# Winevt Logs Analysis | Searching .Evtx Logs For Remote Connections

**URL:** <https://onehack.st/t/winevt-logs-analysis-searching-evtx-logs-for-remote-connections/232746>\
**Category:** Tools & Scripts\
**Tags:** tools, networking, windows\
**Created:** [February 6, 2023, 8:32pm UTC](https://onehack.st/t/winevt-logs-analysis-searching-evtx-logs-for-remote-connections/232746 "2023-02-06T20:32:06Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [February 6, 2023, 8:32pm UTC](https://onehack.st/t/winevt-logs-analysis-searching-evtx-logs-for-remote-connections/232746/1 "2023-02-06T20:32:06Z")

</div>

## Winevt logs analysis (Remote connections)

### Simple script for the purpose of finding remote connections to Windows machine and ideally some public IPs. It checks for some EventIDs regarding remote logins and sessions.

You should **pip install -r requirements.txt** so the script can work and parse some of the .evtx files inside winevt folder.

The **winevt/Logs** folders and the script must have identical file path.

##### Execution Example

[![Image of Spreadsheet](https://github.com/georgi-i/winevt_logs_analysis/raw/main/search.png)](https://github.com/georgi-i/winevt_logs_analysis/blob/main/search.png)

##### Result Example

[![Image of Spreadsheet](https://github.com/georgi-i/winevt_logs_analysis/raw/main/result.png)](https://github.com/georgi-i/winevt_logs_analysis/blob/main/result.png)

## GitHub:

[https://github.com/georgi-i/winevt\_logs\_analysis](https://github.com/georgi-i/winevt_logs_analysis)