Guided lab: read Windows event logs without Windows

You are looking at the distribution, not the contents. Which IDs dominate, and which appear once or twice?

Two things.

What the sensor was. A file full of 4624s and 4688s is the Security log. One full of 1s, 3s, 11s and 13s is Sysmon. Knowing which you have tells you what questions the data can answer, and a great deal of wasted time comes from asking a log for something it never recorded.

Where to look. In a normal capture the common IDs are the background and the rare ones are the event. That is the same frequency argument as the services lab, applied to one file instead of a fleet: you do not need to know what is bad to know what is unusual.

Start with whatever appears once.

For Sysmon Event ID 1, the fields you want are ParentImage and Image:

jq -r 'select(.Event.System.EventID==1)
  | "\(.Event.EventData.ParentImage) -> \(.Event.EventData.Image)"' events.jsonl \
  | sort | uniq -c | sort -rn

The answer depends which sample you took, but the method is the point and it is the same every time. You are looking for a parent that has no business starting that child: an Office application starting a shell, a browser starting cmd.exe, a service account starting an interpreter.

This is exactly the reasoning from the Northwind case, except nobody has laid the evidence out for you. Five events quoted in order is a very different exercise from three thousand in a file, and the second one is the job.

jq -r 'select(.Event.System.EventID==13)
  | .Event.EventData.TargetObject' events.jsonl | sort | uniq -c | sort -rn

Most of the output will be Windows writing to its own keys constantly, which is the noise the Run key lab warned about. Filter to what matters:

... | grep -i 'CurrentVersion\\\\Run'

You have now found the same artifact you planted by hand in that lab, except somebody else planted this one and did not tell you where. That is the difference this lab is for.

Sort by .Event.System.TimeCreated and print the ID with a short description, then read it in order.

Sequence turns a list of facts into a story: what ran, what it started, what it wrote, in what order. A registry write on its own is an artifact. A registry write forty seconds after a document spawned a shell is evidence, and the difference is entirely the ordering.

Every DFIR report you will read is this, at scale. The timeline is the product; the events are the raw material.

What normal looks like on a machine you know. These captures are trimmed to the interesting window. A real endpoint generates thousands of events an hour, almost all of them dull, and developing a feel for that baseline is most of what makes an experienced analyst fast.

What the artifact looks like while it exists. You can read that a Run key was written; you cannot open Autoruns and see it sitting there, or delete it and watch it come back. State and history again — this lab is all history.

So do this one first if a VM is out of reach, and do the others when one is within reach. They are not substitutes.