Records events that occur on a Windows operating system.
It's critical source of information for
Investigating security incidents,
Identifying malicious/susp activities
Understanding system events
Logs doesn’t lie! But it can be clear/delete by the Threat actor...
Event logs is located at C:\Windows\System32\winevt\Logs
Save time
Read and investigate the event logs from A-Z is time consuming for CTF. So, we use automate scanner such as Hayabusa to scan the event logs and parse the result.
Hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
