (if applicable)\n\n## Workflow\n\n### Step 1: Collect Windows Event Log Files\n\n```bash\n# Extract EVTX files from forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002F*.evtx \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F\n\n# Key event logs to prioritize\n# Security.evtx - Authentication, authorization, audit events\n# System.evtx - System services, drivers, hardware events\n# Application.evtx - Application errors and events\n# Microsoft-Windows-Sysmon%4Operational.evtx - Detailed process\u002Fnetwork monitoring\n# Microsoft-Windows-PowerShell%4Operational.evtx - PowerShell activity\n# Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx - RDP sessions\n# Microsoft-Windows-TaskScheduler%4Operational.evtx - Scheduled tasks\n# Microsoft-Windows-WinRM%4Operational.evtx - Windows Remote Management\n# Microsoft-Windows-Bits-Client%4Operational.evtx - BITS transfers\n# Microsoft-Windows-Windows Defender%4Operational.evtx - AV detections\n\n# List available log files and sizes\nls -lhS \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F | head -20\n\n# Hash for integrity\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F*.evtx > \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002Fevtx_hashes.txt\n```\n\n### Step 2: Run Chainsaw for Sigma-Based Detection\n\n```bash\n# Install Chainsaw\nwget https:\u002F\u002Fgithub.com\u002FWithSecureLabs\u002Fchainsaw\u002Freleases\u002Flatest\u002Fdownload\u002Fchainsaw_all_platforms+rules.zip\nunzip chainsaw_all_platforms+rules.zip -d \u002Fopt\u002Fchainsaw\n\n# Run Chainsaw with bundled Sigma rules\n\u002Fopt\u002Fchainsaw\u002Fchainsaw hunt \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -s \u002Fopt\u002Fchainsaw\u002Fsigma\u002Frules\u002F \\\n   --mapping \u002Fopt\u002Fchainsaw\u002Fmappings\u002Fsigma-event-logs-all.yml \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchainsaw_results.txt\n\n# Run with CSV output for easier analysis\n\u002Fopt\u002Fchainsaw\u002Fchainsaw hunt \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -s \u002Fopt\u002Fchainsaw\u002Fsigma\u002Frules\u002F \\\n   --mapping \u002Fopt\u002Fchainsaw\u002Fmappings\u002Fsigma-event-logs-all.yml \\\n   --csv \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchainsaw_results\u002F\n\n# Run with JSON output\n\u002Fopt\u002Fchainsaw\u002Fchainsaw hunt \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -s \u002Fopt\u002Fchainsaw\u002Fsigma\u002Frules\u002F \\\n   --mapping \u002Fopt\u002Fchainsaw\u002Fmappings\u002Fsigma-event-logs-all.yml \\\n   --json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchainsaw_results.json\n\n# Search for specific keywords\n\u002Fopt\u002Fchainsaw\u002Fchainsaw search \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -s \"mimikatz\" --json\n\n# Search for specific event IDs\n\u002Fopt\u002Fchainsaw\u002Fchainsaw search \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -e 4688 --json | head -100\n```\n\n### Step 3: Run Hayabusa for Fast Timeline Generation\n\n```bash\n# Install Hayabusa\nwget https:\u002F\u002Fgithub.com\u002FYamato-Security\u002Fhayabusa\u002Freleases\u002Flatest\u002Fdownload\u002Fhayabusa-linux-x64-musl.zip\nunzip hayabusa-linux-x64-musl.zip -d \u002Fopt\u002Fhayabusa\n\n# Generate CSV timeline with all detection rules\n\u002Fopt\u002Fhayabusa\u002Fhayabusa csv-timeline \\\n   -d \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhayabusa_timeline.csv \\\n   -p verbose\n\n# Generate JSON timeline\n\u002Fopt\u002Fhayabusa\u002Fhayabusa json-timeline \\\n   -d \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhayabusa_timeline.json\n\n# Run with only critical and high severity detections\n\u002Fopt\u002Fhayabusa\u002Fhayabusa csv-timeline \\\n   -d \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhayabusa_critical.csv \\\n   -p verbose \\\n   --min-level critical\n\n# Generate detection summary (metrics)\n\u002Fopt\u002Fhayabusa\u002Fhayabusa metrics \\\n   -d \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhayabusa_metrics.csv\n\n# Logon summary\n\u002Fopt\u002Fhayabusa\u002Fhayabusa logon-summary \\\n   -d \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flogon_summary.csv\n```\n\n### Step 4: Parse Specific Critical Event IDs\n\n```bash\n# Extract authentication events with python-evtx\npip install evtx\n\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\n\nparser = PyEvtxParser(\"\u002Fcases\u002Fcase-2024-001\u002Fevtx\u002FSecurity.evtx\")\n\n# Critical Event IDs mapping\ncritical_events = {\n    '4624': 'Successful Logon',\n    '4625': 'Failed Logon',\n    '4634': 'Logoff',\n    '4648': 'Explicit Credential Logon',\n    '4672': 'Special Privileges Assigned',\n    '4688': 'Process Created',\n    '4689': 'Process Exited',\n    '4697': 'Service Installed',\n    '4698': 'Scheduled Task Created',\n    '4720': 'User Account Created',\n    '4724': 'Password Reset Attempted',\n    '4728': 'Member Added to Global Group',\n    '4732': 'Member Added to Local Group',\n    '4756': 'Member Added to Universal Group',\n    '1102': 'Audit Log Cleared',\n    '4688': 'New Process Created'\n}\n\nresults = {eid: [] for eid in critical_events}\n\nfor record in parser.records_json():\n    data = json.loads(record['data'])\n    event_id = str(data['Event']['System']['EventID'])\n\n    if event_id in critical_events:\n        event_data = data['Event'].get('EventData', {})\n        results[event_id].append({\n            'timestamp': data['Event']['System']['TimeCreated']['#attributes']['SystemTime'],\n            'event_id': event_id,\n            'description': critical_events[event_id],\n            'data': event_data\n        })\n\n# Print summary\nfor eid, events in results.items():\n    if events:\n        print(f\"\\n[{eid}] {critical_events[eid]}: {len(events)} events\")\n        for e in events[:3]:\n            print(f\"  {e['timestamp']}: {json.dumps(e['data'], default=str)[:200]}\")\n        if len(events) > 3:\n            print(f\"  ... and {len(events)-3} more\")\n\n# Save full results\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcritical_events.json', 'w') as f:\n    json.dump(results, f, indent=2, default=str)\nPYEOF\n```\n\n### Step 5: Detect Specific Attack Patterns\n\n```bash\n# Detect Pass-the-Hash (Logon Type 9 with NTLM)\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\n\nparser = PyEvtxParser(\"\u002Fcases\u002Fcase-2024-001\u002Fevtx\u002FSecurity.evtx\")\n\nprint(\"=== PASS-THE-HASH INDICATORS ===\")\nprint(\"Looking for: Event 4624, Logon Type 9, NTLM authentication\\n\")\n\nfor record in parser.records_json():\n    data = json.loads(record['data'])\n    event_id = str(data['Event']['System']['EventID'])\n\n    if event_id == '4624':\n        event_data = data['Event'].get('EventData', {})\n        logon_type = str(event_data.get('LogonType', ''))\n        auth_package = str(event_data.get('AuthenticationPackageName', ''))\n        logon_process = str(event_data.get('LogonProcessName', ''))\n\n        # Pass-the-Hash indicators\n        if logon_type == '9' and 'NTLM' in auth_package:\n            timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n            target = event_data.get('TargetUserName', 'Unknown')\n            source_ip = event_data.get('IpAddress', 'N\u002FA')\n            print(f\"  [{timestamp}] PtH: User={target}, IP={source_ip}, Auth={auth_package}\")\n\n        # Network logon with NTLM (lateral movement)\n        if logon_type == '3' and 'NTLM' in auth_package:\n            timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n            target = event_data.get('TargetUserName', 'Unknown')\n            source_ip = event_data.get('IpAddress', 'N\u002FA')\n            workstation = event_data.get('WorkstationName', 'N\u002FA')\n            print(f\"  [{timestamp}] Network NTLM: User={target}, IP={source_ip}, WS={workstation}\")\nPYEOF\n\n# Detect log clearing \u002F anti-forensics\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\n\nfor log_file in ['Security.evtx', 'System.evtx']:\n    path = f\"\u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F{log_file}\"\n    try:\n        parser = PyEvtxParser(path)\n        for record in parser.records_json():\n            data = json.loads(record['data'])\n            event_id = str(data['Event']['System']['EventID'])\n            if event_id in ('1102', '104'):  # Security log cleared, System log cleared\n                timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n                print(f\"LOG CLEARED: [{timestamp}] EventID {event_id} in {log_file}\")\n    except Exception as e:\n        print(f\"Error parsing {log_file}: {e}\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| EVTX format | Binary XML-based Windows Event Log format introduced in Vista\u002FServer 2008 |\n| Event ID | Numeric identifier for specific event types (e.g., 4624 = successful logon) |\n| Logon types | Classification of authentication methods (2=interactive, 3=network, 10=RDP) |\n| Sigma rules | Generic detection signatures that map to specific SIEM\u002Flog queries |\n| Sysmon | Microsoft system monitoring driver providing detailed process and network events |\n| Audit policy | GPO settings controlling which events Windows records |\n| Event forwarding (WEF) | Windows mechanism for centralized event log collection |\n| EVTX channels | Separate log files for different event categories and applications |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Chainsaw | Sigma-based EVTX analysis and threat hunting tool |\n| Hayabusa | Fast Windows Event Log forensic timeline generator |\n| EvtxECmd | Eric Zimmerman command-line EVTX parser with CSV\u002FJSON output |\n| python-evtx | Python library for EVTX file parsing |\n| LogParser | Microsoft SQL-like query engine for Windows logs |\n| Event Log Explorer | GUI tool for browsing and analyzing EVTX files |\n| KAPE | Automated triage collection including event logs |\n| Velociraptor | Endpoint agent with EVTX collection and hunting artifacts |\n\n## Common Scenarios\n\n**Scenario 1: Detecting Lateral Movement**\nFilter for Event 4624 with Logon Type 3 (network) and Type 10 (RDP), identify unusual source-destination pairs, check for Event 4648 (explicit credentials) indicating pass-the-hash, correlate with process creation events (4688) on target systems.\n\n**Scenario 2: Privilege Escalation Detection**\nSearch for Event 4672 (special privileges assigned) for unexpected users, check for Event 4728\u002F4732 (group membership changes) adding users to admin groups, look for Event 4697 (service installed) indicating new system-level access, correlate with 4720 (account creation).\n\n**Scenario 3: PowerShell Attack Detection**\nAnalyze PowerShell Operational log for Script Block Logging (Event 4104), search for encoded commands in Event 4688 (process creation with command line), detect AMSI bypass attempts, identify download cradles and invocation of known attack tools.\n\n**Scenario 4: Ransomware Incident Reconstruction**\nBuild timeline starting from initial access (4624 from external IP), trace privilege escalation through group membership changes, identify service installations for persistence, find process creation events for encryption executable, detect volume shadow copy deletion in System log.\n\n## Output Format\n\n```\nWindows Event Log Analysis Summary:\n  System: DC01.corp.local (Windows Server 2019)\n  Log Files Analyzed: 15 EVTX files\n  Total Events: 2,456,789\n  Analysis Period: 2024-01-10 to 2024-01-20\n\n  Chainsaw Detections:\n    Critical:  12 (Mimikatz usage, PsExec, log clearing)\n    High:      34 (Network NTLM logons, encoded PowerShell)\n    Medium:    89 (Unusual service installations, scheduled tasks)\n    Low:       234 (Informational)\n\n  Hayabusa Timeline:\n    Total Alerts: 369\n    Unique Rules Triggered: 45\n    Top Rules:\n      - Suspicious NTLM Authentication (34 hits)\n      - PowerShell Download Cradle (12 hits)\n      - Service Installation Suspicious Path (8 hits)\n\n  Critical Findings:\n    2024-01-15 14:32 - RDP brute force (234 failed, 1 success from 203.0.113.45)\n    2024-01-15 14:45 - Admin account created (svcbackup) - Event 4720\n    2024-01-16 02:30 - PsExec service installed on DC01 - Event 4697\n    2024-01-18 03:00 - Security log cleared - Event 1102\n\n  Reports:\n    Chainsaw: \u002Fanalysis\u002Fchainsaw_results\u002F\n    Hayabusa: \u002Fanalysis\u002Fhayabusa_timeline.csv\n    Critical Events: \u002Fanalysis\u002Fcritical_events.json\n```\n","# Extracting Windows Event Logs Artifacts\n\n## When to Use\n- When investigating security incidents on Windows systems through event log analysis\n- For detecting lateral movement, privilege escalation, and persistence mechanisms\n- When performing threat hunting across Windows event log data\n- During compliance audits requiring review of authentication and access events\n- When building forensic timelines from Windows system activity\n\n## Prerequisites\n- Windows Event Log files (EVTX format) from forensic image or live system\n- Chainsaw, Hayabusa, or EvtxECmd for parsing and detection\n- Sigma rules for automated threat detection\n- Understanding of critical Windows Event IDs\n- Python with python-evtx or evtx library for custom parsing\n- PowerShell for live system analysis (if applicable)\n\n## Workflow\n\n### Step 1: Collect Windows Event Log Files\n\n```bash\n# Extract EVTX files from forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002F*.evtx \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F\n\n# Key event logs to prioritize\n# Security.evtx - Authentication, authorization, audit events\n# System.evtx - System services, drivers, hardware events\n# Application.evtx - Application errors and events\n# Microsoft-Windows-Sysmon%4Operational.evtx - Detailed process\u002Fnetwork monitoring\n# Microsoft-Windows-PowerShell%4Operational.evtx - PowerShell activity\n# Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx - RDP sessions\n# Microsoft-Windows-TaskScheduler%4Operational.evtx - Scheduled tasks\n# Microsoft-Windows-WinRM%4Operational.evtx - Windows Remote Management\n# Microsoft-Windows-Bits-Client%4Operational.evtx - BITS transfers\n# Microsoft-Windows-Windows Defender%4Operational.evtx - AV detections\n\n# List available log files and sizes\nls -lhS \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F | head -20\n\n# Hash for integrity\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F*.evtx > \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002Fevtx_hashes.txt\n```\n\n### Step 2: Run Chainsaw for Sigma-Based Detection\n\n```bash\n# Install Chainsaw\nwget https:\u002F\u002Fgithub.com\u002FWithSecureLabs\u002Fchainsaw\u002Freleases\u002Flatest\u002Fdownload\u002Fchainsaw_all_platforms+rules.zip\nunzip chainsaw_all_platforms+rules.zip -d \u002Fopt\u002Fchainsaw\n\n# Run Chainsaw with bundled Sigma rules\n\u002Fopt\u002Fchainsaw\u002Fchainsaw hunt \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -s \u002Fopt\u002Fchainsaw\u002Fsigma\u002Frules\u002F \\\n   --mapping \u002Fopt\u002Fchainsaw\u002Fmappings\u002Fsigma-event-logs-all.yml \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchainsaw_results.txt\n\n# Run with CSV output for easier analysis\n\u002Fopt\u002Fchainsaw\u002Fchainsaw hunt \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -s \u002Fopt\u002Fchainsaw\u002Fsigma\u002Frules\u002F \\\n   --mapping \u002Fopt\u002Fchainsaw\u002Fmappings\u002Fsigma-event-logs-all.yml \\\n   --csv \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchainsaw_results\u002F\n\n# Run with JSON output\n\u002Fopt\u002Fchainsaw\u002Fchainsaw hunt \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -s \u002Fopt\u002Fchainsaw\u002Fsigma\u002Frules\u002F \\\n   --mapping \u002Fopt\u002Fchainsaw\u002Fmappings\u002Fsigma-event-logs-all.yml \\\n   --json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fchainsaw_results.json\n\n# Search for specific keywords\n\u002Fopt\u002Fchainsaw\u002Fchainsaw search \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -s \"mimikatz\" --json\n\n# Search for specific event IDs\n\u002Fopt\u002Fchainsaw\u002Fchainsaw search \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -e 4688 --json | head -100\n```\n\n### Step 3: Run Hayabusa for Fast Timeline Generation\n\n```bash\n# Install Hayabusa\nwget https:\u002F\u002Fgithub.com\u002FYamato-Security\u002Fhayabusa\u002Freleases\u002Flatest\u002Fdownload\u002Fhayabusa-linux-x64-musl.zip\nunzip hayabusa-linux-x64-musl.zip -d \u002Fopt\u002Fhayabusa\n\n# Generate CSV timeline with all detection rules\n\u002Fopt\u002Fhayabusa\u002Fhayabusa csv-timeline \\\n   -d \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhayabusa_timeline.csv \\\n   -p verbose\n\n# Generate JSON timeline\n\u002Fopt\u002Fhayabusa\u002Fhayabusa json-timeline \\\n   -d \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhayabusa_timeline.json\n\n# Run with only critical and high severity detections\n\u002Fopt\u002Fhayabusa\u002Fhayabusa csv-timeline \\\n   -d \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhayabusa_critical.csv \\\n   -p verbose \\\n   --min-level critical\n\n# Generate detection summary (metrics)\n\u002Fopt\u002Fhayabusa\u002Fhayabusa metrics \\\n   -d \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhayabusa_metrics.csv\n\n# Logon summary\n\u002Fopt\u002Fhayabusa\u002Fhayabusa logon-summary \\\n   -d \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flogon_summary.csv\n```\n\n### Step 4: Parse Specific Critical Event IDs\n\n```bash\n# Extract authentication events with python-evtx\npip install evtx\n\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\n\nparser = PyEvtxParser(\"\u002Fcases\u002Fcase-2024-001\u002Fevtx\u002FSecurity.evtx\")\n\n# Critical Event IDs mapping\ncritical_events = {\n    '4624': 'Successful Logon',\n    '4625': 'Failed Logon',\n    '4634': 'Logoff',\n    '4648': 'Explicit Credential Logon',\n    '4672': 'Special Privileges Assigned',\n    '4688': 'Process Created',\n    '4689': 'Process Exited',\n    '4697': 'Service Installed',\n    '4698': 'Scheduled Task Created',\n    '4720': 'User Account Created',\n    '4724': 'Password Reset Attempted',\n    '4728': 'Member Added to Global Group',\n    '4732': 'Member Added to Local Group',\n    '4756': 'Member Added to Universal Group',\n    '1102': 'Audit Log Cleared',\n    '4688': 'New Process Created'\n}\n\nresults = {eid: [] for eid in critical_events}\n\nfor record in parser.records_json():\n    data = json.loads(record['data'])\n    event_id = str(data['Event']['System']['EventID'])\n\n    if event_id in critical_events:\n        event_data = data['Event'].get('EventData', {})\n        results[event_id].append({\n            'timestamp': data['Event']['System']['TimeCreated']['#attributes']['SystemTime'],\n            'event_id': event_id,\n            'description': critical_events[event_id],\n            'data': event_data\n        })\n\n# Print summary\nfor eid, events in results.items():\n    if events:\n        print(f\"\\n[{eid}] {critical_events[eid]}: {len(events)} events\")\n        for e in events[:3]:\n            print(f\"  {e['timestamp']}: {json.dumps(e['data'], default=str)[:200]}\")\n        if len(events) > 3:\n            print(f\"  ... and {len(events)-3} more\")\n\n# Save full results\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcritical_events.json', 'w') as f:\n    json.dump(results, f, indent=2, default=str)\nPYEOF\n```\n\n### Step 5: Detect Specific Attack Patterns\n\n```bash\n# Detect Pass-the-Hash (Logon Type 9 with NTLM)\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\n\nparser = PyEvtxParser(\"\u002Fcases\u002Fcase-2024-001\u002Fevtx\u002FSecurity.evtx\")\n\nprint(\"=== PASS-THE-HASH INDICATORS ===\")\nprint(\"Looking for: Event 4624, Logon Type 9, NTLM authentication\\n\")\n\nfor record in parser.records_json():\n    data = json.loads(record['data'])\n    event_id = str(data['Event']['System']['EventID'])\n\n    if event_id == '4624':\n        event_data = data['Event'].get('EventData', {})\n        logon_type = str(event_data.get('LogonType', ''))\n        auth_package = str(event_data.get('AuthenticationPackageName', ''))\n        logon_process = str(event_data.get('LogonProcessName', ''))\n\n        # Pass-the-Hash indicators\n        if logon_type == '9' and 'NTLM' in auth_package:\n            timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n            target = event_data.get('TargetUserName', 'Unknown')\n            source_ip = event_data.get('IpAddress', 'N\u002FA')\n            print(f\"  [{timestamp}] PtH: User={target}, IP={source_ip}, Auth={auth_package}\")\n\n        # Network logon with NTLM (lateral movement)\n        if logon_type == '3' and 'NTLM' in auth_package:\n            timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n            target = event_data.get('TargetUserName', 'Unknown')\n            source_ip = event_data.get('IpAddress', 'N\u002FA')\n            workstation = event_data.get('WorkstationName', 'N\u002FA')\n            print(f\"  [{timestamp}] Network NTLM: User={target}, IP={source_ip}, WS={workstation}\")\nPYEOF\n\n# Detect log clearing \u002F anti-forensics\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\n\nfor log_file in ['Security.evtx', 'System.evtx']:\n    path = f\"\u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F{log_file}\"\n    try:\n        parser = PyEvtxParser(path)\n        for record in parser.records_json():\n            data = json.loads(record['data'])\n            event_id = str(data['Event']['System']['EventID'])\n            if event_id in ('1102', '104'):  # Security log cleared, System log cleared\n                timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n                print(f\"LOG CLEARED: [{timestamp}] EventID {event_id} in {log_file}\")\n    except Exception as e:\n        print(f\"Error parsing {log_file}: {e}\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| EVTX format | Binary XML-based Windows Event Log format introduced in Vista\u002FServer 2008 |\n| Event ID | Numeric identifier for specific event types (e.g., 4624 = successful logon) |\n| Logon types | Classification of authentication methods (2=interactive, 3=network, 10=RDP) |\n| Sigma rules | Generic detection signatures that map to specific SIEM\u002Flog queries |\n| Sysmon | Microsoft system monitoring driver providing detailed process and network events |\n| Audit policy | GPO settings controlling which events Windows records |\n| Event forwarding (WEF) | Windows mechanism for centralized event log collection |\n| EVTX channels | Separate log files for different event categories and applications |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Chainsaw | Sigma-based EVTX analysis and threat hunting tool |\n| Hayabusa | Fast Windows Event Log forensic timeline generator |\n| EvtxECmd | Eric Zimmerman command-line EVTX parser with CSV\u002FJSON output |\n| python-evtx | Python library for EVTX file parsing |\n| LogParser | Microsoft SQL-like query engine for Windows logs |\n| Event Log Explorer | GUI tool for browsing and analyzing EVTX files |\n| KAPE | Automated triage collection including event logs |\n| Velociraptor | Endpoint agent with EVTX collection and hunting artifacts |\n\n## Common Scenarios\n\n**Scenario 1: Detecting Lateral Movement**\nFilter for Event 4624 with Logon Type 3 (network) and Type 10 (RDP), identify unusual source-destination pairs, check for Event 4648 (explicit credentials) indicating pass-the-hash, correlate with process creation events (4688) on target systems.\n\n**Scenario 2: Privilege Escalation Detection**\nSearch for Event 4672 (special privileges assigned) for unexpected users, check for Event 4728\u002F4732 (group membership changes) adding users to admin groups, look for Event 4697 (service installed) indicating new system-level access, correlate with 4720 (account creation).\n\n**Scenario 3: PowerShell Attack Detection**\nAnalyze PowerShell Operational log for Script Block Logging (Event 4104), search for encoded commands in Event 4688 (process creation with command line), detect AMSI bypass attempts, identify download cradles and invocation of known attack tools.\n\n**Scenario 4: Ransomware Incident Reconstruction**\nBuild timeline starting from initial access (4624 from external IP), trace privilege escalation through group membership changes, identify service installations for persistence, find process creation events for encryption executable, detect volume shadow copy deletion in System log.\n\n## Output Format\n\n```\nWindows Event Log Analysis Summary:\n  System: DC01.corp.local (Windows Server 2019)\n  Log Files Analyzed: 15 EVTX files\n  Total Events: 2,456,789\n  Analysis Period: 2024-01-10 to 2024-01-20\n\n  Chainsaw Detections:\n    Critical:  12 (Mimikatz usage, PsExec, log clearing)\n    High:      34 (Network NTLM logons, encoded PowerShell)\n    Medium:    89 (Unusual service installations, scheduled tasks)\n    Low:       234 (Informational)\n\n  Hayabusa Timeline:\n    Total Alerts: 369\n    Unique Rules Triggered: 45\n    Top Rules:\n      - Suspicious NTLM Authentication (34 hits)\n      - PowerShell Download Cradle (12 hits)\n      - Service Installation Suspicious Path (8 hits)\n\n  Critical Findings:\n    2024-01-15 14:32 - RDP brute force (234 failed, 1 success from 203.0.113.45)\n    2024-01-15 14:45 - Admin account created (svcbackup) - Event 4720\n    2024-01-16 02:30 - PsExec service installed on DC01 - Event 4697\n    2024-01-18 03:00 - Security log cleared - Event 1102\n\n  Reports:\n    Chainsaw: \u002Fanalysis\u002Fchainsaw_results\u002F\n    Hayabusa: \u002Fanalysis\u002Fhayabusa_timeline.csv\n    Critical Events: \u002Fanalysis\u002Fcritical_events.json\n```\n",{"name":5,"tags":44,"author":45,"domain":38,"license":15,"version":46,"subdomain":47,"description":7},[25,30,31,32,33,29,26],"mahipal","1.0","digital-forensics","main","4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c","ai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fextracting-windows-event-logs-artifacts",1,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai","https:\u002F\u002Fgithub.com\u002Fluokai0","a solo builder.","2026-05-06 04:29:04",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill extracting-windows-event-logs-artifacts",{"tool":62,"command":63},"bunx","bunx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill extracting-windows-event-logs-artifacts",{"tool":65,"command":66},"pnpm","pnpm dlx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill extracting-windows-event-logs-artifacts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fextracting-windows-event-logs-artifacts\u002FSKILL.md",true,[70,75,81],{"path":71,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fextracting-windows-event-logs-artifacts\u002FLICENSE",{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"references\u002Fapi-reference.md","REFERENCE","参考文档",2817,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fextracting-windows-event-logs-artifacts\u002Freferences\u002Fapi-reference.md",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"scripts\u002Fagent.py","SCRIPT","脚本",11178,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fextracting-windows-event-logs-artifacts\u002Fscripts\u002Fagent.py",[88,116,133,163,196,233],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":39},"01M6F2SKTE208174C7S7JJCZC7","write-contracts","Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.","MIT","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fwrite-contracts\u002FSKILL.md",[],[96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115],"write","contracts","write contracts","storage","secure","create","generate","collection","model","decision","ask","smart-contracts","selection","objects","structure","nft","token","aptos","critical","move",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":39},"01M6F2RFXJ6T9MKW0A7N7GM45B","web-search","通用网络搜索技能，支持多引擎搜索（百度、必应、DuckDuckGo），无需API密钥即可获取实时信息","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fweb-search-ex-skill\u002FSKILL.md",[],[123,124,125,126,127,128,129,130,131,132],"web","search","web search","搜索","baidu","bing","duckduckgo","百度","多引擎","internet",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":144,"publishedAt":39},"01M6F2K968G1FZEZFPW2E6B222","solo-build","Execute implementation plan tasks with TDD workflow, auto-commit, and phase gates. Use when user says \"build it\", \"start building\", \"execute plan\", \"implement tasks\", \"ship it\", or references a track ID. Do NOT use for planning (use \u002Fplan) or scaffolding (use \u002Fscaffold).","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fsolo-build\u002FSKILL.md",[139],{"categoryNo":140,"categoryName":141,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[145,146,147,148,149,150,151,152,124,153,154,155,96,156,157,158,159,160,161,162],"build","solo","solo build","MCP","workflow","commit","tasks","code","Bash","plan","read","auto","references","context7","query","scaffolding","ship it","project",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":175,"publishedAt":39},"01M6F2GKN39SGHSPWYB3662YC8","react-email","Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Freact-email-skills\u002FSKILL.md",[169,172],{"categoryNo":170,"categoryName":171,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":173,"categoryName":174,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000009","前端开发",[176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195],"react","email","react email","github","editor","components","react components","component","welcome","https","notifications","password","node","use","html","resend","visual","emails","rendering","with",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":214,"publishedAt":39},"01M6F2FBVGVDFSG8SSFJGXA40C","APITester Agent-Driven API Testing","Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fopenclaw-api-tester\u002FSKILL.md",[202,205,208,209],{"categoryNo":203,"categoryName":204,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":206,"categoryName":207,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":140,"categoryName":141,"taxonomyType":142,"taxonomyTypeDesc":143},{"categoryNo":210,"categoryName":211,"taxonomyType":212,"taxonomyTypeDesc":213},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232],"testing","api","api testing","driven","APITester Agent Driven API Testing","test","run","postman","results","plain english","tester","endpoints","document","get","define","tests","english","api-tester",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":239,"publishedAt":39},"01M6F273Y3NGAPVJZ608BC0G9G","hubspot-implementation-plan","Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running \u002Fhubspot-audit.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fhubspot-implementation-plan\u002FSKILL.md",[],[154,240,241,242,243,244,245,102,246,247,248,249,250,189,251,252,195,253],"implementation","hubspot","hubspot implementation plan","automation","feasibility","cleanup","planning","report","audit","audit report","phased implementation","dependencies","processes","hubspot audit"]