> For the complete documentation index, see [llms.txt](https://seymour.hackstreetboys.ph/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://seymour.hackstreetboys.ph/projects/blue-team/custom-evtx-logs.md).

# Custom EVTX Logs

## SUMMARY

This lays out how to create a subscription (both source and collector initiated) that collects selected forwarded **`.evtx`** event logs from a workstation to a domain controller.

## ENVIRONMENT

| WINDOWS         | OS                           | BUILD NO.              | REMARKS           |
| --------------- | ---------------------------- | ---------------------- | ----------------- |
| WIN-BO2CT95INDP | Windows Server 2016 Standard | 10.0.14393 Build 14393 | Collector Machine |

## APPLICATIONS/TOOLS USED

1. Windows SDK (Development Kit):
   * ecmangen.exe
   * mc.exe (Message Compiler)
   * rc.exe (Resource Compiler)
2. csc.exe (C# Compiler)
3. wevtutil

* **ecmangen.exe** was removed from the Windows 10 SDK starting from 10.0.16299.15
  * Parallel installations of Windows SDK are allowed.
  * In this case, [Windows 10 SDK (10.0.14393.795)](https://go.microsoft.com/fwlink/p/?LinkId=838916) was installed alongside the latest SDK version.
* **csc.exe** is included in the ***Microsoft .NET Framework***.
  * **.NET Framework** is native to Windows Operating Systems.
  * The Framework's version depends on the OS installed.
* **wevtutil** is a command native to the ***Command Prompt***

## PROCEDURE

### 1. Create a manifest file

Open `ecmangen.exe`:

```
C:\Program Files (x86)\Windows Kits\10\bin\x64\ecmangen.exe
```

Create a new ***provider***:

1. On the left panel, right click on `Events Section` then select **New** -> **Provider**.
2. Fill up the following fields:

   | FIELD     | VALUE                              |
   | --------- | ---------------------------------- |
   | Name      | WEF-Events                         |
   | Symbol    | WEF\_Events                        |
   | GUID      | Press "New" beside the input field |
   | Resources | C:\Windows\System32\WEF-Events.dll |
   | Messages  | C:\Windows\System32\WEF-Events.dll |

On the right panel, click on `Save`. Then, create a new ***template***:

1. On the left panel, under `WEF-Events`, select `Templates`.
2. On the right panel, select `New Template`. 
3. Fill up the following fields:

   | FIELD | VALUE        |
   | ----- | ------------ |
   | Name  | WEF-Template |
4. Add `Field Attributes`:

   | Name    | InType            | OutType        | Count   | Length  |
   | ------- | ----------------- | -------------- | ------- | ------- |
   | Unicode | win:UnicodeString | xs:string      | default | default |
   | UInt32  | win:UInt32        | xs:unsignedInt | default | -       |
5. On the right panel, click `Save`.

Create ***channels*** (maximum of 8):

1. On the left panel, under `WEF-Events`, select `Channels`.
2. On the right panel, select `New Channel`.
3. Fill up the following fields:

   | NAME           | SYMBOL          | TYPE        | ENABLE | DESCRIPTION        | CHANNEL SECURITY |
   | -------------- | --------------- | ----------- | ------ | ------------------ | ---------------- |
   | WEF-Security   | WEF\_Security   | Operational | Yes    | DC Security Logs   | Default          |
   | WEF-System     | WEF\_System     | Operational | Yes    | DC System Logs     | Default          |
   | WEF-PowerShell | WEF\_PowerShell | Operational | Yes    | DC PowerShell Logs | Default          |
   | WEF-Sysmon     | WEF\_Sysmon     | Operational | Yes    | DC Sysmon Logs     | Default          |
4. On the right panel, click `Save`.

Create a new ***event***:

1. On the left panel, under `WEF-Events`, select `Events`.
2. On the right panel, select `New Event`.
3. Fill up the following fields:

   | FIELD    | VALUE                                      |
   | -------- | ------------------------------------------ |
   | Symbol   | WEF\_Event                                 |
   | Event ID | 6969                                       |
   | Message  | $(string.WEF-Events.event.6969.message)    |
   | Channel  | WEF-Security                               |
   | Template | WEF-Template                               |
   | Keywords | \`win:AuditSuccess\`, \`win:AuditFailure\` |
4. On the right panel, click on `Save`.

Save the manifest file as "**WEF\_Events.man**"

* Avoid using the character, '`-`', in the filename.
  * The generated C# file during compiling will face an error.
* Resulting manifest file (XML formatted):

  ```markup
  <?xml version="1.0"?>
  <instrumentationManifest xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd" xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:trace="http://schemas.microsoft.com/win/2004/08/events/trace">
    <instrumentation>
   <events>
        <provider name="WEF-Events" guid="{CB3EB4AA-FEDD-41C4-A7BB-E173045E4DC7}" symbol="WEF_Events" resourceFileName="C:\Windows\System32\WEF_Events.dll" messageFileName="C:\Windows\System32\WEF_Events.dll">
          <events>
            <event symbol="WEF_Event" value="6969" version="0" channel="WEF-Security" template="WEF-Template" keywords="win:AuditSuccess win:AuditFailure " message="$(string.WEF-Events.event.6969.message)"></event>
          </events>
          <channels>
            <channel name="WEF-Security" chid="WEF-Security" symbol="WEF_Security" type="Operational" enabled="true" message="$(string.WEF-Events.channel.WEF_Security.message)"></channel>
            <channel name="WEF-System" chid="WEF-System" symbol="WEF_System" type="Operational" enabled="true" message="$(string.WEF-Events.channel.WEF_System.message)"></channel>
            <channel name="WEF-PowerShell" chid="WEF-PowerShell" symbol="WEF_PowerShell" type="Operational" enabled="true" message="$(string.WEF-Events.channel.WEF_PowerShell.message)"></channel>
            <channel name="WEF-Sysmon" chid="WEF-Sysmon" symbol="WEF_Sysmon" type="Operational" enabled="true" message="$(string.WEF-Events.channel.WEF_Sysmon.message)"></channel>
          </channels>
          <keywords></keywords>
          <templates>
            <template tid="WEF-Template">
              <data name="Unicode" inType="win:UnicodeString" outType="xs:string"></data>
          <data name="UInt32" inType="win:UInt32" outType="xs:unsignedInt"></data>
            </template>
          </templates>
        </provider>
      </events>
    </instrumentation>
    <localization>
      <resources culture="en-US">
        <stringTable>
          <string id="keyword.AuditSuccess" value="Audit Success"></string>
          <string id="keyword.AuditFailure" value="Audit Failure"></string>
          <string id="WEF-Events.event.6969.message" value="$(string.WEF-Events.event.6969.message)"></string>
          <string id="WEF-Events.channel.WEF_System.message" value="DC System Logs"></string>
          <string id="WEF-Events.channel.WEF_Sysmon.message" value="DC Sysmon Logs"></string>
          <string id="WEF-Events.channel.WEF_Security.message" value="DC Security Logs"></string>
          <string id="WEF-Events.channel.WEF_PowerShell.message" value="DC PowerShell Logs"></string>
        </stringTable>
      </resources>
    </localization>
  </instrumentationManifest>
  ```

### 2. Compile the manifest file and generate relevant files (e.g. WEF-Events.dll)

Press `Win` + `R` then enter `cmd` and navigate to where `WEF_Events.man` was saved. Then, enter the following commands:&#x20;

1\. **mc.exe** (Message Compiler)

```
   "C:\Program Files (x86)\Windows Kits\10\bin\x64\mc.exe" WEF_Events.man
   "C:\Program Files (x86)\Windows Kits\10\bin\x64\mc.exe" -css WEF_Events.DummyEvent WEF_Events.man
```

* The compiler generates the message resource files to which your application links.
* Switches used:

  | OPTION            | DESCRIPTION                                                                                                                                  |
  | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
  | -css \<namespace> | <ul><li>Generates a static C# class</li><li>It includes the methods that you would call to log the events defined in your manifest</li></ul> |

File(s) generated after execution:

* MSG00001.bin
* WEF\_Events.cs
* WEF\_Events.h
* WEF\_Events.rc
* WEF\_EventsTEMP.bin

2\. **rc.exe** (Resource Compiler)

```
"C:\Program Files (x86)\Windows Kits\10\bin\x64\rc.exe" WEF_Events.rc

# Microsoft (R) Windows (R) Resource Compiler Version 10.0.10011.16384
# Copyright (C) Microsoft Corporation.  All rights reserved.
```

* `rc.exe` compiles an application's resources and could be used to build Windows-based applications.
* File(s) generated after execution:
  * WEF\_Events.res

3\. **csc.exe** (C# Compiler)

```
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /win32res:WEF_Events.res /unsafe /target:library /out:WEF_Events.dll WEF_Events.cs
```

* No output means the command was successfully executed&#x20;
* Switches used:

  | OPTION            | DESCRIPTION                                                                         |
  | ----------------- | ----------------------------------------------------------------------------------- |
  | /win32res:\<file> | Specify a Win32 resource file (.res)                                                |
  | /unsafe           | Allow 'unsafe' code                                                                 |
  | /target:library   | Build a library (Short form: /t:library)                                            |
  | /out:\<file>      | Specify output file name (default: base name of file with main class or first file) |
* File(s) generated after execution -- WEF\_Events.dll

### 3. Install the **manifest file** with the matching **dll file**:

1. Move both files to the `C:\Windows\System32` directory:

   ```
   copy .\WEF_Events.man C:\Windows\System32\WEF_Events.man
   copy .\WEF_Events.dll C:\Windows\System32\WEF_Events.dll
   ```
2. Install the manifest file using `wevtutil`:

   ```
   wevtutil im C:\Windows\System32\WEF_Events.man
   ```

### 4. The created logs should appear under `Applications and Services Logs` inside **Event Viewer**

* The logs generated could be used for created subscriptions.
* Additional columns could be added/removed from the logs (e.g. `Log`, `Computer`)&#x20;

## REFERENCES

```
- https://blogs.technet.microsoft.com/russellt/2016/05/18/creating-custom-windows-event-forwarding-logs/
- https://stackoverflow.com/questions/53028775/cannot-locate-ecmangen
- https://developer.microsoft.com/en-us/windows/downloads/sdk-archive
- https://blogs.msdn.microsoft.com/astebner/2007/03/14/mailbag-what-version-of-the-net-framework-is-included-in-what-version-of-the-os/
- https://docs.microsoft.com/en-us/windows/win32/wes/message-compiler--mc-exe-
- https://docs.microsoft.com/en-us/windows/win32/menurc/using-rc-the-rc-command-line-
```