THM,Windows Event Logs write-up :)

After learning about logs with linux ( syslog , journald ) , widows having their logs controller too.
And actually windows events logs world was amazing jourery to start . Windows Event Logs are not text files that can be viewed using a text editor. The raw data can be translated into XML using the Windows API. The events in these log files are stored in a proprietary binary format with a .evt or .evtx extension. The log files with the .evtx file extension typically reside in C:\Windows\System32\winevt\Logs.

we will start with connecting to the machine you can do that by accessing the attach box or RDP ‘ Remote Desktop Protocol :is a p rotocol created by Microsoft that lets you control another Windows computer remotely’
i’ll RDPing and honestly this my first time with macOS . so firts i downloaded Microsoft Remote Desktop .From apps i added pc , tha name is your machine ip you will get it once you started your machine at tryhackme . double click on credentails and choose add : username and password are given by thm > User name: administrator User password: blueT3aming!.

then just add and from devices you will find it exits , we need to use vpn so we can connect to thm network . follow these steps > Install Tunnelblick ( you can that by terminal or from Stable ) , then download your OpenVPN configuration file (.ovpn) from the Access → VPN Access section in TryHackMe . After downloading the file, double-click it to import it into Tunnelblick and choose “Only Me” when prompted to install the configuration. Next, connect to the VPN by clicking the Tunnelblick icon in the macOS menu bar and selecting Connect, which places your machine inside the TryHackMe lab network. Once connected, open Microsoft Remote Desktop and paste the Machine IP address provided in the room (e.g., 10.10.x.x) into the PC Namefield, then click Connect to access the remote Windows lab environment.

connected with the vpn

let’s started (if you wondering about the ip diff that because i asked for anew one )

There are three main ways of accessing these event logs within a Windows system:

1. Event Viewer (GUI-based application)
2. Wevtutil.exe (command-line tool)
3. Get-WinEvent (PowerShell cmdlet)

Task#2 : Event Viewer

open event viewer using right click and choose it or using cli

we have 3 panes here , the right pane for the providers and the middle pane for overview and the left pane for actions and filteration

scrolling down to find powershell

choosing operational

click on “Date and Time” to rearrange it and scroll either to the bottom or top to look for the earliest date.

2.2 Answer: 4103

start filtering from the action panel choosing filter with current log and change “Filter Current Log” yo event id 4104(for executing a remote command ) to find the 2nd command executed in the PowerShell session

it supposed to be the second earliest command but it shows too many windows scripts and the PowerShell log is full of background scripts executed by Windows diagnostics and modules. The trick is the challenge wants the second command executed in a PowerShell session, not the second 4104 event overall.

2.3 Answer: whoami

you can find the task category from the overview pane

2.4 Answer: execute a remote command

we are going to be changing locations for this question. Head all the way to the bottom to find “Windows PowerShell.” If you don’t see it, the path should be Event Viewer (Local) > Applications and Services Logs > Microsoft > Windows PowerShell

filter it with the action pane as we did before

2.5 Answer: pipeline execution details

Task#3 : Event Viewer

Let’s look at wevtutil.exe first. Per Microsoft, the wevtutil.exe tool “enables you to retrieve information about event logs and publishers. You can also use this command to install and uninstall event manifests, to run queries, and to export, archive, and clear logs.”

i opened the windows powershell from the menu then explored the guide and some help from the documentation

I typed wevtutil el |Measure-Object which will display the number of logs. i want to count them .

3.1 Answer: 1072

we get the information about query-events command

3.2 Answer: event log, log file , structured query

now back to wevtutil eq /? and read the options

3.3 Answer: lf:true

3.3 Answer: xpath query

i copied the command and wevtutil qe Application /c:3 /rd:true /f:text that means “Show the 3 most recent events from the Application log in text format.” . Reading the output, we can see the log name.

3.4 Answer: application

now back to wevtutil eq /? and read the options fot the next 2 questions
3.5 Answer:Event read direction
3.6 Answer:Maximum number of events to read

Task#4 : Get-WinEvent

This is a PowerShell cmdlet called Get-WinEvent. Per Microsoft, the Get-WinEvent cmdlet “gets events from event logs and event tracing log files on local and remote computers.” It provides information on event logs and event log providers. Additionally, you can combine numerous events from multiple sources into a single command and filter using XPath queries, structured XML queries, and hash table queries. Note: The Get-WinEvent cmdlet replaces the Get-EventLog cmdlet.
We will be using the online guide by Microsoft to answer the following questions. ( to say , the examples were a good source for practical )

using the command Get-WinEvent -ListLog * in PowerShell and scroll down to find openssh (later you can filter using a specific words)

4.2 Answer:openssh/admin, openssh/operational

from Example 8 in the online guide, we get Get-WinEvent -ListProvider *Policy* . We do have to change it a little bit to fit our question so our final command is Get-WinEvent -ListProvider *PowerShell* .

4.3 Answer: Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager

The command is (Get-WinEvent -ListProvider Microsoft-Windows-PowerShell).Events | Format-Table Id, Description | Measure-Object where we changed the log provider to “Microsoft-Windows-PowerShell” and we added “Measure-Object” to count the number of entries for us.

4.3 Answer: 192

Reading the online guide, I saw that Example 13 had an interesting parameter. It had -MaxEvents . I read a bit more and it helps display a maximum number of events.

4.4 Answer: -MaxEvents

i found that examples 17,18 used FilterHashtable so i read more about it here to get the levels to find it for informational

4.5 Answer:4

Task#5 : XPath Queries

i read a lot to take idea how i will create and write the queary , and opend the xml tags at event viewer to more feed. here is references for the systemtime and synatx and more.

Get Aya Emad’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Using the knowledge gained on Get-WinEvent and XPath, what is the query to find WLMS events with a System Time of 2020-12-15T01:09:08.940277500Z?
5.1 Answer: Get-WinEvent -LogName Application -FilterXPath ‘*/System/Provider[@Name=”WLMS”] and */System/TimeCreated[@SystemTime=”2020–12–15T01:09:08.940277500Z”]’

Using Get-WinEvent and XPath, what is the query to find a user named Sam with an Logon Event ID of 4720?
5.2 Answer:Get-WinEvent -LogName Security -FilterXPath ‘*/EventData/Data[@Name=”TargetUserName”]=”Sam” and */System/EventID=4720’
5.3 Answer:2
5.4 Answer:A user account was created

Still working with Sam as the user, what time was Event ID 4724 recorded? (MM/DD/YYYY H:MM:SS [AM/PM])
Using the previous code as our reference, we just have to change Event ID from “4720” to “4724.” The result should be Get-WinEvent -LogName Security -FilterXPath ‘*/EventData/Data[@Name=”TargetUserName”]=”Sam” and */System/EventID=4724’

5.5 Answer:12/17/2020 1:57:14 PM

What is the Provider Name?

5.6 Answer:Microsoft-Windows-Security-Auditing

Task#7 : Putting theory into practice

okey this final section of the room puts everything together. We’re working against a single file — merged.evtx — found on the Desktop, and we'll use Get-WinEvent with XPath to hunt through four realistic SOC scenarios covering PowerShell logging, log tampering, Emotet malware, and insider threat activity.All queries follow this base structure:

Get-WinEvent -Path C:\Users\Administrator\Desktop\merged.evtx -FilterXPath '<>'

Scenario 1 — PowerShell Logging Visibility

Management has approved PowerShell in the environment after repeated requests from server admins. Now the security team needs visibility — we need to confirm what logging is in place and what events are generated when PowerShell commands are executed.

What event ID is to do with the creation of new processes?

for this one , just google it
6.1 Answer:400

now let’s find all the logs by this event id ‘400’ using this

Get-WinEvent -Path C:\Users\Administrator\Desktop\merged.evtx -FilterXPath '*[System[EventID=400]]' | Format-List TimeCreated, Message

6.2 Answer:12/18/2020 7:50:33 AM

Scenario 2 (Questions 3 & 4) : The Security Team is using Event Logs more. They want to ensure they can monitor if event logs are cleared. You assigned a colleague to execute this action.

A Log clear event was recorded. What is the ‘Event Record ID’?
For this one we’re hunting Event ID 104 (System log cleared) or 1102 (Security log cleared). so we ran this

Get-WinEvent -Path C:\Users\Administrator\Desktop\merged.evtx -FilterXPath '*[System[EventID=104 or EventID=1102]]' | Format-List *

The Format-List * is important here — it dumps all properties including the RecordId field , you can useSelect-Object *too.

6.3 Answer:27736

What is the name of the computer?
will be the mahine name from the same screenshot
6.4 Answer:PC01.example.corp

Scenario 3 (Questions 5, 6 & 7) : The threat intel team shared its research on Emotet . They advised searching for event ID 4104 and the text “ScriptBlockText” within the EventData element. Find the encoded PowerShell payload.

What is the name of the first variable within the PowerShell command?

when i executed a query before to take a look around and i noticed the wanted command already but we can do it with event viewer too for the easy way

Get-WinEvent -Path C:\Users\Administrator\Desktop\merged.evtx -FilterXPath '*[System[EventID=400]]' | Format-List TimeCreated, Message

when you filter by 4104 and rearrange by time you will find the command , i Highlight the variable

6.5 Answer:$Va5w3n8

What is the Date and Time this attack took place? (MM/DD/YYYY H:MM:SS [AM/PM])

We can get the information under Date and Time column.

6.6 Answer:8/25/2020 10:09:28 PM

What is the Execution Process ID?

you will find it at the details too

6.7 Answer:6620

Scenario 4 (Questions 8 & 9) : A report came in that an intern was suspected of running unusual commands on her machine, such as enumerating members of the Administrators group. A senior analyst suggested searching for “ C:\Windows\System32\net1.exe". Confirm the suspicion.
We actually already saw this in our very first output! Remember the Event ID 4799 entry:
Group: Security ID: S-1–5–32–544 Group Name: Administrators Group Domain: Builtin

Get-WinEvent -Path C:\Users\Administrator\Desktop\merged.evtx -FilterXPath '*[EventData[Data="C:\Windows\System32\net1.exe"]]' | Format-List *

so
6.8 Answer:S-1–5–32–544

What is the event ID?

6.9 Answer:4799
if you are wondering rn why are using 4799 ? i did too so let me answer you
4798 vs 4799 — they’re closely related but different:

Event ID Meaning 4798A user’s local group membership was enumerated — user-centric 4799A security-enabled local group membership was enumerated — group-centric

In this scenario the intern was specifically enumerating the Administrators group — she ran something like:

net localgroup administrators

That action is group-centric (who’s in this group?) which triggers 4799, not 4798.

Think of it this way:

• 4798 = “show me what groups this user belongs to”
• 4799 = “show me what members are in this group”

Since she was enumerating members of the Administrators group, Windows logged it as 4799.

This room was genuinely challenging — especially if Windows isn’t your home turf. But that discomfort is exactly the point. As SOC analysts, we don’t get to choose which systems attackers target.

The real takeaway here isn’t memorizing Event IDs — it’s building the instinct to know where to look and what to ask. Whether you’re using Event Viewer’s GUI to get your bearings or crafting precise XPath queries with Get-WinEvent, both are valid tools in your arsenal. Start with the GUI when you're lost, then tighten it up with PowerShell when you need speed and precision at scale.

XPath feels unnatural at first — the syntax is strict and unforgiving — but once the structure clicks, you can read and write queries with confidence. That moment of clarity is worth the frustration getting there.

The four scenarios in this room reflect real SOC work: hunting PowerShell execution, detecting log tampering, identifying malware indicators, and confirming insider threat activity. These aren’t CTF tricks — they’re Monday morning tasks for a working analyst.

The most helpful reference throughout this room was the official Microsoft documentation — it’s dense but it’s accurate, and learning to navigate it is a skill in itself. No blog post or cheat sheet will ever replace going straight to the source.

And the biggest advantage you can take from this room? Read. Figure it out yourself. Then try, fail, and try again.Nobody gets XPath right on the first attempt. Nobody understands event logs without getting their hands dirty. The analysts who grow fastest aren’t the ones who find answers quickest — they’re the ones who genuinely understand why the answer is what it is.

Keep sharpening your Linux skills too. The best analysts are fluent in both worlds, because threats don’t respect your comfort zone.