Stop 03 · Linux & Windows FundamentalsTopics · 6/10

Windows Event Logs

In short

Windows quietly writes down logins, new accounts, new processes and much more. Knowing a handful of event IDs lets you rebuild what happened on a machine, minute by minute.

Windows records detailed logs of system, security and application events — knowing which event IDs matter (failed logins, process creation) is essential for both investigation and threat hunting.

The blob flips through a thick visitor register at a reception desk below a CCTV camera.

Think of it like this

The building's visitor register

Every visitor signs in with a name and time, and the guard notes anything odd. If something goes missing, you open the register and trace who came and went. Windows event logs are that register, written automatically for every action.

Watch it happen

Event IDs every analyst should know

4624

4625

4688

4720

4732

1102

1/5These live in the Security log. Each event ID always means the same kind of action.

The big ideas

What you need to know

Three main logs

Security, System and Application. Security is where logins and account changes live.

Logon types tell the story

Event 4624 includes a logon type: 2 is at the keyboard, 3 is over the network, 10 is Remote Desktop.

Some logging is off by default

Process command lines and PowerShell script logging must be turned on with Group Policy.

Ship logs off the machine

Attackers can clear local logs. Forwarding them to a SIEM keeps a copy they can't reach.

See it in code

Walk through the code

powershell

1# PowerShell (run as admin on your own VM)2# Last 20 failed logons3Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 |4  Select-Object TimeCreated, Message5 6# Was the Security log ever cleared?7Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} -ErrorAction SilentlyContinue

1/2Fetch the 20 newest failed logons and show when each happened and the details.

FilterHashtable filters on the machine itself, which is much faster than fetching every event and filtering afterwards.

Save yourself the pain

Common mistakes

Oops

Only looking at failed logins.

Do this instead

Successful logins after many failures, or at odd hours, are often more important than the failures.

Oops

Keeping logs only on each laptop.

Do this instead

Forward them centrally and keep them long enough for investigations. Many teams aim for months, not days.

Your mission

Make and find your own events

~25 min

Quick check

You see 50 events with ID 4625 for one account, then one 4624 from the same IP. What likely happened?

Go deeper

1Explore Windows Event Viewer on a practice VM and identify security-relevant event logs.
2Learn a few high-value event IDs (like 4625 for failed logon) and what they indicate.
3Practice filtering logs for a specific event type or time range.