I created this because I had to parse many windows logs files and I didn't want to run the parsing script on each file manually
- Ensure python-evtx is installed
- https://github.com/williballenthin/python-evtx
- In Kali you can just use
sudo apt install python-evtx
- Run
ParseAllEVTX.pyin the directory that has all of your evtx files - This will create a directory called
parsedand will output each .evtx file here as an.xmlfile
- Create a txt file that has a search term on a new line
- Ensure that your file paths have two back slashes (with an extra
\) (ex.C:\\WINDOWS\\system32) - Run
SearchLogs.pywith the arg<YOUR_FILE_HERE>