Windows event log ยท Microsoft-Windows-WLAN-AutoConfig/Operational8003 WIFI connection was terminated
- Windows operational
- 5 fields
Microsoft-Windows-WLAN-AutoConfig%4Operational.evtxMicrosoft-Windows-WLAN-AutoConfig
Fields EvtxECmd extracts
5 columns in the EvtxECmd CSV
- PayloadData1
ConnectionMode: %ConnectionMode%- %ConnectionMode% = /Event/EventData/Data[@Name="ConnectionMode"]
- PayloadData2
ProfileName: %ProfileName%- %ProfileName% = /Event/EventData/Data[@Name="ProfileName"]
- PayloadData3
SSID: %SSID%- %SSID% = /Event/EventData/Data[@Name="SSID"]
- PayloadData4
BSSType: %BSSType%- %BSSType% = /Event/EventData/Data[@Name="BSSType"]
- PayloadData5
Reason: %Reason%- %Reason% = /Event/EventData/Data[@Name="Reason"]
Sample event
Event XML from the map file
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WLAN-AutoConfig" Guid="{GUID}"/>
<EventID>8003</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>24010</Task>
<Opcode>192</Opcode>
<Keywords>0x8000000040000600</Keywords>
<TimeCreated SystemTime="2020-12-02T23:01:09.8177071Z"/>
<EventRecordID>16</EventRecordID>
<Correlation/>
<Execution ProcessID="3352" ThreadID="3520"/>
<Channel>Microsoft-Windows-WLAN-AutoConfig/Operational</Channel>
<Computer>ComputerName</Computer>
<Security UserID="S-1-5-18"/>
</System>
<EventData>
<Data Name="InterfaceGuid">{InterfaceGuid}</Data>
<Data Name="InterfaceDescription">Intel(R) Dual Band Wireless-AC 7265</Data>
<Data Name="ConnectionMode">{ConnectionMode}</Data>
<Data Name="ProfileName">asdf</Data>
<Data Name="SSID">asdf</Data>
<Data Name="BSSType">Infrastructure</Data>
<Data Name="Reason">{Reason}</Data>
<Data Name="ConnectionId">0x3</Data>
<Data Name="ReasonCode">2</Data>
</EventData>
</Event>References
3 links
- sans.org/blog/making-the-most-out-of-wlan-event-log-artifacts/(opens in new tab)
- nasbench.medium.com/finding-forensic-goodness-in-obscure-windows-event-logs-60e978ea45a3(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-WLAN-AutoConfig.csv(opens in new tab)
Source: evtx/Maps/Microsoft-Windows-WLAN-AutoConfig-Operational_Microsoft-Windows-WLAN-AutoConfig_8003.map(opens in new tab) by Hyun Yi @hyuunnn and contributors(opens in new tab), MIT License(opens in new tab)