System.evtx — System Event Log

The System event log is the operating system’s heartbeat monitor — every service crash, every new service installed, every event log cleared, and every unplanned shutdown is recorded here. When an attacker installs a persistent backdoor as a Windows service or clears event logs to cover their tracks, System.evtx captures the evidence of both actions.

What Is System.evtx?

System.evtx is one of the three core Windows event logs (alongside Security.evtx and Application.evtx) that exists on every Windows installation from Vista onward. It records events generated by Windows system components: the Service Control Manager (SCM), kernel-mode drivers, the Windows Time Service, the Event Log service itself, and core OS subsystems. Unlike the Security log (which requires audit policy configuration), the System log captures critical events by default with no additional configuration required.

The Service Control Manager writes events whenever a service changes state — started, stopped, crashed, or had its startup type modified. The Event Log service records when any event log channel is cleared. The kernel records driver load events, blue screen parameters, and time synchronization changes. For forensic investigators, these default events provide a reliable baseline of system activity that persists across reboots and survives most cleanup attempts.

System.evtx is stored at C:\Windows\System32\winevt\Logs\System.evtx in the EVTX binary XML format. By default, it operates as a rolling log with a 20 MB maximum size. When the log reaches capacity, the oldest events are overwritten. On busy servers, 20 MB may provide only days of retention; on quiet workstations, it may span weeks or months.

Location & Format

File Path

EVTX Format

The EVTX format (introduced in Vista, replacing the legacy EVT format) uses a binary XML structure. Each event record contains a header with the record ID, timestamp (FILETIME), and event ID, followed by an XML payload containing the event data. Records are stored in 64 KB chunks, each with its own header and CRC32 checksum. This chunked architecture means that even if portions of the file are corrupted, intact chunks can still be parsed.

Critical Event IDs

The following Event IDs are the highest-value entries in System.evtx for forensic and incident response investigations:

Service Control Manager Events

Event Log Service Events

System Time & Other Critical Events

What It Reveals

System.evtx answers the following categories of investigative questions:

• Was a new service installed? — Event ID 7045 records the service name, binary path, service type, start type, and account. This detects PsExec (PSEXESVC), Cobalt Strike service execution, and attacker persistence services.
• Was a security service disabled? — Event ID 7040 records when a service’s start type changes. An attacker disabling Windows Defender (WinDefend) or changing it from Auto to Disabled generates this event.
• Were event logs cleared? — Event ID 104 is written to System.evtx when any event log is cleared. Critically, this event survives even if the Security log was the one cleared, because it is recorded in the System log, not the cleared log.
• When did the system boot and shut down? — Events 6005/6006/6008/6009 provide a complete boot/shutdown timeline. Gaps between 6006 and the next 6005 indicate the system was off; absence of 6006 before 6005 indicates a crash or forced power-off.
• Was the system clock manipulated? — Event ID 1 (Kernel-General) records both the old and new time values when the system clock changes, detecting time-based anti-forensics.
• Did a critical service crash? — Event ID 7034 records service crashes with the service name and crash count. A legitimate service crashing may indicate exploitation; a malware service crashing may indicate failed deployment.

Forensic Use Cases

1. PsExec Lateral Movement Detection

When PsExec is used for lateral movement, it installs a temporary service named PSEXESVC on the remote host. Event ID 7045 records: Service Name: PSEXESVC, Service File Name: %SystemRoot%\PSEXESVC.exe, Service Type: user mode service, Service Start Type: demand start, Service Account: LocalSystem. This event persists even after PsExec completes and removes the service binary. The timestamp of the 7045 event pins the lateral movement to the second.

2. Cobalt Strike Service Execution

Cobalt Strike’s psexec and psexec_psh commands create services with randomized 7-character alphanumeric names (e.g., ab1c2d3) and command lines pointing to cmd.exe /c or powershell.exe -nop -w hidden -encodedcommand. Event ID 7045 captures the full service binary path, making the encoded payload recoverable from the event log alone.

3. Anti-Forensics Detection — Log Clearing

An attacker runs wevtutil cl Security to clear the Security event log after credential theft. Event ID 104 in System.evtx records: The Security log file was cleared. Subject: DOMAIN\compromised_admin. The attacker cannot clear System.evtx’s record of the clearing without generating another Event ID 104 for System.evtx itself — creating an infinite evidence loop.

4. Security Service Tampering

Before deploying ransomware, attackers commonly disable endpoint protection. Event ID 7040 captures: The start type of the WinDefend service was changed from auto start to disabled and The start type of the MsMpSvc service was changed from auto start to disabled. The sequence of security services being disabled immediately before encryption provides a clear pre-ransomware indicator.

5. Boot/Shutdown Timeline Reconstruction

In a corporate espionage case, the investigator needs to establish when a laptop was powered on during a weekend. Events 6005 (boot), 6006 (clean shutdown), 6008 (unexpected shutdown), and 12/13 (kernel start/stop) provide an hour-by-hour power timeline. If the laptop was supposedly off-site but System.evtx shows it booting at 02:30 AM Saturday, the user’s account is contradicted by the evidence.

Acquisition Methods

Live System — wevtutil Export

:: Export the System log to a new .evtx file (bypasses file lock)
wevtutil epl System C:\Evidence\System_export.evtx

:: Also export Security and Application for cross-correlation
wevtutil epl Security C:\Evidence\Security_export.evtx
wevtutil epl Application C:\Evidence\Application_export.evtx

:: Quick triage: export only Event ID 7045 (new services) from the last 7 days
wevtutil qe System /q:"*[System[(EventID=7045) and TimeCreated[timediff(@SystemTime) <= 604800000]]]" /f:text

Live System — KAPE / Velociraptor

:: KAPE: Collect all event logs
kape.exe --tsource C: --tdest C:\Evidence\KAPE_Output --target EventLogs

:: Velociraptor: Collect System.evtx via artifact
:: Artifact: Windows.EventLogs.EvtxHunter
:: Or: Windows.KapeFiles.Targets with target "EventLogs"

Forensic Image — Direct Extraction

# Mount forensic image read-only
mount -o ro,noexec,nodev /dev/sdb1 /mnt/evidence

# Copy all event logs
cp -r /mnt/evidence/Windows/System32/winevt/Logs/ /analysis/evtx/

# Or extract only System.evtx
cp /mnt/evidence/Windows/System32/winevt/Logs/System.evtx /analysis/evtx/

Parsing Tools & Analysis

Parsing with EvtxECmd

:: Parse System.evtx to CSV with event maps
EvtxECmd.exe -f C:\Evidence\System.evtx --csv C:\Analysis\System_Output --csvf System_parsed.csv

:: Parse all EVTX files in a directory
EvtxECmd.exe -d C:\Evidence\evtx\ --csv C:\Analysis\AllLogs_Output

Hunting with Chainsaw

:: Hunt across all EVTX logs using Sigma rules
chainsaw hunt C:\Evidence\evtx\ -s sigma/rules/ --mapping mappings/sigma-event-logs-all.yml

:: Search for specific Event IDs
chainsaw search C:\Evidence\System.evtx -e 7045
chainsaw search C:\Evidence\System.evtx -e 104

PowerShell Queries (Live or Offline)

# Find all new service installations (Event ID 7045)
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} |
    Select-Object TimeCreated, @{N='ServiceName';E={$_.Properties[0].Value}},
        @{N='ImagePath';E={$_.Properties[1].Value}},
        @{N='ServiceType';E={$_.Properties[2].Value}},
        @{N='StartType';E={$_.Properties[3].Value}},
        @{N='AccountName';E={$_.Properties[4].Value}}

# Find all log clearing events (Event ID 104)
Get-WinEvent -FilterHashtable @{LogName='System';Id=104} |
    Select-Object TimeCreated, @{N='ClearedLog';E={$_.Properties[0].Value}},
        @{N='SubjectUser';E={$_.Properties[1].Value}}

# Find service start-type changes (Event ID 7040)
Get-WinEvent -FilterHashtable @{LogName='System';Id=7040} |
    Select-Object TimeCreated, Message | Format-List

# Query an offline .evtx file
Get-WinEvent -Path 'C:\Evidence\System.evtx' -FilterXPath "*[System[(EventID=7045)]]"

Retention & Persistence

Anti-Forensics Resilience

System.evtx has strong anti-forensics resilience for most attacks, with one critical exception: direct log clearing by an administrator-level attacker.

MITRE ATT&CK Detection Mapping

System.evtx provides direct detection capability for the following MITRE ATT&CK techniques:

Related Artifacts & Cross-References

Complementary Artifacts

References

1. Eric Zimmerman, “EvtxECmd — EVTX Parser” — https://ericzimmerman.github.io/
2. WithSecure, “Chainsaw — Rapid EVTX Hunting” — https://github.com/WithSecureLabs/chainsaw
3. Yamato Security, “Hayabusa — Windows Event Log Analyzer” — https://github.com/Yamato-Security/hayabusa
4. SANS Institute, “Windows Event Log Reference” — https://www.sans.org/posters/windows-forensic-analysis/
5. Microsoft, “Service Control Manager Events” — https://learn.microsoft.com
6. JPCERT/CC, “Tool Analysis Result Sheet — PsExec” — https://jpcertcc.github.io/ToolAnalysisResultSheet/
7. SigmaHQ, “Sigma Detection Rules” — https://github.com/SigmaHQ/sigma