Windows event log ยท Microsoft-Windows-WLAN-AutoConfig/Operational8001 WIFI connection was successful
- Windows operational
- 6 fields
Microsoft-Windows-WLAN-AutoConfig%4Operational.evtxMicrosoft-Windows-WLAN-AutoConfig
Fields EvtxECmd extracts
6 columns in the EvtxECmd CSV
- PayloadData1
ConnectionMode: %ConnectionMode%- %ConnectionMode% = /Event/EventData/Data[@Name="ConnectionMode"]
- PayloadData2
ProfileName: %ProfileName%- %ProfileName% = /Event/EventData/Data[@Name="ProfileName"]
- PayloadData3
SSID: %SSID%- %SSID% = /Event/EventData/Data[@Name="SSID"]
- PayloadData4
BSSType: %BSSType%- %BSSType% = /Event/EventData/Data[@Name="BSSType"]
- PayloadData5
AuthenticationAlgorithm: %AuthenticationAlgorithm%- %AuthenticationAlgorithm% = /Event/EventData/Data[@Name="AuthenticationAlgorithm"]
- PayloadData6
CipherAlgorithm: %CipherAlgorithm%- %CipherAlgorithm% = /Event/EventData/Data[@Name="CipherAlgorithm"]
Sample event
Event XML from the map file
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WLAN-AutoConfig" Guid="{GUID}"/>
<EventID>8001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>24010</Task>
<Opcode>190</Opcode>
<Keywords>0x8000000020000600</Keywords>
<TimeCreated SystemTime="2020-12-02T23:00:51.0749521Z"/>
<EventRecordID>6</EventRecordID>
<Correlation/>
<Execution ProcessID="3352" ThreadID="3516"/>
<Channel>Microsoft-Windows-WLAN-AutoConfig/Operational</Channel>
<Computer>ComputerName</Computer>
<Security UserID="S-1-5-18"/>
</System>
<EventData>
<Data Name="InterfaceGuid">{InterfaceGuid}</Data>
<Data Name="InterfaceDescription">Intel(R) Dual Band Wireless-AC 7265</Data>
<Data Name="ConnectionMode">{ConnectionMode}</Data>
<Data Name="ProfileName">asdf</Data>
<Data Name="SSID">asdf</Data>
<Data Name="BSSType">Infrastructure</Data>
<Data Name="PHYType">802.11n</Data>
<Data Name="AuthenticationAlgorithm">WPA-Personal</Data>
<Data Name="CipherAlgorithm">AES-CCMP</Data>
<Data Name="OnexEnabled">0</Data>
<Data Name="ConnectionId">0x2</Data>
<Data Name="NonBroadcast">true</Data>
</EventData>
</Event>References
3 links
- sans.org/blog/making-the-most-out-of-wlan-event-log-artifacts/(opens in new tab)
- nasbench.medium.com/finding-forensic-goodness-in-obscure-windows-event-logs-60e978ea45a3(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-WLAN-AutoConfig.csv(opens in new tab)
Source: evtx/Maps/Microsoft-Windows-WLAN-AutoConfig-Operational_Microsoft-Windows-WLAN-AutoConfig_8001.map(opens in new tab) by Hyun Yi @hyuunnn and contributors(opens in new tab), MIT License(opens in new tab)