PE-WEV
wevtutil
Query Windows Event Log channels for evidence without opening Event Viewer.
OVERVIEW
wevtutil is the built-in Windows Event Log CLI (learn.microsoft.com). `wevtutil qe Security /c:20 /f:text` prints the last events from a channel; `el` lists channels; `gl` shows a log’s metadata. During an engagement it is how you grab proof of a logon, a service install, or an application error without shipping a full EVTX off the box first.
Reading logs is in-scope evidence collection when the host is. Clearing a log (`cl`) destroys evidence, fires its own event, and is almost never allowed by rules of engagement. Export a slice with `qe` or `epl` into the loot folder instead of wiping anything.
USE CASES
Practical use cases
- 01
Pulling recent Security logons to show which account was used.
- 02
Confirming a service or scheduled-task change landed in System or Operational logs.
- 03
Listing available channels before asking for a full EVTX export.
- 04
Saving a short text extract as an appendix to a finding.
QUICK START
On a Windows host in scope, when you need recent Security, System, or application events as evidence — logons, service changes, or errors — from the CLI.
- Confirm reading Event Logs on this host is in the data-handling / evidence scope.
- List channels, then query a small tail of Security or System in text form.
- Narrow by event id or time window if the tail is too noisy.
- Save the extract; do not clear or overwrite any log.
wevtutil qe Security /c:20 /f:textBEFORE YOU RUN IT
What to check before running it
wevtutil cl clears a channel, which is destructive, highly visible, and almost always outside the rules of engagement.
Security log access usually needs administrator rights; a failed query is still logged.
Full-channel exports can include personal data and credentials in application logs — handle them under the NDA and trim to the events you need.