Documentation Index
Fetch the complete documentation index at: https://mintlify.com/the-useless-one/pywerview/llms.txt
Use this file to discover all available pages before exploring further.
invoke-eventhunter queries the Windows Security event log on each domain computer via WMI Win32_NTLogEvent to search for logon events and Kerberos TGT requests involving target users. By examining historical event log entries rather than live sessions, it can reveal where a user was recently active even if they are no longer logged in — making it useful for building a timeline of user movement within a domain. The --search-days parameter controls how far back in the logs to look. Like other hunting commands, it supports multi-threading and can target specific hosts or draw the computer list from LDAP.
Event log queries use WMI
Win32_NTLogEvent and require local administrator rights on the target host. Hosts that deny access are automatically skipped. Ensure the Security event log is enabled and appropriately sized on target machines, as small log buffers may not retain events older than a day or two.Flags
Domain Controller Connection
IP address of the domain controller used to enumerate target computers and users via LDAP.
Name of the domain to authenticate with.
Username for authentication.
Password associated with the specified username.
NTLM hashes for pass-the-hash authentication. Format:
[LMHASH:]NTHASH.Use Kerberos authentication. Reads credentials from the
KRB5CCNAME ccache file.Force a TLS connection to the domain controller.
Target Computer Selection
One or more specific hostnames or IPs to search event logs on (space-separated). Skips LDAP computer enumeration when provided.
Path to a file containing hostnames or IPs to query, one per line.
Custom LDAP filter applied when querying computers from the domain controller.
ADS path to use when searching for computers in LDAP.
Domain to query for target machines.
Target User Selection
Search event logs for activity by this specific username.
Name of a domain group whose members to use as target users.
Custom LDAP filter applied when querying target users from the domain controller.
ADS path used when searching for target users in LDAP.
Path to a file containing usernames to search for, one per line.
Use the local administrators of this server as the target user list.
Hunt Behaviour
Number of days back to search the event logs on each host. Default:
3.Number of parallel worker threads to use when querying target hosts. Default:
1.Logging verbosity sent to stderr. Choices:
CRITICAL (default), WARNING, DEBUG, ULTRA.Print results as JSON instead of the default human-readable format.