windows-event-logs-analysis

Windows Event Logs Analysis

When to Use

• When responding to a security incident involving compromised Windows systems.
• When performing threat hunting across Active Directory environments for signs of lateral movement.
• When conducting post-breach forensic analysis to reconstruct attacker activity timeline.
• When investigating suspected credential theft (Pass-the-Hash, Kerberoasting, DCSync).
• When analyzing persistence mechanisms (services, scheduled tasks, WMI subscriptions).

When NOT to use: For Linux/macOS log analysis, use appropriate syslog/auditd skills. For memory forensics, use volatility-memory-forensics.

Prerequisites

• Access to Windows Event Log files (.evtx) — either live system or acquired forensic images
• Chainsaw, Hayabusa, or EvtxECmd for automated parsing
• Sigma rules repository for threat detection
• PowerShell 5.1+ for manual investigation
• Sysmon installed (recommended for enhanced logging)

Workflow

Phase 1: Understanding Critical Event IDs

# === AUTHENTICATION EVENTS (Security.evtx) ===
Event ID 4624 — Successful Logon
  Logon Type 2:  Interactive (physical keyboard/KVM)
  Logon Type 3:  Network (SMB share access, PSExec, WMI)
  Logon Type 7:  Unlock (screen unlock)
  Logon Type 9:  NewCredentials (RunAs /netonly — creds used for remote access)
  Logon Type 10: RemoteInteractive (RDP)

Event ID 4625 — Failed Logon (brute force indicator)
  Watch for: Multiple 4625 followed by 4624 = successful brute force

Event ID 4648 — Explicit Credential Logon (RunAs, PassTheHash indicator)

Event ID 4672 — Special Privileges Assigned (admin/SYSTEM logon)
  Alert: When unexpected users receive SeDebugPrivilege, SeTcbPrivilege

Event ID 4776 — NTLM Authentication (local SAM validation)
  Watch for: "Error Code: 0xC0000064" = username doesn't exist
  Watch for: "Error Code: 0xC000006A" = bad password

# === KERBEROS EVENTS (Security.evtx) ===
Event ID 4768 — TGT Request (AS-REQ)
  AS-REProast indicator: Encryption type 0x17 (RC4) for accounts with SPN

Event ID 4769 — Service Ticket Request (TGS-REQ)
  Kerberoasting indicator: Encryption type 0x17 (RC4) targeting service accounts

Event ID 4771 — Kerberos Pre-Auth Failed
  Password spray indicator: Multiple failures across different accounts

# === PROCESS & EXECUTION EVENTS ===
Event ID 4688 — New Process Created (Security.evtx)
  Enable "Include command line in process creation events" GPO
  Watch for: powershell.exe -enc, cmd.exe /c, wmic, certutil, bitsadmin

Sysmon Event ID 1 — Process Creation (detailed command line + hashes)
  Gold standard for process tracking — includes ParentImage, Hashes, User

# === LATERAL MOVEMENT INDICATORS ===
Event ID 7045 — New Service Installed (System.evtx)
  PSExec indicator: Service name "PSEXESVC" with ImagePath pointing to remote executable
  Watch for: Services with random names, Base64 in service paths

Event ID 5140 — Network Share Accessed (Security.evtx)
  Watch for: \\*\ADMIN$, \\*\C$, \\*\IPC$ access from unexpected sources

Event ID 5145 — Network Share Object Access (detailed file-level access)

# === PERSISTENCE INDICATORS ===
Event ID 4698 — Scheduled Task Created (Security.evtx)
Event ID 4699 — Scheduled Task Deleted
Sysmon Event ID 19/20/21 — WMI Event Filter/Consumer/Binding created
Event ID 7040 — Service startup type changed (auto-start persistence)

# === POWERSHELL LOGGING ===
Event ID 4104 — Script Block Logging (PowerShell/Operational)
  Captures deobfuscated script content — PRIMARY forensic source
Event ID 4103 — Module Logging
Event ID 400/403 — PowerShell engine start/stop