Windows Event Logs — EVTX, XML Schema, Providers, Channels

Windows Event Logs are the primary telemetry source for endpoint detection on Windows systems. Before you can write a Sigma rule that targets logsource: product: windows, you need to understand what you’re actually reading.

The EVTX Format

Windows stores event logs as binary .evtx files on disk. Each file corresponds to one channel — a named stream of events from related providers.

C:\Windows\System32\winevt\Logs\
├── Security.evtx          ← 4624, 4625, 4688, 4663...
├── System.evtx             ← 7045, 1102...
├── Application.evtx
├── Microsoft-Windows-Sysmon%4Operational.evtx
├── Microsoft-Windows-PowerShell%4Operational.evtx
└── ...hundreds more

Anatomy of a Windows Event (XML)

When Windows writes an event, it stores it as structured XML. Every event has two blocks: System (standardized metadata) and EventData (provider-specific payload).

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing"
              Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4688</EventID>
    <Version>2</Version>
    <Level>0</Level>
    <Task>13312</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2024-03-15T09:23:14.882341200Z" />
    <EventRecordID>84231</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8044" />
    <Channel>Security</Channel>
    <Computer>WORKSTATION01.corp.local</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-21-3623811015-3361044348-30300820-1013</Data>
    <Data Name="SubjectUserName">jdoe</Data>
    <Data Name="SubjectDomainName">CORP</Data>
    <Data Name="SubjectLogonId">0x3E7</Data>
    <Data Name="NewProcessId">0x1d8c</Data>
    <Data Name="NewProcessName">C:\Windows\System32\cmd.exe</Data>
    <Data Name="TokenElevationType">%%1938</Data>
    <Data Name="ProcessId">0x16bc</Data>
    <Data Name="CommandLine">cmd.exe /c whoami</Data>
    <Data Name="TargetUserSid">S-1-0-0</Data>
    <Data Name="TargetUserName">-</Data>
    <Data Name="TargetDomainName">-</Data>
    <Data Name="TargetLogonId">0x0</Data>
    <Data Name="ParentProcessName">C:\Windows\explorer.exe</Data>
    <Data Name="MandatoryLabel">S-1-16-8192</Data>
  </EventData>
</Event>

What each System field means

What EventData contains

The EventData block varies by EventID. For 4688 (process creation):

• SubjectUserName — who ran the process (the user’s login context)
• NewProcessName — the full path of the new executable
• CommandLine — what arguments were passed (only if process command line auditing is enabled)
• ParentProcessName — what spawned this process (critical for parent-child detection)

The Four Core Channels

Security Channel (Security.evtx)

The Security channel is generated by Microsoft-Windows-Security-Auditing. It requires audit policies to be configured — disabled policies produce no events.

Key EventIDs:

System Channel (System.evtx)

Tracks OS-level events: service start/stop, driver load, hardware errors.

PowerShell/Operational

Generated by Microsoft-Windows-PowerShell. Critical for detecting scripting-based attacks.

Reading Events in Practice

When a SIEM ingests Windows events, the XML gets flattened into field-value pairs. Elasticsearch/ECS normalizes them like this:

# ECS-normalized 4688 event
winlog.event_id: 4688
winlog.channel: Security
winlog.computer_name: WORKSTATION01.corp.local
winlog.event_data.SubjectUserName: jdoe
winlog.event_data.NewProcessName: C:\Windows\System32\cmd.exe
winlog.event_data.CommandLine: cmd.exe /c whoami
winlog.event_data.ParentProcessName: C:\Windows\explorer.exe
@timestamp: 2024-03-15T09:23:14.882Z

A Sigma rule targeting this event might look like:

detection:
  selection:
    winlog.event_id: 4688
    winlog.event_data.CommandLine|contains: 'whoami'
  condition: selection