Windows Event IDs Every SOC Analyst Should Know

Most investigations in a Windows environment come down to a handful of event IDs. Knowing them by heart lets you write searches quickly, read an alert without looking things up and explain a timeline in an interview. These are the ones we teach first.

Logons and Authentication

• 4624: an account logged on successfully. The logon type matters: 2 is interactive at the keyboard, 3 is network (such as file shares), 10 is remote desktop
• 4625: a logon failed. Many in a short time from one source suggests password guessing; one password tried against many accounts suggests spraying
• 4634 and 4647: logoff
• 4648: a logon with explicitly supplied credentials, often seen with "run as" and some lateral movement tools
• 4672: special privileges assigned to a new logon, which flags administrator-level sessions
• 4768, 4769 and 4771: Kerberos ticket requests and pre-authentication failures on domain controllers; unusual 4769 patterns can point to Kerberoasting
• 4776: NTLM credential validation on a domain controller

Account and Group Changes

• 4720: a user account was created
• 4722 and 4725: an account was enabled or disabled
• 4723 and 4724: a password change or reset was attempted
• 4728, 4732 and 4756: a member was added to a security group (global, local and universal). Additions to Domain Admins or local Administrators deserve attention
• 4740: an account was locked out

Processes, Services and Tasks

• 4688: a new process was created. Turn on command-line logging, or the most useful detail is missing
• 7045 (System log): a new service was installed, a common persistence and lateral movement trace
• 4697: a service was installed (Security log version)
• 4698: a scheduled task was created

Signs of Tampering

• 1102: the Security audit log was cleared. Rarely legitimate outside planned maintenance
• 4719: the audit policy was changed

PowerShell

With script block logging enabled, 4104 in the PowerShell Operational log records the code that ran, including code that was encoded or obfuscated when it was launched. It is one of the most valuable logs on a Windows machine.

Sysmon Events

Microsoft's free Sysmon tool adds detail that default logging misses. The most used:

• 1: process creation with full command line, hashes and parent process
• 3: network connection, with the process that made it
• 7: image (DLL) loaded
• 10: process access, for example a tool reading the memory of LSASS to steal credentials
• 11: file created
• 13: registry value set
• 22: DNS query, with the process that made it

Put Them to Work

Event IDs only help if the logging is turned on and collected centrally. In a lab, enable command-line process auditing and PowerShell logging, install Sysmon, send everything to Splunk or Wazuh, then run an attack from Kali and find each step. See our home lab guide and Splunk search basics.

Learning SOC Investigation

Our SOC analyst, Splunk, Wazuh and DFIR course teaches these logs hands-on, with Sysmon telemetry, Sigma detections and investigations of attacks you ran yourself in the earlier courses.