# EVTX

location:&#x20;

```powershell
# NT / XP / 2000 / 2003
C:\Windows\System32\winevts\logs\*.evtx
# Vista / Win7 / Win8 / Win10 / Win11
C:\Windows\System32\winevt\Logs\*.evtx

# OR* custom set within:
HKLM\SYSTEM\CurrentControlSet\Services\EventLog
```

3 options when max size is reached:&#x20;

* overwrite (default)&#x20;
* Archive
* do not overwrite - error message appears

### Powershell EVTX filtering:

```powershell
Get-WinEvent -FilterHashtable @{Logname="Security";id=4624}
Get-WinEvent -FilterHashtable @{Logname="Security";id=5140} | where {$_.Message -match "\\Admin\$"}
```

<table><thead><tr><th width="187">Log</th><th width="95">EventID</th><th>Info</th></tr></thead><tbody><tr><td>System</td><td>7034</td><td>Service crashed unexpectedly</td></tr><tr><td></td><td>7035</td><td>Service sent a start/stop control</td></tr><tr><td></td><td>7036</td><td>service started or stopped</td></tr><tr><td></td><td>7040</td><td>start type changed (boot | On Request | Disabled) </td></tr><tr><td></td><td>7045</td><td>Service was installed on the system</td></tr><tr><td></td><td>7045</td><td>A new service was installed on the system (look for PSEXESVC)</td></tr><tr><td>Defender</td><td>1116</td><td>Detected Event</td></tr><tr><td></td><td>1117</td><td>Quarantined Event</td></tr><tr><td></td><td></td><td></td></tr><tr><td>TaskScheduler</td><td>106</td><td>Task creation</td></tr><tr><td></td><td>140</td><td>Task update</td></tr><tr><td></td><td>141</td><td>Task Deleted</td></tr><tr><td></td><td>200</td><td>Task Executed</td></tr><tr><td>Sysmon</td><td></td><td></td></tr></tbody></table>

[https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/)

sc.exe leaves nothing in EVTX

#### Parse:&#x20;

[Event Log Explorer](https://eventlogxp.com/)

[Zicrolite](https://github.com/wagga40/Zircolite)

apt-hunter

chainsaw

Eric Zimmerman:&#x20;

```powershell
evtxecmd -f "e:\c\Windows\system32\winevt\logs\Security.evtx" --csv g:\Labs\event-logs --csvf security.csv
evtxecmd -f "e:\C\Windows\System32\winevt\logs\Microsoft-Windows-TaskScheduler%4Operational.evtx" --csv G:\Labs\event-logs --csvf taskscheduler.csv
```

Recover deleted evtx file - tool built by Willi Ballenthin [EvtExtract](https://github.com/williballenthin/EVTXtract)
