Skip to content

Collection of Custom Views for the Microsoft Windows Event Viewer

Notifications You must be signed in to change notification settings

tomstryhn/EventViewerCustomViews

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 
 
 

Repository files navigation

Event Viewer Custom Views

Custom Views for Microsoft Windows Event Viewer

Table of Content

Background

I often find myself using the Microsoft Event Viewer when gathering information related to hardening tasks in Windows Environments, troubleshooting or gathering data when doing forensic work. There's many ressources online for ie. XML filters when filtering in the EventLogs, these are often used together with the Custom Views in the Event Viewer. So I started gathering these filters, and created these templates, so I quickly can download the XML-file and use the builtin Import Custom View... feature inside the Microsoft Event Viewer.

How to Use

Find the Custom View in the list, download it to the computer, or copy the content to Notepad and save the file as an .xml, then open Event Viewer, right click on the Custom Views in the top left pane, and select Import Custom View...

Can also be used with the EventFromCustomView PowerShell Module

Custom Views

Account Authentication

  • Successful and Failed Account Authentication

Administrator Logon (Failed)

  • Failed Administrator Account Logons

Administrator Logon (Successful)

  • Successful Administrator Account Logons

Legacy Kerberos Ticket Encryption Types

  • Legacy Kerberos Ticket Encryption Types: DES-CBC-CRC, DES-CBC-MD5, RC4-HMAC, RC4-HMAC-EXP

Logon (Failed)

Logon (Successful)

NTLMv1 Authentications

  • NTLMv1 (Windows New Technology LAN Manager) Authentications

Security Group Membership

  • Member added to Security Group (Local Group)

Security Group Membership

  • Member added to Security Group (Universal Group)

Security Group Membership

  • Member added to Security Group (Global Group)

Service Creation

Service Creation Error

User Creation