Skip to content

SKILL.md

Latest commit

 

History

History
143 lines (109 loc) · 5.67 KB

SKILL.md

File metadata and controls

143 lines (109 loc) · 5.67 KB
name evtxecmd
version 1.0.0
description Parse and extract Windows Event Log (.evtx) files using Eric Zimmerman's EvtxECmd. Covers CLI flags, output formats (CSV/JSON/XML), event filtering, Volume Shadow Copy support, and the map system.
metadata
tool-name tool-vendor
EvtxECmd
Eric Zimmerman

EvtxECmd Skill

EvtxECmd is a Eric Zimmerman's tool that uses maps to extract and normalize many event types into structured output suitable for timeline analysis and forensic investigation. Forensic interpretation of event logs (Event ID meanings, investigation workflows, lateral movement analysis, etc.) belongs in a separate analysis skill.

Command Syntax

EvtxECmd.exe -f <file> [--csv <dir> | --json <dir> | --xml <dir>] [other options]
EvtxECmd.exe -d <directory> ...

Single-letter options use a single dash (-). Multi-character options use double dashes (--).

Input (one required)

Flag Description
-f Single .evtx file to process
-d Directory containing .evtx files to process

Output Formats

Flag Description
--csv Directory to write CSV output
--csvf Custom filename for CSV output (overrides default)
--json Directory to write JSON output
--jsonf Custom filename for JSON output (overrides default)
--xml Directory to write XML output
--xmlf Custom filename for XML output (overrides default)

It's recommended to specify at least one output format to write results to a file. Forensic output can be very large and may consume the context window. CSV is the most common choice for analysis with Timeline Explorer or Excel.

Filtering

Use UTC consistently when filtering and correlating logs; do not mix local-time assumptions with UTC filter values.

Flag Description
--inc Include only these Event IDs (comma-separated)
--exc Exclude these Event IDs (comma-separated)
--sd Start date (UTC) -- drop events older than this
--ed End date (UTC) -- drop events newer than this

Options

Flag Description Default
--dt Custom date/time format string yyyy-MM-dd HH:mm:ss.fffffff
--maps Path to event map files Maps folder next to the executable
--vss Process Volume Shadow Copies on the drive FALSE
--dedupe Deduplicate across -f/-d and VSCs by SHA-1 TRUE
--sync Download latest maps from GitHub before processing FALSE
--fj Include full JSON payload in output FALSE
--tdt Time discrepancy threshold in seconds 1
--met Show processing metrics TRUE
--debug Show debug information FALSE
--trace Show trace information FALSE

Common Output Fields (CSV)

When EvtxECmd processes logs through its maps, it normalizes data into columns. A map can fail to match or only partially extract fields. Map updates can change output column population across runs, affecting reproducibility. Common output columns often include the following, though exact columns depend on tool version and map matches.

Column Description
TimeCreated UTC timestamp of the event
EventId Windows Event ID
Level Event severity (Information, Warning, Error, Critical)
Provider Event log provider name
Channel Log channel (Security, System, Application, etc.)
Computer Hostname that generated the event
UserId SID of the user associated with the event
MapDescription Human-readable description from the matching map
UserName Resolved username (when mapped)
RemoteHost Source IP/hostname (when mapped)
PayloadData1-6 Mapped event-specific data fields
ExecutableInfo Process or executable details (when mapped)
EventRecordId Record ID within the log
RecordNumber Sequential record number
ProcessId PID of the logging process
ThreadId Thread ID of the logging process
Keywords Event keyword flags
SourceFile Path to the source .evtx file
ChunkNumber Internal chunk number
ExtraDataOffset Offset for extra data
HiddenRecord Whether the record was hidden
Timestamp Additional timestamp field
Payload Raw XML payload of the event

Maps

Maps are the core feature that makes EvtxECmd powerful. They define how raw event XML data is extracted and placed into the normalized output columns. Maps are stored as YAML files in the Maps directory. Updating maps during an investigation can change field extraction and output consistency.

  • --sync downloads the latest community maps from GitHub. Requires network access.
  • Custom maps can be added to the Maps directory for proprietary or uncommon event sources.
  • If an event has no matching map, the raw XML payload is still included in the output.

Workflow Examples

Parse a single log to CSV

EvtxECmd.exe -f "C:\Cases\Evidence\Security.evtx" --csv "C:\Cases\Output" --csvf Security_parsed.csv

Parse a directory of logs

EvtxECmd.exe -d "C:\Cases\Evidence\Logs" --csv "C:\Cases\Output"

Parse from a mounted forensic image with VSS

EvtxECmd.exe -d "E:\Windows\System32\winevt\Logs" --csv "C:\Cases\Output" --vss

Filter by Event ID

EvtxECmd.exe -d "C:\Cases\Evidence\Logs" --csv "C:\Cases\Output" --inc 4624,4625

Filter by date range

EvtxECmd.exe -d "C:\Cases\Evidence\Logs" --csv "C:\Cases\Output" --sd "2025-03-01 00:00:00" --ed "2025-03-07 23:59:59"

Export to JSON with full payload

EvtxECmd.exe -f "C:\Cases\Evidence\System.evtx" --json "C:\Cases\Output" --fj