Windows Event IDs That Every Cybersecurity Analyst MUST Know

7 min readAug 13, 2024

Introduction

In the world of cybersecurity, staying ahead of potential threats is crucial. One of the best ways to do this is by keeping a close eye on Windows Event IDs. These event IDs are like digital breadcrumbs, providing valuable informations about what’s happening on your system. Whether you’re new to the field or a seasoned pro, knowing which Event IDs to monitor can make a big difference in how effectively you can protect your environment.

Here’s a rundown of some of the most important Windows Event IDs that every cybersecurity analyst should be familiar with:

1- Event ID 1116 — Antivirus Malware Detection

This event is particularly important because it logs when Defender detects a malware. A surge in these events could indicate a targeted attack or widespread malware infection.

CopyMicrosoft Defender Antivirus has detected malware or Other potentially unwanted software.

   Name: HackTool:Win32/MimikatzD
   ID: 2147729891
   Severity: High
   Cateqory: Tool
   Path: file:
   Detection Oriqin: Local machine
   Detection Type: Concrete
   Detection Source: Real-Time Protection
   User KNOWLEDGEBASE\brs
   Process Name: C:\Windows\explorer.exe
   Security intelligence Version: AV: 1.329.963.0 AS: 1.329.963.0, NIS: 1.329.963.0
   Engine Version: AM: 1.1.17700.4, NIS: 1.1.17700.4

2- Event ID 4624 — Successful Account Logon

This log helps you track who’s accessing the system and when. Monitoring these logins is key for spotting unusual access patterns that might indicate unauthorized activity.

CopyThe account login was successful.

Object :
 Security ID: System
 Account name: Example$
 Account domain: WORKGROUP
 Login ID: 0x3A6Login information:
 Login type: 5
 Restricted administrator mode: -
 Remote Credential Guard: -
 Virtual account: No
 High Token: YesImpersonation Level: ImpersonationNew login:
 Security ID: System
 Account Name: System
 Account domain: NT AUTHORITY
 Login ID: 0x868
 Linked Logon ID: 0x8
 Network account name: -
 Network Account Domain:-
 Logon GUID: {00000-0000-0000-0000-00}Process information:
 Process ID: 0x895j
 Process name: C:\Windows\System32\services.exe
Detailed authentication information:
 Login process: **** 
 Authentication package: Negotiate
 Services in transit:-
 Package name (NTLM only): -
 Key length: 0This event is generated when a logon is created. It is generated on the computer where the logon was performed.

3- Event ID 4625 — Failed Account Logon

Failed login attempts are captured by Event ID 4625. These logs are vital for identifying potential brute-force attacks or unauthorized access attempts. By keeping an eye on these events, you can spot suspicious behavior early and take action before things escalate.

CopyFailed to log in to an account.

Subject :
 Security ID: System
 Account name: Example$
 Account Area: WORKING GROUP
 Login ID: 0x3A1Login type: 2Account for which login failed:
 Security ID: NULL SID
 Account name: Gamer
 Account domain: ExampleFailure information:
 Failure reason: Unknown username or incorrect password.
 Status: 0xC000006D
 Substate: 0xC000006AProcess information:
 Caller process ID: ***
 Caller process name: C:\Windows\System32\svchost.exeDetailed authentication information:
 Login process: User32 
 Authentication Package: Negotiate
 Services in transit:-
 Package name (NTLM only): -
 Key length: 0This event is generated when a logon request fails. It is generated on the computer on which access was attempted.

Failure Information: Sub Status and Status code explain the failure reason in this case we have the code “0xC000006A” indicate that the user name is correct but the password is wrong.

Here is a table show all the failure reasons code:

These codes are typically generated by Windows operating systems when a user fails to log in. They offer valuable information to help troubleshoot and resolve login issues.

4- Event ID 4672 — Special Privileges Assigned to New Logon

When a user is granted special privileges, Event ID 4672 is logged. This event is crucial for spotting privilege escalation, which could be a sign of an attacker gaining elevated access. Regularly checking these logs helps ensure that privilege changes are legitimate.

CopyPrivilèges spéciaux attribués à la nouvelle ouverture de session.

Sujet :
 ID de sécurité :  Example\Gamer
 Nom du compte :  Gamer
 Domaine du compte :  Example
 ID d'ouverture de session :  0x1****Privilèges :  SeSecurityPrivilege
   SeTakeOwnershipPrivilege
   SeLoadDriverPrivilege
   SeBackupPrivilege
   SeRestorePrivilege
   SeDebugPrivilege

5- Event ID 4688 — New Process Creation

Event ID 4688 records the creation of new processes. This is important for identifying suspicious or unauthorized applications that might be running on your system. Keeping track of process creation helps in spotting potential threats early.

CopyA new process has been created.

Creator Subject:
    Security ID:        Système
    Account Name:        -
    Account Domain:        -
    Logon ID:        0x3**Target Subject:
    Security ID:        NULL SID
    Account Name:        -
    Account Domain:        -
    Logon ID:        0x**Process Information:
    New Process ID:        0x***
    New Process Name:    C:\Windows\System32\smss.exe
    Token Elevation Type:    ****
    Mandatory Label:        Étiquette obligatoire\Niveau obligatoire système
    Creator Process ID:    0x**
    Creator Process Name:
    Process Command Line:Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

6- Event ID 4689 — Process Termination

When a process is terminated, Event ID 4689 is triggered. This helps you understand the lifecycle of processes and can be useful for correlating with process creation events. It’s another piece of the puzzle in monitoring system activity.

CopyA process has exited.

Subject:   Security ID:  Example\Gamer
   Account Name:  Gamer
   Account Domain:  WIN-R9H529RIO4Y
   Logon ID:  0x1**Process Information:   Process ID: 0x**
   Process Name: C:\Windows\System32\notepad.exe
   Exit Status: 0x0

7- Event ID 4720 — User Account Created

Event ID 4720 logs the creation of new user accounts. This is crucial for monitoring who’s being added to your system and ensuring that account creation follows your organization’s policies. Unexpected new accounts could be a red flag.

CopyA user account was created.

Subject:
   Security ID:  ACME-FR\administrator
   Account Name:  administrator
   Account Domain:  ACME-FR
   Logon ID:  0x20f9dNew Account:
   Security ID:  ACME-FR\John.Locke
   Account Name:  John.Locke
   Account Domain:  ACME-FRAttributes:
   SAM Account Name: John.Locke
   Display Name:  John Locke
   User Principal Name: John.Locke@acme-fr.local
   Home Directory:  -
   Home Drive:  -
   Script Path:  -
   Profile Path:  -
   User Workstations: -
   Password Last Set: <never>
   Account Expires:  <never>
   Primary Group ID: 513
   Allowed To Delegate To: -
   Old UAC Value:  0x0
   New UAC Value:  0x15
   User Account Control:
    Account Disabled
    'Password Not Required' - Enabled
    'Normal Account' - Enabled
   User Parameters: -
   SID History:  -
   Logon Hours:  <value not set>Additional Information:
   Privileges  -

8- Event ID 4726 — User Account Deleted

When a user account is deleted, Event ID 4726 is recorded. This helps you track changes to user accounts and spot any potentially malicious deletions. Monitoring these events ensures that account management is done securely.

CopyA user account was deleted.

Subject:
   Security ID:  WIN-R9H529RIO4Y\Administrator
   Account Name:  Administrator
   Account Domain:  WIN-R9H529RIO4Y
   Logon ID:  0x1fd23Target Account:
  Security ID:  WIN-R9H529RIO4Y\bob
  Account Name:  bob
  Account Domain:  WIN-R9H529RIO4YAdditional Information:
   Privileges -

9- Event ID 4732 — A Member Was Added to a Security-Enabled Local Group

This event logs when a user is added to a security group with elevated privileges. It’s important for monitoring changes in user permissions and preventing unauthorized privilege escalation.

CopyA member was added to a security-enabled local group.

Subject:
   Security ID:  WIN-R9H529RIO4Y\Administrator
   Account Name:  Administrator
   Account Domain:  WIN-R9H529RIO4Y
   Logon ID:  0x1fd47Member:
   Security ID:  WIN-R9H529RIO4Y\bob
   Account Name:  -Group:
   Security ID:  BUILTIN\Users
   Group Name:  Users
   Group Domain:  BuiltinAdditional Information:
   Privileges:  -
   Expiration time:  -

10- Event ID 4771 — Kerberos pre-authentication failed

This event is similar to 4625 (failed logon) but specifically for Kerberos authentication. An unusual amount of these logs could indicate an attacker attempting to brute force your Kerberos service.

CopyKerberos pre-authentication failed.

Account Information:
   Security ID:  ACME\administrator
   Account Name:  AdministratorService Information:
   Service Name:  krbtgt/acmeNetwork Information:
   Client Address:  ::ffff:10.42.42.224
   Client Port:  50950Additional Information:
   Ticket Options:  0x40810010
   Failure Code:  0x18
   Pre-Authentication Type: 2Certificate Information:
   Certificate Issuer Name: 
   Certificate Serial Number: 
   Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication.

Also this event have her own failure code like event ID 4625

There are more codes check this link

11- Event ID 5001 — Antivirus real-time protection configuration has changed

This event indicates that the real-time protection settings of Defender have been modified. Unauthorized changes could indicate an attempt to disable or undermine the functionality of Defender.

12- Event ID 5140 — Network Share Access

Event ID 5140 records access to network shares. This is useful for detecting unauthorized file access or data breaches. By monitoring network share access, you can ensure that file sharing practices are secure.

CopyA network share object was accessed.

Subject:
   Security ID:  ACME-FR\Administrator
   Account Name:  Administrator
   Account Domain:  ACME-FR
   Logon ID:  0x78a731Network Information:
   Source Address:  10.42.52.156
   Source Port:  64077Share Name:   \\*\Dharma Initiative Protocols

13- Event ID 5156 — Windows Filtering Platform (WFP) Allow Network Connection

This event captures network connections allowed by the Windows Filtering Platform. It helps you identify unusual or unauthorized network traffic, which is crucial for maintaining network security.

CopyThe Windows Filtering Platform has allowed a connection.

Application Information:
   Process ID:  1752
   Application Name: \device\harddiskvolume1\windows\system32\dns.exeNetwork Information:
   Direction:  Inbound
   Source Address:  10.45.45.103
   Source Port:  53
   Destination Address: 10.45.45.103
   Destination Port:  50146
   Protocol:  17Filter Information:
   Filter Run-Time ID: 5
   Layer Name:  Receive/Accept
   Layer Run-Time ID: 44

14- Event ID 5158 — The Windows Filtering Platform has permitted a bind to a local port

When the WFP blocks a network connection, Event ID 5158 is generated. This helps you understand which network traffic is being blocked and troubleshoot any potential security issues.

CopyThe Windows Filtering Platform has permitted a bind to a local port.

Application Information:
   Process ID:  4
   Application Name: SystemNetwork Information:
   Source Address:  ::
   Source Port:  3389
   Protocol:  6Filter Information:
   Filter Run-Time ID: 0
   Layer Name:  Resource Assignment
   Layer Run-Time ID: 38

15- Event ID 7045 — A service was installed in the system

A sudden appearance of unknown services might suggest malware installation, as many types of malware install themselves as services.

CopyA service was installed in the system.
Subject:
   Security ID: SYSTEM
   Account Name: WIN-GG82ULGC9GOS
   Account Domain: CONTOSO
   Logon ID: 0x3E7
Service Information:
   Service Name: W3SVC
   Service File Name: %windir%\system32\svchost.exe -k iissvcs
   Service Type: 0x20
   Service Start Type: 2
   Service Account: localSystem

These Event IDs provide critical insights into user activities, system changes, and potential security threats, helping analysts maintain a robust security posture.

Conclusion

Understanding Windows Event IDs is key to staying ahead in cybersecurity. By keeping track of these essential logs, you can spot suspicious activity, track user actions, and respond quickly to potential threats. Mastering these Event IDs not only helps you react to incidents but also strengthens your overall security strategy. Stay vigilant and use these insights to keep your systems secure and your organization protected.