Reading these: most live in the Security log; PowerShell and Sysmon have their own Operational channels (tag on each row). Command-line auditing (4688) and script-block logging (4104) are off by default — if you don't see them, they aren't enabled. Rows flagged in amber are the highest-signal for an intrusion.
Security
Logon & authentication
4624 Successful logonSecurity The one you correlate everything to. LogonType says how (see table).4625 Failed logonSecurity Bursts across accounts = spray; many against one = brute force. Status codes say why it failed.4634 / 4647 LogoffSecurity 4647 is a user-initiated logoff; 4634 is the session ending.4648 Logon with explicit credentialsSecurity RunAs / alternate creds. Common in lateral movement and pass-the-hash.4672 Special privileges assignedSecurity Admin-equivalent logon. Pair with 4624 to spot privileged sessions.4776 NTLM credential validationSecurity · DC The DC validated an NTLM logon. Failures here map password attacks.4768 Kerberos TGT requestedSecurity · DC A logon ticket was issued. Encryption type 0x17 (RC4) can signal downgrade.4769 Kerberos service ticket requestedSecurity · DC Kerberoasting shows here — many 4769s with RC4 for service accounts.4771 Kerberos pre-auth failedSecurity · DC The Kerberos equivalent of a failed password.4964 Special group logonSecurity A member of a watched "special group" logged on.Reference
Logon types (4624 / 4625)
| Type | Means |
|---|---|
| 2 | Interactive — at the keyboard |
| 3 | Network — SMB, shares, most remote auth |
| 4 | Batch — scheduled task |
| 5 | Service — a service starting |
| 7 | Unlock — workstation unlocked |
| Type | Means |
|---|---|
| 8 | NetworkCleartext — creds sent in the clear |
| 9 | NewCredentials — RunAs /netonly |
| 10 | RemoteInteractive — RDP |
| 11 | CachedInteractive — cached domain creds |
Security
Account & group management
4720 User account createdSecurity A new account. Off-hours or on a workstation is a flag.4722 / 4725 Account enabled / disabledSecurity Re-enabling a dormant account is a common persistence move.4723 / 4724 Password change / resetSecurity 4724 is an admin reset of someone else's password.4726 User account deletedSecurity Cleanup, or removing evidence of a created account.4738 User account changedSecurity Attributes modified — watch UAC flag changes (e.g. password-not-required).4740 Account locked outSecurity Lockout — often the tail end of a brute-force.4728 / 4732 / 4756 Added to groupSecurity Global / local / universal. Watch adds to Domain Admins & Administrators.4729 / 4733 / 4757 Removed from groupSecurity The matching removals.Security
Process execution
4688 Process createdSecurity New process with parent and — if command-line auditing is on — the full command line. The core hunting event.4689 Process exitedSecurity Useful for bracketing how long something ran.4696 Primary token assignedSecurity Token manipulation — can accompany privilege abuse.PowerShell channels
PowerShell
Operational channel unless noted. Script-block logging is where obfuscated PowerShell gets decoded.
4104 Script block loggingPowerShell/Operational Decodes the actual script — including -enc base64. The single best PowerShell event.4103 Module / pipeline loggingPowerShell/Operational Command invocation detail with parameters.4105 / 4106 Script start / stopPowerShell/Operational Execution bracketing.400 / 403 Engine start / stopWindows PowerShell Classic log. 400 with HostName=ConsoleHost shows an interactive session.800 Pipeline executionWindows PowerShell Older detail event; useful pre-5.0 where 4104 isn't available.Security · System
Services, tasks & persistence
7045 New service installedSystem A brand-new service. PsExec, Cobalt Strike, and ransomware all leave this.4697 Service installedSecurity The Security-log counterpart to 7045 (needs auditing on).7040 / 7036 Service state / start-typeSystem Start-type changed to Auto, or stop/start — disabling defenses.4698 Scheduled task createdSecurity Task persistence. 4699 deleted, 4700/4701 enabled/disabled, 4702 updated.4657 Registry value modifiedSecurity Autostart (Run keys) and config tampering — if the key is audited.5861 WMI event consumerWMI-Activity/Operational Permanent WMI subscription — a stealthy persistence people forget.Security · System
Log tampering & policy
1102 Security log clearedSecurity Someone wiped the Security log. Almost never legitimate — treat as an incident.104 Log clearedSystem A System or application log was cleared.1100 Event log service shutdownSecurity Logging stopped — a gap you should account for.4719 Audit policy changedSecurity Turning off auditing to go dark.4616 System time changedSecurity Clock changes can be anti-forensic timeline manipulation.4673 / 4674 Privileged service / objectSecurity Sensitive privilege use — noisy, but useful with context.Security
Object access & shares
5140 Network share accessedSecurity A share was accessed. ADMIN$ / C$ access is a lateral-movement tell.5145 Detailed share accessSecurity Per-file share access check — very noisy, very detailed.5142 / 5143 / 5144 Share added / modified / deletedSecurity New shares can be an exfil staging point.4663 Object access attemptedSecurity File/registry access when SACL auditing is set on the object.4660 Object deletedSecurity Pairs with 4663 to show a delete.Defender · Firewall
Defender & firewall
1116 / 1117 Defender detected / actedDefender/Operational Malware found (1116) and the action taken (1117).5001 Real-time protection disabledDefender/Operational AV turned off — a very common pre-attack step.5007 Defender configuration changedDefender/Operational Exclusions added is the classic evasion (watch the path).5156 / 5157 Firewall allowed / blockedSecurity WFP connection decisions — noisy, but maps outbound behavior.Sysmon/Operational
Sysmon
If Sysmon is deployed, these beat the built-in log for process, network, and injection detail.
1 Process createSysmon Like 4688 but with hashes and parent lineage, always on.3 Network connectionSysmon Process-to-connection mapping — C2 and beaconing.7 Image / DLL loadedSysmon DLL side-loading and unsigned module loads.8 CreateRemoteThreadSysmon Classic process injection.10 Process accessSysmon Handle to another process — access to lsass.exe is credential dumping.11 File createSysmon Drops to disk — droppers and staged tools.12 / 13 / 14 RegistrySysmon Key/value create, set, and rename — persistence.15 File stream createdSysmon Alternate data streams and Mark-of-the-Web on downloads.22 DNS querySysmon Per-process DNS — tunneling and C2 domains.25 Process tamperingSysmon Process hollowing / herpaderping.Terminal Services
RDP & remote sessions
1149 RDP authentication succeededRemoteConnectionManager User authenticated to RDP (not necessarily a full logon yet).21 / 25 Session logon / reconnectLocalSessionManager 21 logon, 24 disconnect, 25 reconnect — with source IP.4778 / 4779 Session reconnect / disconnectSecurity The Security-log view of RDP reconnects and disconnects.