Windows Event Logs for Red Teams

This blog post details a proof-of-concept technique for storing and retrieving binary payloads in Windows Event Logs to achieve fileless execution and potential persistence: it covers Windows Event Log basics, permission and size constraints, creating entries with Write-EventLog (including RawData), extracting and executing payloads with a C# PoC (demonstrating calc.exe and a Metasploit reverse shell), detection observations with Windows Defender, and references to persistence tooling (SharpEventPersist).