Open CaledoniaProject opened 1 year ago
Please take a look at this,
package main import ( "flag" "fmt" "log" "github.com/0xrawsec/golang-evtx/evtx" ) func main() { flag.Parse() for _, filename := range flag.Args() { eventFile, err := evtx.OpenDirty(filename) if err != nil { log.Fatal(err) } for event := range eventFile.FastEvents() { if event.EventID() == 7045 { path1 := evtx.Path("/Event/EventData/param1") fmt.Println(event.GetString(&path1)) } } } }
Please take a look at this,