Comments (6)
sbousseaden
commented on May 20, 2024
don't think the log is corrupted (see below XML view of the same event file), it was recored on a Windows 7 VM, those issues are often related to EventMessageFile DLL version used to format event message.
from evtx-attack-samples.
EdwardsCP
commented on May 20, 2024
It's strange, because I see the same on the XML view in EventViewer, but
the general view shows the mis-alignment the same as powershell's
get-winevent cmd-let.
[image: image.png]
…On Thu, Aug 13, 2020 at 5:00 AM sbousseaden ***@***.***> wrote:
don't think the log is corrupted (see below XML view of the same event
file), it was recored on a Windows 7 VM, those issues are often related to
EventMessageFile
<https://docs.microsoft.com/en-us/troubleshoot/windows/win32/troubleshoot-event-message-not-found>
DLL version used to format event message.
[image: image]
<https://user-images.githubusercontent.com/20989958/90115030-d394f480-dd53-11ea-8484-ab0a2c3c3214.png>
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#9 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AE7XCISIZZ6K6V2OCZPXUNDSAOTT7ANCNFSM4P5HBONA>
.
from evtx-attack-samples.
EdwardsCP
commented on May 20, 2024
Even opening it on a Win7 system, I'm getting the same
from evtx-attack-samples.
EdwardsCP
commented on May 20, 2024
I think this may be because the logs were collected with an older version of sysmon. Version 10 (which I'm using) added OriginalFilename as the 10th element in the list, and that seems to be where the misalignment starts. In the screenshot above, "c:\Windows\System32\calc.exe" should be CommandLine, and everything else after that shifted down one.
from evtx-attack-samples.
sbousseaden
commented on May 20, 2024
yes probably that's the reason (sysmon vers) tough not sure 100% :)
from evtx-attack-samples.
EdwardsCP
commented on May 20, 2024
Seems that's what it is. Closing out the issue.
from evtx-attack-samples.
Related Issues (11)
- Missing Event ID's 9, 14, 16, and 255 HOT 2
- evasion_execution_imageload_wuauclt_lolbas.evtx HOT 2
- SpooFool(CVE-2022-21999 win-LPE)
- invalid signature
- The tools generated these EVTX files
- Help loading evtx into winlogbeat
- Access to benign logs HOT 2
- [Question] Any advice regarding how to contribute? HOT 1
- License Information HOT 2
- Pentesting cheatsheets HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from evtx-attack-samples.