skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

extracting-windows-event-logs-artifacts

Extract and analyze Windows Event Logs using Chainsaw, Hayabusa, and python-evtx to detect attacks.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#chainsaw#digital forensics#sigma rules#hayabusa#evtx#windows event logs
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill extracting-windows-event-logs-artifacts
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: extracting-windows-event-logs-artifacts
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/digital-forensics/extracting-windows-event-logs-artifacts
Command: npx skills add https://github.com/xalgord/xalgorix --skill extracting-windows-event-logs-artifacts

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python-evtx.

What problem does it solve?

Investigating Windows security incidents requires parsing large volumes of binary EVTX event logs and identifying attacker behavior such as lateral movement, privilege escalation, and log tampering, which is slow and error-prone when done manually.

Core Features & Use Cases

  • Sigma-Based Detection: Run Chainsaw and Hayabusa against collected EVTX files to generate detection results and forensic timelines from Sigma rules.
  • Critical Event ID Parsing: Use python-evtx to extract and summarize key Security log events such as 4624 logons, 4688 process creation, 4697 service installs, and 1102 log clearing.
  • Attack Pattern Detection: Identify Pass-the-Hash, NTLM lateral movement, log clearing, and anti-forensic gaps in EventRecordID sequences.
  • Use Case: During a ransomware investigation, mount a forensic image, collect the EVTX files, run Hayabusa to build a timeline, and correlate RDP brute-force attempts with service installations and log clearing events.

Quick Start

Analyze the Windows Event Logs in my case directory with Chainsaw and Hayabusa and summarize any signs of lateral movement or log clearing.

Frequently Asked Questions about extracting-windows-event-logs-artifacts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze Windows Event Logs for a security incident?▼

Collect the EVTX files from the forensic image or live system, then run Chainsaw with Sigma rules for detection and Hayabusa to generate a CSV or JSON timeline. Follow up by parsing critical Event IDs like 4624, 4688, and 1102 with python-evtx.

Chainsaw vs Hayabusa for EVTX analysis, which should I use?▼

Chainsaw hunts EVTX files using Sigma rules and supports keyword and Event ID searches with text, CSV, or JSON output. Hayabusa focuses on fast timeline generation, detection metrics, and logon summaries, so the two are commonly run together.

Which Windows Event IDs indicate lateral movement?▼

Event 4624 with Logon Type 3 or 10 indicates network or RDP logons, while Event 4648 shows explicit credential use associated with Pass-the-Hash. Correlating these with 4688 process creation on target systems strengthens the detection.

Why are expected events missing from my EVTX analysis?▼

Missing events usually mean the activity was never audited, since command-line logging in 4688 and object access events are off by default. Logs also wrap by size, may have been cleared, and Sysmon events only exist if Sysmon was deployed.

How do I detect if an attacker cleared the Windows event logs?▼

Look for Security Event ID 1102 and System Event ID 104, which record log clearing. Sophisticated attackers may stop the EventLog service instead, so also scan for gaps in the EventRecordID sequence and check forwarded logs on a SIEM.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

performing-endpoint-forensics-investigation

Identify and document endpoint compromises through Windows digital forensics investigations.

Community
Advanced
Yamato-SecurityYamato-Security
26

investigate_jp

Analyze Hayabusa CSV logs to generate Japanese intrusion timelines and incident reports.

Official
Advanced
rjonhaasrjonhaas
1

Windows Artifacts (EZ Tools / Autoruns / Event Logs)

Parse Windows forensic artifacts into CSV outputs for DFIR triage.

Community
Advanced
refractionPOINTrefractionPOINT
29

velociraptor

Launch Velociraptor forensic collections on endpoints via LimaCharlie API.

Official
Advanced