CTF Write-up: Event Logs
to convert the evtx content to another formats like json or xml .. .ect
EVTX is:#
Windows Event Logs - Like Linux logs (/var/log/) but for Windows.
Examples of what's inside:#
Who logged in (logins) What programs ran (processes) What files were accessed (file access) System errors (errors) Security alerts (warnings)
to convert the evtx content to another formats like json or xml .. .ect
Best Tools for EVTX Analysis:#
- EVTXtract (Python - Best for CTF)
bash
## Install
pip3 install evtxtract
or
sudo apt install python3-evtx
or
wget https://github.com/omerbenamram/evtx.git
## Convert to XML/JSON
evtxtract Windows_Logs.evtx -o output.xml
## Or just dump readable text
python3 -m evtxtract.cli Windows_Logs.evtx --format text > events.txt-
Chainsaw (Professional - Awesome!)
-
EVTXdump (Simple Python)
bash
## Already mentioned, but here's full usage:
python3 -m evtx.evtx_dump Windows_Logs.evtx --output json > events.json
## Or XML
python3 -m evtx.evtx_dump Windows_Logs.evtx --output xml > events.xmlthis is all the tools
text
evtx_dump.py
evtx_eid_record_numbers.py
evtx_filter_records.py
evtx_record_structure.py
evtx_templates.py
evtx_dump_chunk_slack.py
evtx_extract_record.py
evtx_info.py
evtx_structure.py flag{Ev3nt_vi3wv3r_1s_a_pr3tty_us3ful_bro}