Tolkien Ring - Windows Event Logs walkthrough
"Investigate the Windows event log mystery in the terminal or offline. Get hints for this challenge by typing hint in the upper panel of the Windows Event Logs terminal." Difficulty Rating: 2/5 Advancing to the next stage of the challenge after wireshark practice challenge, we talk to Dusty Giftwrap and we access a terminal called “Windows Event Logs”, We are provided with powershell.evtx.log file that contains all the logs captured between 13-12-2022 23:12:29.956579 till 24-12-2022 18:44:53.874228, within which claims to be an attack happened and we will analyse. For ease of analysis, have personally converted the log file into xml 1. What is the date of when the attack took place ? 24/12/2022 PowerShell strict mode has been turned off as a first activity and more activities are seen on the 24th, which can be identified as your perform a visual grep through the logs or even a head command on the powershell.evtx.log file, given windows logs are in reverse chronological or...