Cheat sheet
Windows Event IDs
The event IDs that come up in every investigation. To learn how to use them, see the Windows logs and Sysmon methodology.
CJCADefence
Security log
| ID | Meaning |
|---|---|
| 4624 | Successful logon |
| 4625 | Failed logon |
| 4634 / 4647 | Logoff |
| 4648 | Logon with explicit credentials |
| 4672 | Special privileges assigned to the session (admin account) |
| 4688 | Process creation |
| 4697 | Service installed |
| 4698 | Scheduled task created |
| 4720 | User account created |
| 4726 | User account deleted |
| 4728 | Member added to a global group |
| 4732 | Member added to a local group |
| 4756 | Member added to a universal group |
| 4740 | Account locked out |
| 4768 | Kerberos TGT requested |
| 4769 | Kerberos service ticket requested |
| 4776 | NTLM credential validation |
| 1102 | Audit log cleared |
Other logs
| ID | Log | Meaning |
|---|---|---|
| 7045 | System | New service installed |
| 4103 | PowerShell/Operational | Module Logging: command invocations |
| 4104 | PowerShell/Operational | Script Block Logging: script content |
Logon types (4624 / 4625)
| Type | Meaning |
|---|---|
| 2 | Interactive (keyboard, console) |
| 3 | Network (an SMB share, for instance) |
| 4 | Batch (scheduled task) |
| 5 | Service |
| 7 | Session unlock |
| 8 | NetworkCleartext (password sent in cleartext) |
| 9 | NewCredentials (runas /netonly) |
| 10 | RemoteInteractive (RDP) |
| 11 | CachedInteractive (cached credentials, off the network) |
Sysmon
| ID | Event |
|---|---|
| 1 | Process creation (hash, parent, command line) |
| 3 | Network connection |
| 5 | Process terminated |
| 7 | Image (DLL) loaded |
| 8 | CreateRemoteThread |
| 10 | Process access (e.g. lsass.exe) |
| 11 | File created |
| 12 / 13 / 14 | Registry: create or delete / value set / rename |
| 15 | Alternate data stream (ADS) created |
| 22 | DNS query |