Home

Awesome

Windows Event Log Messages

The Windows Event Log Messages (WELM) tool retrieves the definitions of Windows Event Log messages embedded in binaries. The tool's output can be used to create an exhaustive list of event information for an operating system.

The tool was initially developed to aid in writing the Spotting the Adversary with Windows Event Log Monitoring paper but has proven useful in a number of scenarios:

Documentation

For more information see:

Data

Retrieved data is available as a dated (YYYMMDD) zip file attachment on the latest release organized by operating system version and architecture. Expanding the dated zip file attachment results in a number of folders that corresponding to Windows operating system releases along with the architecture version. See the Datasets page for more information about each folder and its corresponding media.

Most of the operating system folders contain two folders: welm and wevtutil. These folders were generated by using a batch file that calls WELM and wevutil. The welm folder contains files generated by the WELM tool. The wevtutil folder contains files generated by using wevutil to dump all log and publisher information. Most users will be interested in the events.csv, logs.csv, and providers.csv files inside the the welm folder for each operating system.

Links

License

See License.

Disclaimer

See Disclaimer.