exfinder

Very rudimentary PoC to search Windows's EVTX files like a SIEM.

Requirements

• evtx
• jq

Usage

First convert the EVTX dump to JSON

./evtx_dump -o json Security.evtx > JsonLog.txt

Pre-process to convert it to pure JSON file

sed -E 's/Record [[:digit:]]+//g' JsonLog.txt > ProcJsonLog.txt

Start quering like a SIEM

./exfinder.sh 'EventID=4688 Command=powershell.exe | project Host, User, Command'

./exfinder.sh 'EventID=4688 Command= -ma lsass'

Supported Event IDs

• 4688

Note

• project has a definite hardcoded order and does not depend upon the order in the query.