> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2025/forensics/event-viewing-medium.md).

# Event Viewing (Medium)

<figure><img src="/files/vqsQwkFby8kj5ta7AHR0" alt=""><figcaption></figcaption></figure>

***

The challenge give us a Event Viewer Log. I've had frequent experience using Syslog so it should be fine. The flag is separated in three different parts.&#x20;

* **Security**: login attempts, privilege changes
* **System**: device events, service changes
* **Application**: program execution, errors
* **PowerShell**: powershell commands and scriptblocks

{% hint style="info" %}
evtx files are Windows Event Logs files.&#x20;
{% endhint %}

```
Windows Installer (Application Log):

Event ID 1033 - Installation completed successfully
Event ID 1034 - Software removal completed successfully
Event ID 11707 - Installation operation completed successfully
Event ID 11724 - Application removal completed successfully
Event ID 1040 - Beginning of installation process
Event ID 1042 - Beginning of removal process

System Log:

Event ID 19 - Windows Installer reconfigured a product (can indicate installation/update)

Security Log (requires audit policy enabled):

Event ID 4688 - A new process has been created (you can see when setup.exe or installers run)
Event ID 4697 - A service was installed in the system (if the software installs a service)

Application and Services Logs → Microsoft → Windows → Application-Experience:

Event ID 500 - Program inventory updated (shows installed programs)
Event ID 903 - Program installation detected
Event ID 904 - Program updated
```

### Part 1

The first thing we need to check is that the employee installed the installer. There's various Event IDs that are associated with installation. Most of them didn't work until I used the Event ID 1033.&#x20;

{% embed url="<https://learn.microsoft.com/en-us/windows/win32/msi/event-logging>" %}

<figure><img src="/files/8F6p86YfvvkYcBz6ID4T" alt=""><figcaption></figcaption></figure>

This gave us "picoCTF{Ev3nt\_vi3wv3r\_"

### Part 2&#x20;

I tried the Event ID 4688 but that didn't work. I'm guessing that didn't work because it didn't really run a piece of software, it more of it editing something in our system. And in this time I was searching for Event ID, I found this brilliant resource.&#x20;

<https://gist.github.com/githubfoam/69eee155e4edafb2e679fb6ac5ea47d0>

Make sure to bookmark this because this is quite useful!

<figure><img src="/files/IiIddavYzSSYd1wn1Xlh" alt=""><figcaption></figcaption></figure>

Anyways, searching 4657 brings up this page, which includes the flag. This EventID is associated with a registry value being modified, which make sense in this scenario. Additionally, it give us a pretty big hint by the name of the registry, as "Immediate Shutdown" which I didn't even know it was a thing frankly.&#x20;

### Part 3

I found this by searching the Event ID 1074, which is when the system is shutdown by a planned process. (Something like how a registry would done so)&#x20;

<figure><img src="/files/gBGDiopBweIQTj4gUP60" alt=""><figcaption></figcaption></figure>

And after all that, it's solved!&#x20;

***

I think for now, this challenge was easy enough to put aside the more complex tools.

<figure><img src="/files/gZRhvIyEambECJ7rWxa8" alt=""><figcaption></figcaption></figure>

Additionally, if you know what Event ID to look for, it shouldn't be too hard anyways.&#x20;

```
Events starting with 4 are generally security-related auditing events (4688, 4624, 4663, etc.)

Events starting with 5 are often service-related security events (5038, 5056, etc.)

Events starting with 1 often relate to application/installer events (1074 shutdown, 1033 installation)

Events starting with 6 often relate to Event Log service itself (6005, 6006, 6008)
```