The following code is for security research and authorized testing only.
python
import win32evtlog
import sys
def check_logs():
# """Function to read Windows Event Logs for sensitive data"""
server = None # Local machine
logtype = "System" # Could also be Application, Security
try:
hand = win32evtlog.OpenEventLog(server, logtype)
flags = win32evtlog.EVENTLOG_BACKWARDS_READ | win32evtlog.EVENTLOG_SEQUENTIAL_READ
total = 0
while True:
events = win32evtlog.ReadEventLog(hand, flags, 0)
if not events:
break
for event in events:
# Extract event data strings
if event.StringInserts:
data = " ".join(event.StringInserts)
# Check for keywords indicating sensitive info (Simulation)
if "password" in data.lower() or "token" in data.lower():
print(f"[!] Potential Sensitive Data found in Event ID {event.EventID}: {data}")
total += 1
win32evtlog.CloseEventLog(hand)
if total == 0:
print("[*] No obvious sensitive data found in this run.")
except Exception as e:
print(f"[-] Error: {e}")
if __name__ == "__main__":
check_logs()