windows-event-ids

Definition

Related Terms

Examples & Use Cases

**Examples:**

Windows Event ID 4624: An account was successfully logged on which could be used to track legitimate and suspicious access

Windows Event ID 4625: Failed logon which could be used to identify password attacks such as brute-force or password spraying

Windows Event ID 4720/4726: User account creation/deletion could be used to identify rogue accounts that are not normal to an environment

Windows Event ID 4672: Special Privileges assigned which could be used to detect privilege escalation

How it's relevant to security investigations.

Regarding security investigations, Windows Event IDs can be very beneficial and overall advantageous for a plethora of scenarios such as the ones listed below:

**Forensic and Investigative Value**

When an incident occurs for instance, Windows event IDs can be used by security analysts or Security Operation Analysts to reconstruct the sequence of attacker actions which is essential for scoping impact and supporting legal or compliance investigations.

Additionally, Event IDs can help analysts figure out different attack types and phases such as credential attacks, lateral movement, privilege escalation, and persistence because they now have an audit trail of events to use as data.

***Further Reading:***

[CyberDefender's Mastering Windows Event Log Analysis] (Essential Techniques for SOC Analysts: https://cyberdefenders.org/blog/event-log-analysis-for-soc-analysts/)

[HackTheBox's Decoding Windows event logs: A definitive guide for incident responders] (https://www.hackthebox.com/blog/decoding-windows-event-logs-a-definitive-guide-for-incident-responders#:~:text=Windows%20system%20logs:&text=System%20shutdown/restart.,infection%20or%20unauthorized%20user%20access.&text=The%20event%20log%20service%20was,to%20detect%20unauthorized%20system%20reboots.&text=The%20event%20log%20service%20was%20stopped.,disruption%20for%20covering%20illicit%20activities.&text=Windows%20uptime.,unauthorized%20activity%20on%20the%20system.&text=Service%20status%20change.,a%20sign%20of%20system%20tampering.)

[Ultimate IT Security's Windows Security Log Encyclopedia](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/)

[Valency Networks Important Windows Event IDs for SIEM Monitoring] (https://valencynetworks.com/blogs/important-windows-event-ids-for-siem-monitoring/)