Developer ToolsFree referencePDF, Excel, Word exportManufacturing

Windows Security Event ID Reference for Threat Hunting

A small security team cannot read every log line, so the useful question is which event IDs deserve attention. This reference lists the Windows events most often used to catch intrusions, with the reason each matters.

Download:

Event ID	Log	Meaning	Why it matters
1102	Security	The audit log was cleared	Attackers clear logs to hide activity. Alert on every occurrence.
104	System	An event log was cleared	Same intent as 1102 for other logs.
4624	Security	An account logged on successfully	Baseline for lateral movement. Check logon type 3 and 10.
4625	Security	An account failed to log on	Bursts indicate password guessing or spraying.
4634	Security	An account was logged off	Pairs with 4624 to build session length.
4647	Security	User initiated logoff	Interactive session end.
4648	Security	Logon attempted using explicit credentials	Common with runas, remote admin tools and pass-the-hash tooling.
4657	Security	A registry value was modified	Persistence changes. Needs registry auditing enabled.
4663	Security	An attempt was made to access an object	File access on sensitive shares when auditing is enabled.
4672	Security	Special privileges assigned to a new logon	Marks administrator-level logons.
4688	Security	A new process was created	Needs command line auditing for full value.
4697	Security	A service was installed on the system	Common for malware and remote execution tools.
4698	Security	A scheduled task was created	Frequent persistence method.
4699	Security	A scheduled task was deleted	Cleanup after an attack.
4702	Security	A scheduled task was updated	Tampering with existing jobs.
4719	Security	System audit policy was changed	Attackers disable auditing before acting.
4720	Security	A user account was created	Rogue or backdoor accounts.
4722	Security	A user account was enabled	Dormant accounts brought back.
4723	Security	An attempt was made to change an account password	User initiated password change.
4724	Security	An attempt was made to reset an account password	Admin reset. Check who did it.
4725	Security	A user account was disabled	Leaver process evidence.
4726	Security	A user account was deleted	Account removal or cover-up.
4728	Security	A member was added to a security-enabled global group	Watch Domain Admins and similar.
4732	Security	A member was added to a security-enabled local group	Watch local Administrators.
4738	Security	A user account was changed	Flags such as password never expires.
4740	Security	A user account was locked out	Spray or brute force signal.
4756	Security	A member was added to a security-enabled universal group	Privileged group changes.
4768	Security	A Kerberos authentication ticket (TGT) was requested	Baseline for Kerberos activity.
4769	Security	A Kerberos service ticket was requested	Spikes can indicate Kerberoasting.
4771	Security	Kerberos pre-authentication failed	Bad passwords against domain accounts.
4776	Security	The computer attempted to validate credentials (NTLM)	NTLM use should be rare and explainable.
4800	Security	The workstation was locked	Session context for investigations.
4801	Security	The workstation was unlocked	Session context for investigations.
5140	Security	A network share object was accessed	Share access patterns, detects mass enumeration.
5145	Security	A network share object was checked for access	Detailed share and file access, noisy.
6416	Security	A new external device was recognized	USB use on machines and engineering stations.
7045	System	A new service was installed	High value for ransomware and remote tools.
4103	PowerShell/Operational	PowerShell module logging	Pipeline execution details.
4104	PowerShell/Operational	PowerShell script block logging	Captures deobfuscated script content.
1	Sysmon/Operational	Sysmon process creation	Rich process data with hashes and parent.
3	Sysmon/Operational	Sysmon network connection	Process to destination mapping.
11	Sysmon/Operational	Sysmon file created	Dropped payloads and ransom notes.

Many of these events appear only when the matching audit subcategory is enabled by group policy. Test in a lab, size the event log, and forward to a central collector so a compromised host cannot erase the evidence.

Detection set review

Optional review of which events you log and alert on today.

Optional. The tool and every export work without this. No spam.

How to use it

Filter by ID or by phrase such as service, group or cleared. Use the table to decide which audit policies to enable and which events to forward to your SIEM or collector. Start with the handful that are rarely benign: 1102, 104, 4719, 4697, 7045, 4720 and privileged group changes. Add the noisy ones, such as 4624 and 4688, only when you have storage and a use for them.

Alert on 1102 and 104 every time
Alert on new services and scheduled tasks on servers
Review 4728 and 4732 for privileged groups

Make the events exist

Many events are silent by default. Advanced audit policy must enable process creation with command line capture, account management, logon, and policy change subcategories. PowerShell script block logging and Sysmon add depth on hosts that matter, such as ERP and file servers and engineering workstations. Without these settings you have a table of events that never fire.

Plant floor considerations

Engineering workstations, HMI servers and historians often run old Windows versions with small default log sizes. Raise log sizes, forward events off the host and keep a copy outside the plant network where possible. Isolated hosts that cannot forward should have logs collected on a schedule by an approved method.

Common mistakes

Logging everything and alerting on nothing is the main one. A second is alerting on 4625 per event instead of per source and time window, which floods the queue. Count failures per account and source over minutes and alert on thresholds. Finally, do not trust local logs only: ransomware operators clear them.

Frequently Asked Questions

Which event IDs should I alert on first?

Start with cleared logs (1102, 104), audit policy changes (4719), new services (4697, 7045), new accounts (4720) and additions to privileged groups (4728, 4732). They are rare in a healthy environment and high in value.

Why does 4688 show no command line?

Command line capture is off by default. Enable the audit setting that includes command line in process creation events through group policy, then size the log for the volume.

What does logon type 3 or 10 mean in 4624?

Type 3 is a network logon such as a file share, type 10 is remote interactive such as RDP. Unexpected 3 or 10 logons to servers from workstations deserve a look.

Do I need Sysmon?

Not to start. Native events cover a lot. Sysmon adds hashes, parent processes and network connections per process, which helps on the servers and workstations you care about most.

If you want a small, tested detection set for your Windows estate and plant servers, Netray can help build it with your team.

Talk to an Expert Explore More Free Tools

Related Tools

Developer Tools

More Developer Tools tools

See all

Back to All Tools