> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/accounts-and-and-groups-in-depth/event-log-readers.md).

# Event Log Readers

The [Event Log Readers](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn579255\(v=ws.11\)?redirectedfrom=MSDN#event-log-readers) group may reveal a surprisingly amount of information about a system. Event logs are emitted in all sorts of scenarios, such as when [processes are created](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-process-creation), or when command lines are run. Often, attackers are caught as a result of logs pertaining to their command-line execution (e.g. running `wmic`, `wusa`, `at`, `reg`, `tasklist`, `ver`, `ipconfig`, `systeminfo`, `dir`, `net`, `view`, `ping`, `net use`, `type`, `whoami`, `netstat`, `tasklist`). This can be particularly useful, as other users may pass in credentials into their commands. We can use the event log to see whether we can recover these.

{% code title="Confirm group membership" %}

```batch
net localgroup "Event Log Readers"
```

{% endcode %}

Some helpful tools for querying the Windows event log is [wevtutil](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil) and [Get-WinEvent](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.1). 

{% tabs %}
{% tab title="wevtutil" %}

<pre class="language-batch" data-title="Querying for security logs"><code class="lang-batch">wevtutil qe Security /rd:true /f:text | Select-String "/user"
<strong>wevtutil qe Security /rd:true /f:text /r:share01 /u:julie.clay /p:Welcome1 | findstr "/usr"
</strong></code></pre>

{% endtab %}

{% tab title="Get-WinEvent" %}
{% code title="Note that searching the Security event log requires administrator access or permissions adjusted on the registry key HKLM\System\CurrentControlSet\Services\Eventlog\Security" %}

```powershell
Get-WinEvent -LogName security | where { $_.ID -eq 4688 -and $_.Properties[8].Value -like '*/user*'} | Select-Object @{name='CommandLine';expression={ $_.Properties[8].Value }}
```

{% endcode %}
{% endtab %}
{% endtabs %}

Other logs include [PowerShell Operational](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.1) logs, which may contain sensitive information if script block or module logging is enabled. This log is accessible to unprivileged users.