fox-it / danderspritz-evtx Goto Github PK

Should danderspritz-evtx successfully detect modifications from other EVTX editors as well? Currently it fails to detect modifications from DeleteRecordofFileEx (https://github.com/3gstudent/Eventlogedit-evtx--Evolution/blob/master/DeleteRecordofFileEx.cpp):

C:\Temp>c:\tools\DeleteRecordofFileEx.exe security.evtx 5025
[+]ReadPath:C:\WINDOWS\system32\winevt\logs\security.evtx
[+]EventRecordID:5025
[+]Delete success

C:\Temp>c:\tools\danderspritz_evtx.exe -i temp.evtx

Reading records from temp.evtx...


C:\Temp>

I've attached both my Security.evtx (unmodified) and the DeleteRecordofFileEx-modified temp.evtx file as a zip for analysis. There is an obvious loss of the ResourceId value 5025 from the tool, though this doesn't appear to be what danderspritz-evtx looks for as a detection mechanism.

Let me know if you want additional tests, or if you want my EXE build of DeleteRecordofFileEx. Thanks!

-Josh
EventLogs.zip

To demonstrate the efficacy of this script, would you publish some test .evtx log files that we can inspect?