extracting-windows-event-logs-artifacts

name	extracting-windows-event-logs-artifacts
description	Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation. Use when working with extracting windows event logs artifacts.
domain	cybersecurity
tags	["forensics","windows-event-logs","evtx","chainsaw","hayabusa","sigma-rules","incident-response"]
subdomain	digital-forensics
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Extracting Windows Event Logs Artifacts

Overview

Cybersecurity skill for extracting windows event logs artifacts. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "extracting windows event logs artifacts"

• "Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, "

• When investigating security incidents on Windows systems through event log analysis

• For detecting lateral movement, privilege escalation, and persistence mechanisms

• When performing threat hunting across Windows event log data

• During compliance audits requiring review of authentication and access events

• When building forensic timelines from Windows system activity

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Windows Event Log files (EVTX format) from forensic image or live system
• Chainsaw, Hayabusa, or EvtxECmd for parsing and detection
• Sigma rules for automated threat detection
• Understanding of critical Windows Event IDs
• Python with python-evtx or evtx library for custom parsing
• PowerShell for live system analysis (if applicable)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}