Overview
The PoweredOnEvents command analyzes the System event log to build a timeline of system reboots and sleep/wake events. It examines specific Event IDs (1, 12, 13, 42, and 6008) to understand the system’s power and availability schedule, which can inform attack timing and persistence strategies.Syntax
Remote Execution
Output
Returns power event timeline:- Event timestamp
- Event type (Boot, Shutdown, Sleep, Wake)
- Event ID
- Event description
Use Cases
- Red Team
- Blue Team
- Identify system reboot schedules
- Determine maintenance windows
- Plan persistence requiring reboots
- Assess system availability patterns
- Time attacks during low-activity periods
Example Output
Remote Execution
This command supports remote execution using the
-computername parameter.Detection Considerations
Low detection risk - reads Windows event logs.
- Event Log Access: Queries System event log
- Remote Access: Generates event log query events when executed remotely
Related Commands
- LastShutdown - Last shutdown timestamp
- OSInfo - Operating system and boot time
- LogonEvents - User logon events
- Processes - Running processes with start times