Security Operations Center (SOC) analysts rely heavily on Windows Event Logs to detect threats, investigate incidents, and identify suspicious activity across enterprise environments. Windows Event IDs provide critical visibility into authentication activity, account management, process execution, network communications, and attacker behaviors.
Understanding the most important Event IDs enables analysts to quickly identify indicators of compromise and respond effectively to security incidents.
- Authentication and Account Logon Events
- Account Management Events
- Process Creation and Execution Events
- Object Access and File Monitoring Events
- Windows Firewall and Network Events
- Log Clearing and Anti-Forensic Events
- Defender, Sysmon, and Endpoint Security Events
- RDP and Remote Access Events
- DNS Events
1. Authentication and Account Logon Events
Authentication events are among the most valuable logs for detecting brute-force attacks, credential theft, lateral movement, and privilege escalation attempts.
| Event ID | Description | Security Value |
|---|---|---|
| 4624 | Successful Logon | Establishes normal user behavior and identifies unusual login sources. |
| 4625 | Failed Logon | Detects brute-force and password-spraying attacks. |
| 4634 | Logoff | Helps correlate session activity. |
| 4647 | User-Initiated Logoff | Tracks legitimate logout behavior. |
| 4672 | Special Privileges Assigned | Indicates administrative privilege assignment and possible privilege escalation. |
| 4648 | Logon Using Explicit Credentials | Useful for detecting Pass-the-Hash and Pass-the-Ticket attacks. |
| 4768 | Kerberos TGT Request | Helps identify Kerberoasting activity. |
| 4769 | Kerberos Service Ticket Request | Supports lateral movement investigations. |
| 4776 | NTLM Authentication | Detects NTLM-based attacks and legacy authentication usage. |
SOC analysts often correlate Event IDs 4624, 4625, and 4672 to investigate suspicious authentication patterns.
2. Account Management Events
Attackers frequently manipulate user accounts to maintain persistence or escalate privileges. Monitoring account management events can reveal unauthorized changes before they become major security incidents.
| Event ID | Description |
|---|---|
| 4720 | User account created |
| 4722 | User account enabled |
| 4723 | Password change attempt |
| 4724 | Password reset by administrator |
| 4725 | User account disabled |
| 4726 | User account deleted |
| 4732 | User added to security group |
| 4733 | User removed from security group |
| 4756 | User added to global security group |
| 4781 | Account name changed |
These events are particularly useful for detecting rogue account creation, privilege escalation, insider threats, and attacker attempts to disguise identities.
3. Process Creation and Execution Events
Process monitoring is a cornerstone of endpoint detection and response. Malware, ransomware, and other malicious tools often leave traces through process execution logs.
| Event ID | Description | Security Relevance |
|---|---|---|
| 4688 | Process Creation | Essential for malware detection and parent-child process analysis. |
| 4689 | Process Exit | Correlates process lifecycles with Event 4688. |
| 4697 | Service Installed | Persistence mechanism often used by attackers. |
| 7045 | Service Installed (System Log) | Common malware persistence indicator. |
| 4698 | Scheduled Task Created | Detects persistence techniques mapped to MITRE ATT&CK T1053. |
| 4699 | Scheduled Task Deleted | Indicates cleanup or anti-forensic actions. |
Event ID 4688 is considered one of the most important Windows logging events because it provides visibility into process execution across endpoints.
4. Object Access and File Monitoring Events
File and object access events help detect ransomware, data theft, insider threats, and unauthorized access to sensitive information.
| Event ID | Description |
|---|---|
| 4663 | File or folder access |
| 4656 | Object handle requested |
| 4658 | Object handle closed |
| 4660 | Object deleted |
| 5145 | SMB file share access |
Monitoring these events can help identify suspicious file modification, mass file access patterns, and potential exfiltration attempts.
5. Windows Firewall and Network Events
Network-related logs provide valuable visibility into malware communications, lateral movement, and reconnaissance activities.
| Event ID | Description |
|---|---|
| 5156 | Allowed outbound network connection |
| 5157 | Blocked connection |
| 5158 | UDP bind operation |
| 5152 | Blocked packets |
SOC teams commonly analyze these events to identify command-and-control (C2) communications and network scanning attempts.
6. Log Clearing and Anti-Forensic Events
One of the strongest indicators of malicious activity is an attacker attempting to erase evidence. These events should be treated with high priority.
| Event ID | Description |
|---|---|
| 1102 | Security log cleared |
| 104 | System audit log cleared |
| 4719 | Audit policy changed |
Event ID 1102 is especially critical because clearing security logs is typically associated with anti-forensic activity and compromise attempts.
7. Defender, Sysmon, and Endpoint Security Events
Windows Defender Events
| Event ID | Description |
|---|---|
| 1116 | Malware detected |
| 1117 | Malware blocked or remediated |
| 5007 | Defender settings changed |
Unexpected modifications to Defender settings may indicate security tool tampering by an attacker.
Sysmon Events
Sysmon provides richer telemetry than standard Windows logs and is highly recommended for advanced threat detection.
| Sysmon ID | Description |
|---|---|
| 1 | Process creation |
| 3 | Network connection |
| 7 | DLL loading |
| 8 | Process injection |
| 11 | File creation |
| 22 | DNS query |
| 23 | File deletion |
These events significantly improve visibility into endpoint attacks and advanced threat behaviors.
8. RDP and Remote Access Events
Remote Desktop Protocol (RDP) is a frequent target for attackers seeking lateral movement opportunities within a network. Monitoring these events helps identify unauthorized remote access.
| Event ID | Description |
|---|---|
| 4624 (Logon Type 10/7) | Remote logon |
| 4778 | RDP session reconnected |
| 4779 | RDP session disconnected |
| 4648 | Explicit credentials used |
These logs are particularly valuable during ransomware investigations and lateral movement analysis.
9. DNS Events
DNS activity often reveals early indicators of compromise, command-and-control communications, and malicious domain lookups.
Key monitoring areas include:
- DNS query activity associated with Event ID 5156 network traffic.
- DNS Server 22xx series events for domain lookup monitoring.
- Suspicious domains, beaconing behavior, and data exfiltration attempts through DNS channels.
Conclusion
For SOC analysts, mastering Windows Event IDs is fundamental to effective threat detection and incident response. While hundreds of Windows events exist, focusing on authentication events (4624, 4625, 4672), process creation (4688), account changes (4720-4781), network activity (5156, 5157), anti-forensic indicators (1102), and enhanced Sysmon telemetry provides the strongest foundation for detecting modern cyber threats.
By integrating these Event IDs into SIEM alerts, detection rules, and threat-hunting workflows, security teams can significantly improve visibility and reduce response times.
