DFIRHub

Windows event log ยท Microsoft-Windows-Winlogon/Operational811 User activity

  • Windows operational
  • 2 fields
  • Microsoft-Windows-Winlogon%4Operational.evtx
  • Microsoft-Windows-Winlogon

Fields EvtxECmd extracts

2 columns in the EvtxECmd CSV

  • PayloadData1The winlogon notification subscriber <%SubscriberName%> began handling the notification event (%Event%)
    • %Event% = /Event/EventData/Data[@Name="Event"]
    • %SubscriberName% = /Event/EventData/Data[@Name="SubscriberName"]
  • PayloadData2Event: %Reason%
    • %Reason% = /Event/EventData/Data[@Name="Event"]

Value lookups

Codes that EvtxECmd turns into text

Reason

2
User logon
3
User logoff
4
System lock
5
System unlock
6
Screensaver start
7
Screensaver stop

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="db679383-7cf3-4331-91cc-a3cb16a3b538"/>
    b538" />
    <EventID>811</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>811</Task>
    <Opcode>1</Opcode>
    <Keywords>0x4000000000010000</Keywords>
    <TimeCreated SystemTime="2021-02-15 12:20:44.2547237"/>
    <EventRecordID>5176</EventRecordID>
    <Correlation/>
    <Execution ProcessID="1496" ThreadID="1596"/>
    <Channel>Microsoft-Windows-Winlogon/Operational</Channel>
    <Computer>HOSTNAME</Computer>
    <Security UserID="S-1-5-21-250123456-2372827616-1567908901-1001"/>
  </System>
  <EventData>
    <Data Name="Event">5</Data>
    <Data Name="SubscriberName">Sens</Data>
  </EventData>
</Event>

References

4 links

Source: evtx/Maps/Microsoft-Windows-Winlogon-Operational_Microsoft-Windows-Winlogon_811.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)