Windows-focused log enumeration using the local Windows Event Log service: list available channels, then either query selected entries or export a selected log to an EVTX file. Log contents can reveal authentication and system or service activity, but channel access and retained events depend on host configuration.
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
Kibana · Search Sysmon Process-Creation Events with an Office Parent
Search Sysmon Process-Creation Events with an Office Parent
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: ALL(RESTRICTED_ACCESS_BLUR_MARKER)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.preconditions: RESTRICTED_ACCESS_BLUR_MARKERdependencies: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERfailure modes: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKER