evtxecmd

name	evtxecmd
version	1.0.0
description	Parse and extract Windows Event Log (.evtx) files using Eric Zimmerman's EvtxECmd. Covers CLI flags, output formats (CSV/JSON/XML), event filtering, Volume Shadow Copy support, and the map system.
metadata	{"tool-name":"EvtxECmd","tool-vendor":"Eric Zimmerman"}

EvtxECmd Skill

EvtxECmd is a Eric Zimmerman's tool that uses maps to extract and normalize many event types into structured output suitable for timeline analysis and forensic investigation. Forensic interpretation of event logs (Event ID meanings, investigation workflows, lateral movement analysis, etc.) belongs in a separate analysis skill.

Command Syntax

EvtxECmd.exe -f <file> [--csv <dir> | --json <dir> | --xml <dir>] [other options]
EvtxECmd.exe -d <directory> ...

Single-letter options use a single dash (-). Multi-character options use double dashes (--).

Input (one required)

Flag	Description
-f	Single .evtx file to process
-d	Directory containing .evtx files to process

Output Formats

Flag	Description
--csv	Directory to write CSV output
--csvf	Custom filename for CSV output (overrides default)
--json	Directory to write JSON output
--jsonf	Custom filename for JSON output (overrides default)
--xml	Directory to write XML output
--xmlf	Custom filename for XML output (overrides default)

It's recommended to specify at least one output format to write results to a file. Forensic output can be very large and may consume the context window. CSV is the most common choice for analysis with Timeline Explorer or Excel.

Filtering

Use UTC consistently when filtering and correlating logs; do not mix local-time assumptions with UTC filter values.

Flag	Description
--inc	Include only these Event IDs (comma-separated)
--exc	Exclude these Event IDs (comma-separated)
--sd	Start date (UTC) -- drop events older than this
--ed	End date (UTC) -- drop events newer than this

Options

Flag	Description	Default
--dt	Custom date/time format string	yyyy-MM-dd HH:mm:ss.fffffff
--maps	Path to event map files	Maps folder next to the executable
--vss	Process Volume Shadow Copies on the drive	FALSE
--dedupe	Deduplicate across -f/-d and VSCs by SHA-1	TRUE
--sync	Download latest maps from GitHub before processing	FALSE
--fj	Include full JSON payload in output	FALSE
--tdt	Time discrepancy threshold in seconds	1
--met	Show processing metrics	TRUE
--debug	Show debug information	FALSE
--trace	Show trace information	FALSE

Common Output Fields (CSV)

When EvtxECmd processes logs through its maps, it normalizes data into columns. A map can fail to match or only partially extract fields. Map updates can change output column population across runs, affecting reproducibility. Common output columns often include the following, though exact columns depend on tool version and map matches.

Column	Description
TimeCreated	UTC timestamp of the event
EventId	Windows Event ID
Level	Event severity (Information, Warning, Error, Critical)
Provider	Event log provider name
Channel	Log channel (Security, System, Application, etc.)
Computer	Hostname that generated the event
UserId	SID of the user associated with the event
MapDescription	Human-readable description from the matching map
UserName	Resolved username (when mapped)
RemoteHost	Source IP/hostname (when mapped)
PayloadData1-6	Mapped event-specific data fields
ExecutableInfo	Process or executable details (when mapped)
EventRecordId	Record ID within the log
RecordNumber	Sequential record number
ProcessId	PID of the logging process
ThreadId	Thread ID of the logging process
Keywords	Event keyword flags
SourceFile	Path to the source .evtx file
ChunkNumber	Internal chunk number
ExtraDataOffset	Offset for extra data
HiddenRecord	Whether the record was hidden
Timestamp	Additional timestamp field
Payload	Raw XML payload of the event

Maps

Maps are the core feature that makes EvtxECmd powerful. They define how raw event XML data is extracted and placed into the normalized output columns. Maps are stored as YAML files in the Maps directory. Updating maps during an investigation can change field extraction and output consistency.

• --sync downloads the latest community maps from GitHub. Requires network access.
• Custom maps can be added to the Maps directory for proprietary or uncommon event sources.
• If an event has no matching map, the raw XML payload is still included in the output.

Workflow Examples

Parse a single log to CSV

EvtxECmd.exe -f "C:\Cases\Evidence\Security.evtx" --csv "C:\Cases\Output" --csvf Security_parsed.csv

Parse a directory of logs

EvtxECmd.exe -d "C:\Cases\Evidence\Logs" --csv "C:\Cases\Output"

Parse from a mounted forensic image with VSS

EvtxECmd.exe -d "E:\Windows\System32\winevt\Logs" --csv "C:\Cases\Output" --vss

Filter by Event ID

EvtxECmd.exe -d "C:\Cases\Evidence\Logs" --csv "C:\Cases\Output" --inc 4624,4625

Filter by date range

EvtxECmd.exe -d "C:\Cases\Evidence\Logs" --csv "C:\Cases\Output" --sd "2025-03-01 00:00:00" --ed "2025-03-07 23:59:59"

Export to JSON with full payload

EvtxECmd.exe -f "C:\Cases\Evidence\System.evtx" --json "C:\Cases\Output" --fj