Overview
The WindowsEventForwarding command enumerates Windows Event Forwarding (WEF) configuration from the registry. WEF allows centralized collection of event logs from multiple systems to a collector server. Understanding WEF configuration reveals what events are being forwarded and to where, indicating the organization’s logging and monitoring posture.Syntax
Remote Execution
Output
Returns WEF configuration:- WEF enabled/disabled status
- Subscription configurations
- Collector server addresses
- Event log sources being forwarded
- Subscription status
Use Cases
- Red Team
- Blue Team
- Determine if logs are centrally collected
- Identify collector servers (potential high-value targets)
- Understand monitoring visibility
- Assess detection capabilities
- Plan operations to minimize logged events
Example Output
Remote Execution
This command supports remote execution using the
-computername parameter.Detection Considerations
Low detection risk - reads WEF registry configuration.
- Registry Access: Queries
HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\EventForwarding - WMI Activity: Remote execution generates WMI events
- Event Logs: Registry access may be logged if auditing enabled
WEF Architecture Understanding
Windows Event Forwarding Components
Windows Event Forwarding Components
Source Computer (Event Forwarder):
- Sends events to collector
- Configured via subscriptions
- Uses WinRM protocol (HTTP/HTTPS)
- Receives forwarded events
- Aggregates logs centrally
- Typically SIEM or log server
- Source-initiated: Computers contact collector
- Collector-initiated: Collector pulls from computers
- HTTP: 5985
- HTTPS: 5986
Critical Events Often Forwarded
Common Event IDs in WEF
Common Event IDs in WEF
Security Events:
- 4624 - Successful logon
- 4625 - Failed logon
- 4648 - Explicit credential logon
- 4688 - Process creation
- 4672 - Special privilege assigned
- 4720 - User account created
- 4732 - Member added to security group
- 4104 - Script block logging
- 4103 - Module logging
- 1 - Process creation
- 3 - Network connection
- 7 - Image loaded
- 10 - Process access
Related Commands
- AuditPolicies - Audit policy configuration
- Sysmon - Sysmon configuration
- PowerShell - PowerShell logging settings
- PSSessionSettings - WinRM configuration