wevtutil

The Windows Event Log command-line — list logs, query events with XPath, export evidence, and read the config — as a defender's reference, with the log-tampering moves to detect. Click any command to copy it.

Start here

What it does

wevtutil is the built-in CLI for the Windows event logs — the same data behind Event Viewer and Get-WinEvent, scriptable. Commands take a short verb (qe, el, gl, epl…) and a log or provider name. Query filters are XPath. Reads and writes the logs under %SystemRoot%\System32\winevt\Logs\*.evtx. Pairs with the Event IDs, schtasks, and sc sheets.

wevtutil COMMAND [args] /option:valueShort aliases have long forms — qe = query-events, el = enum-logs, gl = get-log, epl = export-log, cl = clear-log.
Log vs providerA log is a container (Security, System); a provider/publisher is what writes events into it. el lists logs, ep lists publishers.
Run as admin for SecurityReading or clearing the Security log needs an elevated prompt. Most gl/el reads don't.
PowerShell equivalentGet-WinEvent -FilterHashtable @{...} / -FilterXPath give object output; wevtutil is leaner and always present, even on Server Core.

Inventory

List logs & read config

wevtutil elEnumerate every log on the box — hundreds, including the Applications-and-Services channels (Sysmon, PowerShell/Operational, TaskScheduler).
wevtutil el | findstr /i "sysmon powershell taskscheduler"Find the operational channels you actually hunt in.
wevtutil gl SecurityGet-log config — enabled state, max size, retention mode, and the .evtx file path. Check the Security log hasn't been shrunk.
wevtutil gli SecurityGet-log info — current record count, oldest record number, file size, last-written time, and whether the log is full.
wevtutil epList all publishers (event providers) registered on the host.
wevtutil gp Microsoft-Windows-Sysmon /ge /gm:trueGet-publisher — the events a provider can emit, with messages. Useful for knowing what an ID means.
wevtutil sl Security /ms:1048576000Set-log: change max size. Shown because shrinking a log to force rollover is a quiet way to destroy evidence without a clear.
wevtutil sl "Microsoft-Windows-PowerShell/Operational" /e:falseDisable a log entirely (/e:false). Turning off PowerShell, Sysmon, or Security logging is a defense-evasion move — baseline enabled states.
wevtutil sl Security /rt:true /ab:falseRetention and auto-backup settings — how the log behaves when full (overwrite vs archive).

Read

Query events (qe)

The core verb. /c caps count, /rd:true reads newest-first, /f:text makes it human-readable, /q takes an XPath filter.

wevtutil qe Security /c:10 /rd:true /f:textThe everyday read — last 10 Security events, newest first, formatted as text. Drop /rd:true for oldest-first.
wevtutil qe System /c:20 /f:text /rd:trueSame against System — service installs (7045), log tampering, unexpected shutdowns.
wevtutil qe Security /q:"*[System[(EventID=4624)]]" /c:20 /f:text /rd:trueFilter by Event ID — here successful logons (4624). The XPath goes in /q.
wevtutil qe Security /q:"*[System[(EventID=4625)]]" /c:50 /rd:true /f:textFailed logons (4625) — brute-force / password-spray triage.
wevtutil qe "Microsoft-Windows-Sysmon/Operational" /q:"*[System[(EventID=1)]]" /c:20 /f:text /rd:trueQuery an Applications-and-Services channel by its full name — Sysmon process-creation here.
wevtutil qe Security /f:xml /c:5Raw XML output — the full EventData, every field. Best for scripting or preserving detail.
wevtutil qe Application /lf:true /q:"*" C:\eff\Security.evtx/lf:true reads from a file (an exported/collected .evtx) instead of a live log — offline analysis.
wevtutil qe Security /sq:true /q:query.xml/sq:true runs a structured query from an XML file — build it once in Event Viewer ("Filter → XML"), reuse it everywhere.

Filters

XPath cheat — what goes in /q

The same XPath works in Event Viewer's XML filter and in Get-WinEvent -FilterXPath. System holds the metadata; EventData holds the fields.

*[System[(EventID=4688)]]One event ID. Multiple: (EventID=4624 or EventID=4625).
*[System[(Level=1 or Level=2)]]By severity — 1 Critical, 2 Error, 3 Warning, 4 Information.
*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]Everything in the last 24h (value in milliseconds). Swap in 3600000 for the last hour.
*[System[(EventID=4625)]] and *[EventData[Data[@Name='TargetUserName']='admin']]Filter on an EventData field — failed logons against the admin account.
*[EventData[Data[@Name='LogonType']='10']]By a named data field — LogonType 10 is RemoteInteractive (RDP).
*[System[Provider[@Name='Microsoft-Windows-Security-Auditing']]]By the provider that wrote the event.
*[System[(EventID=4672)]]Special-privilege logon (admin-equivalent) — pair with 4624 to flag privileged sign-ins.
Suppress: *[System[(EventID=4624)]] and *[System[(EventID!=5379)]]XPath supports != and and/or to carve out noise — combine includes and excludes.

Evidence

Export, archive & clear

Preserve a log for offline work — and the one command every SOC watches for: a clear.

wevtutil epl Security C:\ir\Security.evtxExport-log — write the whole log to an .evtx you can carry off-host and read with /lf:true or Event Viewer. The evidence-preservation command.
wevtutil epl Security C:\ir\4625.evtx /q:"*[System[(EventID=4625)]]"Export only the matching events — a focused evidence file for a ticket.
wevtutil epl App.evtx C:\ir\App2.evtx /lf:trueRe-export from an existing .evtx file (filter an already-collected log).
wevtutil al C:\ir\Security.evtx /l:en-USArchive-log — make an exported .evtx self-contained with its message strings, so it renders on another machine.
wevtutil cl SecurityClear-log — anti-forensics. Wipes the log. The act itself logs Security 1102 (or System 104 for other logs) — alert on those, they're hard for an attacker to suppress.
wevtutil cl Security /bu:C:\backup\Sec.evtxClear with a backup. Still fires 1102 — a clear is a clear.

The move: at the start of an investigation, epl the Security, System, PowerShell/Operational, and Sysmon logs to a collection folder, then analyze the copies with /lf:true — you're working preserved evidence, not a live log that's still rolling.

Fleet

Remote hosts

wevtutil qe Security /r:SRV01 /u:DOMAIN\admin /p:*** /c:20 /f:text /rd:trueQuery a remote host's log — /r host, /u user, /p password (needs RPC + the Remote Event Log service).
wevtutil gli Security /r:SRV01 /u:... /p:...Check a remote log's record count and size — spot a suspiciously empty or tiny Security log across the fleet.
wevtutil epl Security \\SRV01\C$\ir\Sec.evtx /r:SRV01 /u:... /p:...Export a remote host's log straight to a share — remote evidence collection.
wevtutil el /r:SRV01 /u:... /p:...Enumerate a remote host's logs — confirm Sysmon/PowerShell channels exist and are enabled on it.

Put it together

SOC one-liners

Fast reads against a live box. For richer filtering and object output, the Get-WinEvent equivalents are noted.

wevtutil qe Security /q:"*[System[(EventID=1102)]]" /c:5 /f:text /rd:trueWas the Security log cleared? 1102 tells you, and who did it. First thing to check on a suspect host.
wevtutil qe Security /q:"*[System[(EventID=4625)]]" /c:100 /rd:true /f:text | findstr /i "Account Name"Recent failed logons with the targeted accounts — brute-force / spray at a glance.
wevtutil qe Security /q:"*[System[(EventID=4720 or EventID=4732 or EventID=4728)]]" /f:text /rd:trueAccount created (4720) and added to a privileged group (4732 local / 4728 global) — persistence via a new admin.
wevtutil qe System /q:"*[System[(EventID=7045)]]" /f:text /rd:trueNew service installs — the sc / PsExec lateral-movement tell.
wevtutil qe "Microsoft-Windows-PowerShell/Operational" /q:"*[System[(EventID=4104)]]" /c:20 /f:text /rd:trueScript-block logging (4104) — the decoded PowerShell that actually ran.
for /f %l in ('wevtutil el') do @wevtutil gl "%l" 2^>nul | findstr /i "enabled: false"Hunt disabled logs across every channel — catch an attacker who turned logging off.
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625} -MaxEvents 100 | Group TargetUserNameThe PowerShell version — failed logons grouped by account, the cleaner way to see spray.

Detection, restated: a log clear is Security 1102 / System 104; disabling or resizing a log and wevtutil.exe in a command line (4688 / Sysmon 1) with cl, sl … /e:false, or /ms: is the alert — log tampering almost always precedes or follows something worse.