[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71H747HCS2407TP84BZDS89":3,"skill-same:01M71H747HCS2407TP84BZDS89":56},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":24,"linkOnly":25,"markdownContent":26,"markdownBody":27,"frontMatter":28,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":14,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M71H747HCS2407TP84BZDS89","windows-logging-eventlog-artifact",null,"Windows Logging Eventlog Artifact.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows-logging-eventlog-artifact\u002FSKILL.md",[],[19,20,21,22,23],"windows","logging","artifact","windows logging eventlog artifact","cybersecurity","2026-11-10 10:12:30",false,"---\nname: windows-logging-eventlog-artifact\ndescription: \"Windows Logging Eventlog Artifact.\"\ndomain: cybersecurity\n---\n\n|\n| Chainsaw | Sigma-based EVTX analysis and threat hunting tool |\n| Hayabusa | Fast Windows Event Log forensic timeline generator |\n| EvtxECmd | Eric Zimmerman command-line EVTX parser with CSV\u002FJSON output |\n| python-evtx | Python library for EVTX file parsing |\n| LogParser | Microsoft SQL-like query engine for Windows logs |\n| Event Log Explorer | GUI tool for browsing and analyzing EVTX files |\n| KAPE | Automated triage collection including event logs |\n| Velociraptor | Endpoint agent with EVTX collection and hunting artifacts |\n\n## Common Scenarios\n\n**Scenario 1: Detecting Lateral Movement**\nFilter for Event 4624 with Logon Type 3 (network) and Type 10 (RDP), identify unusual source-destination pairs, check for Event 4648 (explicit credentials) indicating pass-the-hash, correlate with process creation events (4688) on target systems.\n\n**Scenario 2: Privilege Escalation Detection**\nSearch for Event 4672 (special privileges assigned) for unexpected users, check for Event 4728\u002F4732 (group membership changes) adding users to admin groups, look for Event 4697 (service installed) indicating new system-level access, correlate with 4720 (account creation).\n\n**Scenario 3: PowerShell Attack Detection**\nAnalyze PowerShell Operational log for Script Block Logging (Event 4104), search for encoded commands in Event 4688 (process creation with command line), detect AMSI bypass attempts, identify download cradles and invocation of known attack tools.\n\n**Scenario 4: Ransomware Incident Reconstruction**\nBuild timeline starting from initial access (4624 from external IP), trace privilege escalation through group membership changes, identify service installations for persistence, find process creation events for encryption executable, detect volume shadow copy deletion in System log.\n\n## Output Format\n\n```\nWindows Event Log Analysis Summary:\n  System: DC01.corp.local (Windows Server 2019)\n  Log Files Analyzed: 15 EVTX files\n  Total Events: 2,456,789\n  Analysis Period: 2024-01-10 to 2024-01-20\n\n  Chainsaw Detections:\n    Critical:  12 (Mimikatz usage, PsExec, log clearing)\n    High:      34 (Network NTLM logons, encoded PowerShell)\n    Medium:    89 (Unusual service installations, scheduled tasks)\n    Low:       234 (Informational)\n\n  Hayabusa Timeline:\n    Total Alerts: 369\n    Unique Rules Triggered: 45\n    Top Rules:\n      - Suspicious NTLM Authentication (34 hits)\n      - PowerShell Download Cradle (12 hits)\n      - Service Installation Suspicious Path (8 hits)\n\n  Critical Findings:\n    2024-01-15 14:32 - RDP brute force (234 failed, 1 success from 203.0.113.45)\n    2024-01-15 14:45 - Admin account created (svcbackup) - Event 4720\n    2024-01-16 02:30 - PsExec service installed on DC01 - Event 4697\n    2024-01-18 03:00 - Security log cleared - Event 1102\n\n  Reports:\n    Chainsaw: \u002Fanalysis\u002Fchainsaw_results\u002F\n    Hayabusa: \u002Fanalysis\u002Fhayabusa_timeline.csv\n    Critical Events: \u002Fanalysis\u002Fcritical_events.json\n```\n","|\n| Chainsaw | Sigma-based EVTX analysis and threat hunting tool |\n| Hayabusa | Fast Windows Event Log forensic timeline generator |\n| EvtxECmd | Eric Zimmerman command-line EVTX parser with CSV\u002FJSON output |\n| python-evtx | Python library for EVTX file parsing |\n| LogParser | Microsoft SQL-like query engine for Windows logs |\n| Event Log Explorer | GUI tool for browsing and analyzing EVTX files |\n| KAPE | Automated triage collection including event logs |\n| Velociraptor | Endpoint agent with EVTX collection and hunting artifacts |\n\n## Common Scenarios\n\n**Scenario 1: Detecting Lateral Movement**\nFilter for Event 4624 with Logon Type 3 (network) and Type 10 (RDP), identify unusual source-destination pairs, check for Event 4648 (explicit credentials) indicating pass-the-hash, correlate with process creation events (4688) on target systems.\n\n**Scenario 2: Privilege Escalation Detection**\nSearch for Event 4672 (special privileges assigned) for unexpected users, check for Event 4728\u002F4732 (group membership changes) adding users to admin groups, look for Event 4697 (service installed) indicating new system-level access, correlate with 4720 (account creation).\n\n**Scenario 3: PowerShell Attack Detection**\nAnalyze PowerShell Operational log for Script Block Logging (Event 4104), search for encoded commands in Event 4688 (process creation with command line), detect AMSI bypass attempts, identify download cradles and invocation of known attack tools.\n\n**Scenario 4: Ransomware Incident Reconstruction**\nBuild timeline starting from initial access (4624 from external IP), trace privilege escalation through group membership changes, identify service installations for persistence, find process creation events for encryption executable, detect volume shadow copy deletion in System log.\n\n## Output Format\n\n```\nWindows Event Log Analysis Summary:\n  System: DC01.corp.local (Windows Server 2019)\n  Log Files Analyzed: 15 EVTX files\n  Total Events: 2,456,789\n  Analysis Period: 2024-01-10 to 2024-01-20\n\n  Chainsaw Detections:\n    Critical:  12 (Mimikatz usage, PsExec, log clearing)\n    High:      34 (Network NTLM logons, encoded PowerShell)\n    Medium:    89 (Unusual service installations, scheduled tasks)\n    Low:       234 (Informational)\n\n  Hayabusa Timeline:\n    Total Alerts: 369\n    Unique Rules Triggered: 45\n    Top Rules:\n      - Suspicious NTLM Authentication (34 hits)\n      - PowerShell Download Cradle (12 hits)\n      - Service Installation Suspicious Path (8 hits)\n\n  Critical Findings:\n    2024-01-15 14:32 - RDP brute force (234 failed, 1 success from 203.0.113.45)\n    2024-01-15 14:45 - Admin account created (svcbackup) - Event 4720\n    2024-01-16 02:30 - PsExec service installed on DC01 - Event 4697\n    2024-01-18 03:00 - Security log cleared - Event 1102\n\n  Reports:\n    Chainsaw: \u002Fanalysis\u002Fchainsaw_results\u002F\n    Hayabusa: \u002Fanalysis\u002Fhayabusa_timeline.csv\n    Critical Events: \u002Fanalysis\u002Fcritical_events.json\n```\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fwindows-logging-eventlog-artifact","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill windows-logging-eventlog-artifact",{"tool":42,"command":43},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill windows-logging-eventlog-artifact",{"tool":45,"command":46},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill windows-logging-eventlog-artifact","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows-logging-eventlog-artifact\u002FSKILL.md",true,[50],{"path":51,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":54,"sourceHtmlUrl":55},"index.json","REFERENCE","参考文档",532,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows-logging-eventlog-artifact\u002Findex.json",[57,82,105,126,147,163],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":24},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,23,81],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":24},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[89,64,90,67,91,92,93,23,94,95,96,97,98,99,69,100,101,102,103,104],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":24},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[21,112,113,114,115,116,23,94,117,95,118,119,69,102,120,121,122,123,124,125],"registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":24},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[65,133,134,135,136,19,137,70,138,23,81,139,140,141,142,143,144,145,146,69],"processes token impersonate detect","token","processes","attacks","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":153,"publishedAt":24},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[154,155,65,156,135,19,157,70,158,138,23,81,95,159,160,161,162,146,69,71],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":24},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[170,65,135,171,157,70,172,173,23,81,174,175,176,177,178,179,69,71,180,181],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]