wevtutil
Enables you to retrieve information about event logs and publishers. Windows commands reference
On Windows 10 Sigma rules name it File wevtutil.exe
Windows
Enables you to retrieve information about event logs and publishers. You can also use this command to install and uninstall event manifests, to run queries, and to export, archive, and clear logs. - Using a configuration file with the sl parameter The configuration file is an XML file with the same format as the output of wevtutil gl <Logname> /f:xml. To shows the format of a configuration file that enables retention, enables autobackup, and sets the maximum log size on the Application log:
wevtutil [{el | enum-logs}] [{gl | get-log} <Logname> [/f:<Format>]][{sl | set-log} <Logname> [/e:<Enabled>] [/i:<Isolation>] [/lfn:<Logpath>] [/rt:<Retention>] [/ab:<Auto>] [/ms:<MaxSize>] [/l:<Level>] [/k:<Keywords>] [/ca:<Channel>] [/c:<Config>]][{ep | enum-publishers}][{gp | get-publisher} <Publishername> [/ge:<Metadata>] [/gm:<Message>] [/f:<Format>]][{im | install-manifest} <Manifest>] [/rf:<Path>] [/mf:<Path>] [/pf:<Path>][{um | uninstall-manifest} <Manifest>] [{qe | query-events} <Path> [/lf:<Logfile>] [/sq:<Structquery>] [/q:<Query>] [/bm:<Bookmark>] [/sbm:<Savebm>] [/rd:<Direction>] [/f:<Format>] [/l:<Locale>] [/c:<Count>] [/e:<Element>]][{gli | get-loginfo} <Logname> [/lf:<Logfile>]][{epl | export-log} <Path> <Exportfile> [/lf:<Logfile>] [/sq:<Structquery>] [/q:<Query>] [/ow:<Overwrite>]][{al | archive-log} <Logpath> [/l:<Locale>]][{cl | clear-log} <Logname> [/bu:<Backup>]] [/r:<Remote>] [/u:<Username>] [/p:<Password>] [/a:<Auth>] [/uni:<Unicode>]List the names of all logs
wevtutil elIdentifyDisplay configuration information about the System log on the local computer in XML format
wevtutil gl System /f:xmlIdentify/fSpecifies that the output should be either XML or text format. Windows commands referenceUse a configuration file to set event log attributes (see Remarks for an example of a configuration file)
wevtutil sl /c:config.xmlIdentify/cSpecifies the path to a configuration file. Windows commands referenceDisplay information about the Microsoft-Windows-Eventlog event publisher, including metadata about the events that the publisher can raise
wevtutil gp Microsoft-Windows-Eventlog /ge:trueIdentify/geGets metadata information for events that can be raised by this publisher. Windows commands referenceInstall publishers and logs from the myManifest.xml manifest file
wevtutil im myManifest.xmlIdentifyUninstall publishers and logs from the myManifest.xml manifest file
wevtutil um myManifest.xmlIdentifyDisplay the three most recent events from the Application log in textual format
wevtutil qe Application /c:3 /rd:true /f:textIdentify/cSpecifies the path to a configuration file. Windows commands reference/rdSpecifies the direction in which events are read. Windows commands reference/fSpecifies that the output should be either XML or text format. Windows commands referenceTrips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Display the status of the Application log
wevtutil gli ApplicationIdentifyExport events from System log to C:\backup\system0506.evtx
wevtutil epl System C:\backup\system0506.evtxIdentifyClear all of the events from the Application log after saving them to C:\admin\backups\a10306.evtx
wevtutil cl Application /bu:C:\admin\backups\a10306.evtxIdentify/buSpecifies the path to a file where the cleared events will be stored. Windows commands referenceTrips 1 Sigma rule: highSuspicious Eventlog Clearing or Configuration Change Activity by Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)
Archive the specified (*.evtx*) log file in a self-contained format. A subdirectory (LocaleMetaData) is created and all locale-specific information is saved in that subdirectory
wevtutil archive-log "C:\backup\Application.evtx" /locale:en-usIdentify{el | enum-logs}Displays the names of all logs.{gl | get-log} <Logname> [/f:<Format>]Displays configuration information for the specified log, which includes whether the log is enabled or not, the current maximum size limit of the log, and the path to the file where the log is stored.{sl | set-log} <Logname> [/e:<Enabled>] [/i:<Isolation>] [/lfn:<Logpath>] [/rt:<Retention>] [/ab:<Auto>] [/ms:<MaxSize>] [/l:<Level>] [/k:<Keywords>] [/ca:<Channel>] [/c:<Config>]Modifies the configuration of the specified log.{ep | enum-publishers}Displays the event publishers on the local computer.{gp | get-publisher} <Publishername> [/ge:<Metadata>] [/gm:<Message>] [/f:<Format>]]Displays the configuration information for the specified event publisher.{im | install-manifest} <Manifest> [/{rf | resourceFilePath}:value] [/{mf | messageFilePath}:value] [/{pf | parameterFilePath}:value]Installs event publishers and logs from a manifest. For more information about event manifests and using this parameter, see the Windows Event Log SDK at the Microsoft Developers Network (MSDN) Web site (https://msdn.microsoft.com). The value is the full path to the mentioned file.{um | uninstall-manifest} <Manifest>Uninstalls all publishers and logs from a manifest. For more information about event manifests and using this parameter, see the Windows Event Log SDK at the Microsoft Developers Network (MSDN) Web site (https://msdn.microsoft.com).{qe | query-events} <Path> [/lf:<Logfile>] [/sq:<Structquery>] [/q:<Query>] [/bm:<Bookmark>] [/sbm:<Savebm>] [/rd:<Direction>] [/f:<Format>] [/l:<Locale>] [/c:<Count>] [/e:<Element>]Reads events from an event log, from a log file, or using a structured query. By default, you provide a log name for <Path>. However, if you use the /lf option, then <Path> must be a path to a log file. If you use the /sq parameter, <Path> must be a path to a file that contains a structured query.{gli | get-loginfo} <Logname> [/lf:<Logfile>]Displays status information about an event log or log file. If the /lf option is used, <Logname> is a path to a log file. You can run wevtutil el to obtain a list of log names.{epl | export-log} <Path> <Exportfile> [/lf:<Logfile>] [/sq:<Structquery>] [/q:<Query>] [/ow:<Overwrite>]Exports events from an event log, from a log file, or using a structured query to the specified file. By default, you provide a log name for <Path>. However, if you use the /lf option, then <Path> must be a path to a log file. If you use the /sq option, <Path> must be a path to a file that contains a structured query. <Exportfile> is a path to the file where the exported events will be stored.{al | archive-log} <Logpath> [/l:<Locale>]Archives the specified log file in a self-contained format. A subdirectory with the name of the locale is created and all locale-specific information is saved in that subdirectory. After the directory and log file are created by running wevtutil al, events in the file can be read whether the publisher is installed or not. Note Files in the locale-specific subdirectory will be overwritten. Make sure the location is trusted and does not contain untrusted symlinks or junctions to critical files.{cl | clear-log} <Logname> [/bu:<Backup>]Clears events from the specified event log. The /bu option can be used to back up the cleared events.