evtx
¶
$ target-query <path/to/target> -f evtx
Module |
|
Output |
|
Module documentation
Plugin for fetching and parsing Windows Eventlog Files (*.evtx)
Function documentation
Return entries from Windows Event log files (*.evtx).
Windows Event log is a detailed record of system, security and application notifications. It can be used to diagnose a system or find future issues. Up until Windows XP the extension .evt was used, hereafter .evtx became the new standard.
- References:
Yields dynamically created records based on the fields in the event. At least contains the following fields:
hostname (string): The target hostname. domain (string): The target domain. ts (datetime): The TimeCreated_SystemTime field of the event. Provider_Name (string): The Provider_Name field of the event. EventID (int): The EventID of the event.