2023-02-26 21:45:17 +01:00
|
|
|
# Windows Event Log
|
|
|
|
|
|
|
|
|
|
## Dump Logfile
|
|
|
|
|
|
|
|
|
|
Windows Event Logfiles can be dumped via
|
2023-11-07 19:02:14 +01:00
|
|
|
|
2023-02-26 21:45:17 +01:00
|
|
|
```sh
|
|
|
|
|
evtx_dump $EVENT_LOG > event.log
|
|
|
|
|
evtx_dump -o json $EVENT_LOG > event.log
|
|
|
|
|
```
|
2023-11-07 19:02:14 +01:00
|
|
|
|
|
|
|
|
## Event IDs
|
|
|
|
|
|
|
|
|
|
### Process
|
|
|
|
|
|
|
|
|
|
* **1**: Process Creation
|
|
|
|
|
|
|
|
|
|
### Files
|
|
|
|
|
|
|
|
|
|
* **11**: File opened
|
|
|
|
|
|
|
|
|
|
### Account Management
|
|
|
|
|
|
2023-11-14 20:36:49 +01:00
|
|
|
* **4719**: Attempt to change a policy
|
2023-11-07 19:02:14 +01:00
|
|
|
* **4720**: User account creation
|
|
|
|
|
* **4722**: User account enabled
|
|
|
|
|
* **4723**: Attempt to change an account password. The user attempts to change their password
|
|
|
|
|
* **4724**: Attempt to reset the account password. The user attempts to reset the password of another account
|
|
|
|
|
* **4725**: Account disable
|
|
|
|
|
* **4726**: Account removal
|
2023-11-14 20:36:49 +01:00
|
|
|
* **4728**: Attempt to add an account to a global security group
|
|
|
|
|
* **4729**: Attempt to remove an account from a global security group
|
|
|
|
|
* **4756**: Attempt to add an account to a universal security group
|
|
|
|
|
* **4757**: Attempt to remove an account from a universal security group
|
2023-11-07 19:02:14 +01:00
|
|
|
|
|
|
|
|
### Account Logon
|
|
|
|
|
|
|
|
|
|
* **4624**: Successful logon
|
|
|
|
|
* **4625**: Failed logon
|
|
|
|
|
* **4634** and **4647**: Logoff
|
|
|
|
|
* **4779**: Session disconnect
|
|
|
|
|
|
|
|
|
|
### Scheduled Tasks
|
|
|
|
|
|
|
|
|
|
* **4698**: Scheduled task creation
|
|
|
|
|
* **4702**: Scheduled task updated
|
|
|
|
|
* **4699**: Scheduled task deletion
|
|
|
|
|
|
|
|
|
|
### Security
|
|
|
|
|
|
|
|
|
|
* **1100**: Logging service disabled
|
|
|
|
|
* **1102**: Log deletion
|
|
|
|
|
* **1116**: Malware detection
|
