Windows event log ยท Microsoft-Windows-WinRM/Operational169 WinRM Authentication
- Remote access
- 2 fields
Microsoft-Windows-WinRM%4Operational.evtxMicrosoft-Windows-WinRM
Fields EvtxECmd extracts
2 columns in the EvtxECmd CSV
- UserName
%username%- %username% = /Event/EventData/Data[@Name="username"]
- PayloadData1
AuthenticationMechanism: %authenticationMechanism%- %authenticationMechanism% = /Event/EventData/Data[@Name="authenticationMechanism"]
Sample event
Event XML from the map file
<EventData>
<Data Name="username">iewin7\ieuser</Data>
<Data Name="authenticationMechanism">NTLM</Data>
</EventData>References
4 links
- resources.infosecinstitute.com/topic/powershell-remoting-artifacts-part-1/(opens in new tab)
- nsfocusglobal.com/Attack-and-Defense-Around-PowerShell-Event-Logging(opens in new tab)
- powershellmagazine.com/2014/07/16/investigating-powershell-attacks/(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-WinRM.csv(opens in new tab)
Source: evtx/Maps/Microsoft-Windows-WinRM-Operational_Microsoft-Windows-WinRM_169.map(opens in new tab) by Mike Pilkington and contributors(opens in new tab), MIT License(opens in new tab)