← All cheat sheets

WINDOWS SECURITY EVENT IDS

Plain-text reference · 5 KB. Read it, search it (Ctrl-F) or print it.

Key Windows Security log Event IDs for SOC triage. These come from the
Security channel (Security.evtx) unless noted. Event IDs are stable across
modern Windows; the text descriptions are from Microsoft Learn.

Log locations:
  Security : %SystemRoot%\System32\winevt\Logs\Security.evtx
  System   : ...\System.evtx
  Channel  : "Security", "System", "Microsoft-Windows-Sysmon/Operational"

AUTHENTICATION / LOGON#

4624  An account was successfully logged on
      Check: LogonType, TargetUserName, IpAddress, LogonProcessName,
      AuthenticationPackageName. Correlate with 4634/4647 for session end.
4625  An account failed to log on
      Check: Status/SubStatus (failure reason), LogonType, IpAddress.
      Brute force = many 4625 from one source; spray = one pw, many users.
4634  An account was logged off
4647  User initiated logoff (interactive)
4648  A logon was attempted using explicit credentials (runas, lateral move)
      Check: Subject user vs TargetUserName, TargetServerName.
4672  Special privileges assigned to new logon (admin-equivalent logon)
      Fires with SeDebugPrivilege, SeTcbPrivilege etc. High-value accounts.

Failure SubStatus codes (in 4625):
  0xC0000064  user name does not exist
  0xC000006A  bad password
  0xC0000234  account locked out
  0xC0000072  account disabled
  0xC0000070  workstation restriction
  0xC0000193  account expired
  0xC0000071  password expired
  0xC000015B  logon type not granted (e.g. no interactive right)

KERBEROS / NTLM (usually on Domain Controllers)#

4768  Kerberos authentication ticket (TGT) was requested
      Check: TargetUserName, IpAddress, Status, TicketEncryptionType.
      0x17 (RC4) where AES expected can be worth reviewing.
4769  Kerberos service ticket (TGS) was requested
      High volume is normal; review ServiceName + encryption type patterns.
4770  Kerberos service ticket was renewed
4771  Kerberos pre-authentication failed (Status 0x18 = bad password)
4776  Domain controller attempted to validate credentials (NTLM)
      Error 0xC000006A bad pw, 0xC0000064 no such user.

ACCOUNT & GROUP MANAGEMENT#

4720  A user account was created
4722  A user account was enabled
4723  An attempt was made to change an account's password
4724  An attempt was made to reset an account's password
4725  A user account was disabled
4726  A user account was deleted
4738  A user account was changed
4740  A user account was locked out
4767  A user account was unlocked
4728  Member added to a security-enabled GLOBAL group
4729  Member removed from a security-enabled global group
4732  Member added to a security-enabled LOCAL group
      (watch for adds to Administrators / Remote Desktop Users)
4733  Member removed from a security-enabled local group
4756  Member added to a security-enabled UNIVERSAL group

PROCESS / COMMAND-LINE#

4688  A new process has been created
      Enable "Include command line" (GPO: Administrative Templates > System >
      Audit Process Creation) so CommandLine is populated.
      Check: NewProcessName, ParentProcessName, CommandLine, TokenElevation.
4689  A process has exited

SERVICES / SCHEDULED TASKS / PERSISTENCE#

7045  A new service was installed          (System log, not Security)
      Classic lateral-movement / persistence signal (e.g. PsExec-style).
7034/7036 Service crashed / changed state  (System log)
4697  A service was installed in the system (Security log, needs audit on)
4698  A scheduled task was created
4699  A scheduled task was deleted
4700  A scheduled task was enabled
4702  A scheduled task was updated

POLICY / LOG TAMPERING#

1102  The audit log was cleared (Security)   -- high priority
104   The log file was cleared (System)
4719  System audit policy was changed
4717  System security access was granted to an account
4964  Special groups assigned to a new logon

OBJECT / SHARE ACCESS (high volume; enable selectively)#

4663  An attempt was made to access an object (needs SACL)
4656  A handle to an object was requested
5140  A network share object was accessed
5145  A network share object was checked (detailed; shows relative path)
5142/5143/5144 Share added / modified / deleted
4661  A handle to an object (SAM/DS) was requested

FIREWALL / WFP (filtered; enable selectively)#

5156  The Windows Filtering Platform permitted a connection
5157  The Windows Filtering Platform blocked a connection
5152/5153 Packet blocked / restricted by WFP

NOISE vs SIGNAL (triage tips)#

- 4624 LogonType 3 (network) and 4672 are extremely common; filter on
  high-value accounts and off-hours before alerting.
- 4634/4647 pair with 4624 for session duration; do not alert on their own.
- 4769 (TGS) is very high volume on DCs -- baseline before building rules.
- 5156 (WFP allow) can flood a SIEM; usually disabled or heavily filtered.
- 1102 (log cleared), 7045 (new service), 4698 (new task), 4720 (new user),
  4728/4732 (privileged group add), 4648 (explicit creds) deserve alerts.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.