Listen to this Post
Introduction:
Your SIEM is drowning in noise—millions of events pour in daily, yet most intrusions announce themselves in the Windows Security log long before the ransom note appears. The problem isn’t a lack of data; it’s that analysts were never taught which event IDs actually matter. Attackers generate countless events, but they only need you to miss the 15 critical signals that reveal an attack in progress.
Learning Objectives:
- Master the 15 Windows Security Event IDs that consistently indicate active intrusion attempts
- Build SIEM queries and detection rules to filter signal from noise
- Implement GPO and PowerShell configurations to enable command-line and script-block logging
- Develop threat-hunting workflows for lateral movement, privilege escalation, and defense evasion
- Getting In: Authentication Anomalies That Signal Initial Access
Attackers don’t break in—they log in. The first phase of any intrusion involves gaining legitimate credentials and using them to access systems. These three event IDs reveal that moment of entry.
Event 4624 — Successful Logon (Logon Type 10) : A successful logon is normal; a successful remote logon at 3 AM from an account that never uses RDP is not. Logon Type 10 indicates an interactive Remote Desktop Protocol (RDP) session. When you see this event from a non-administrative account or from an IP address outside your normal business hours, treat it as suspicious. Review the Source Network Address field to identify the remote client. This event requires the `Audit Logon` policy setting to be enabled within Logon/Logoff.
Event 4625 — Failed Logon: One failed login is a typo. Hundreds from the same IP across multiple accounts is a password spray or brute-force attack. This event logs every failed authentication attempt and is critical for detecting credential-stuffing campaigns. Monitor for rapid spikes from single source IPs targeting diverse usernames. Windows Event Forwarding must be configured to send these Security logs to your SIEM.
Event 4648 — Explicit Credential Logon: This event fires when a process attempts a logon by explicitly specifying credentials—the classic `runas` pattern. Attackers use this to run commands with alternate credentials on remote hosts. When you see `cmd.exe` or `powershell.exe` triggering 4648 events, investigate immediately. This pattern often indicates password-spraying attacks where an adversary attempts to gain initial access or elevate privileges within Active Directory.
Detection Query (Splunk):
index=windows EventCode=4624 LogonType=10 | stats count by Account_Name, Source_Network_Address, _time | where count > 3 AND hour(_time) BETWEEN 0 AND 5
2. Taking Over: Privilege Escalation and Account Manipulation
Once inside, attackers move quickly to gain administrative control. These events expose their privilege-grabbing tactics.
Event 4672 — Special Privileges Assigned: This event indicates a logon session received sensitive privileges like `SeSecurityPrivilege` or SeBackupPrivilege. While SYSTEM accounts routinely trigger this event，human accounts receiving special privileges outside normal administrative hours demand immediate attention. A single user authenticating with special privileges across 30 or more endpoints within five minutes suggests lateral movement or remote code execution. Enable the `Audit Special Logon` policy within Logon/Logoff to capture these events.
Event 4720 — User Account Created: New accounts created outside IT hours are a major red flag. This event logs every local or domain user account creation. Attackers create backdoor accounts to maintain persistence. Always log the account that performed the creation (Domain, username, and Logon ID).
Event 4732 — Member Added to Security-Enabled Local Group: When a newly created account is added to the Domain Admins or Administrators group within minutes of creation, you’re watching an attacker establish dominance. This event, combined with 4720, forms a clear kill-chain indicator. Query for 4720 events followed closely by 4732 events on the same account name.
Detection Query (Splunk):
index=windows (EventCode=4720 OR EventCode=4732) | transaction Account_Name maxspan=5m | where EventCode=4720 AND EventCode=4732
3. Digging In: Execution and Persistence Mechanisms
With privileges secured, attackers install backdoors, schedule tasks, and execute malicious code. These events expose their foothold.
Event 4688 — Process Creation (with Command Line): This is your window into what attackers are actually running. By itself, 4688 tells you a process started. With command-line auditing enabled, it tells you exactly what they typed. Enable “Include command line in process creation events” via GPO. Navigate to: Computer Configuration > Policies > Administrative Templates > System > Audit Process Creation. Without this, you’re logging blind—Office applications spawning `cmd.exe` or `powershell.exe` becomes visible only with command-line data. This event also logs SHA1/SHA2 hashes of the executable when AppLocker is configured.
GPO Configuration for Command-Line Auditing:
1. Open Group Policy Management Console
- Navigate to `Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Detailed Tracking`
3. Enable `Audit Process Creation`
- Enable `Include command line in process creation events`
Event 7045 — Service Installation: A new service with a random name running from `C:\Windows\Temp\` or `C:\Users\Public\` is almost certainly malicious. This event logs the service name, binary path, service type, and start type. Attackers use service installations for persistence—Sliver C2 implants, for example, create services with randomly generated 10-character names in the temp folder. Monitor ImagePath fields containing
\Temp\,\AppData\, or\\\\.\\pipe.
Event 4698 — Scheduled Task Creation: Scheduled tasks are a favorite persistence mechanism. This event logs every task creation. Attackers use them to launch one-liners with PowerShell, Cmd, Wscript, or Cscript. High-entropy, randomly generated task names are a strong indicator of malicious activity. Enable auditing of scheduled task creation via the Security log.
Detection Query (Splunk) for Suspicious Service Paths:
index=windows EventCode=7045 | where ImagePath LIKE "%\Temp\%" OR ImagePath LIKE "%\Users\Public\%"
4. Covering Tracks: Defense Evasion and Log Tampering
Before executing their final payload, sophisticated attackers disable your visibility. These events tell you when they’re trying to go dark.
Event 1102 — Audit Log Cleared: Treat this as hostile until proven otherwise. Attackers clear the Security log using wevtutil, PowerShell, or direct deletion of .evtx files. When you see 1102, you’ve lost historical visibility—but you’ve also caught the attacker in the act. Investigate who cleared the log and what preceded the clearing.
PowerShell Script to Detect Log Clearing:
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=1102} |
Select-Object TimeCreated, Message |
Export-Csv -Path "LogClearedEvents.csv" -1oTypeInformation
Event 4719 — System Audit Policy Changed: This event signals that someone has disabled success or failure auditing for critical categories. Attackers turn off the “cameras” before they act. Monitor for changes that remove auditing from Logon/Logoff, Process Creation, or Policy Change categories. This event has low volume in normal environments—any occurrence warrants investigation.
Event 4104 — PowerShell Script Block Logging: When enabled, PowerShell logs every script block it processes to the `Microsoft-Windows-PowerShell/Operational` log. This is how you catch Base64-encoded payloads and obfuscated one-liners. Enable Script Block Logging via GPO or PowerShell. Large scripts may be split across multiple 4104 events—reconstruct the full script by concatenating events with the same ScriptBlock ID.
Enable PowerShell Script Block Logging:
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -1ame "EnableScriptBlockLogging" -Value 1
5. Moving Sideways: Lateral Movement and Credential Theft
Attackers don’t stay on one machine. These events expose their movement across your network.
Event 5145 — Network Share Object Accessed: When one workstation touches `ADMIN$` across the fleet, you’re watching lateral movement in progress. This event logs network share access and can detect SMB relay attacks like PetitPotam (CVE-2021-36942). Monitor for executable files being written to administrative shares (C$, ADMIN$, IPC$).
Event 4769 — Kerberos Service Ticket Requested (RC4): Kerberoasting attacks request service tickets for domain accounts using RC4 encryption because these tickets are easier to crack offline. In modern environments, all Kerberos authentication should use AES cipher suites. A surge in 4769 events with RC4 encryption indicates an attacker is harvesting service account hashes.
Event 4776 — NTLM Authentication: NTLM is older and weaker than Kerberos. Spikes in 4776 events from a single source authenticating against multiple accounts indicate password spraying or credential stuffing. Domain controllers log this event when they validate credentials. Monitor for a single source failing to authenticate with 30 or more unique users.
Detection Query (Splunk) for Kerberoasting:
index=windows EventCode=4769 Ticket_Encryption_Type=RC4 | stats count by Account_Name, Client_Address | where count > 10
What Undercode Say:
- Event IDs are the language of compromise—the 15 events above aren’t a checklist; they’re a narrative. Each one tells a chapter of the attacker’s story, from initial access to final payload.
-
Logging without action is noise—enabling these events means nothing if your SOC doesn’t have playbooks for each one. Build alerting thresholds, train analysts to recognize patterns, and practice incident response drills around these specific IDs.
-
Context is everything—a single 4624 at 2 PM is normal; a 4624 at 3 AM from a no-RDP account is an incident. Always correlate events with time, source IP, and user behavior baselines.
-
Command-line visibility is non-1egotiable—without 4688 command-line data and 4104 script block logging, you’re investigating blind. These two events alone can reveal 80% of attacker TTPs.
-
Defense evasion is the canary—1102 and 4719 events are the attacker’s equivalent of turning off the security cameras. When you see them, assume a breach is in progress and escalate immediately.
-
Lateral movement leaves footprints—5145, 4769, and 4776 events expose the attacker’s path across your network. Map these to understand the blast radius and contain the threat.
-
Mature SOCs don’t collect more events—they watch the right ones. The difference between a overwhelmed analyst and a threat hunter is knowing which 15 events to prioritize among the millions.
Prediction:
-
+1 Organizations that implement targeted alerting on these 15 event IDs will reduce their mean time to detection (MTTD) by 60-70%, catching attacks during the reconnaissance phase rather than after encryption.
-
-1 Attackers are already adapting—expect increased use of living-off-the-land binaries (LOLBins) that don’t trigger process creation events and increased abuse of legitimate administrative tools to bypass these specific detections.
-
+1 AI-powered SIEMs will increasingly use these 15 events as training data for anomaly detection, creating models that can distinguish between legitimate administrative activity and attacker behavior with higher fidelity.
-
-1 The shift toward cloud-1ative authentication (Azure AD, Okta) means these on-premises event IDs will become less relevant over time—security teams must parallel-track cloud identity logs with equivalent detection logic.
-
+1 Open-source detection rules (SIGMA, Splunk ES) are already incorporating these 15 IDs into their default rule sets, democratizing enterprise-grade threat detection for organizations of all sizes.
-
-1 Ransomware groups are increasingly clearing logs via kernel-level drivers and direct memory manipulation, bypassing Event Tracing for Windows (ETW)—expect event ID 1102 to become less reliable as a detection signal within 18-24 months.
-
+1 The cybersecurity community is building shared threat-hunting playbooks around these events, creating a collective defense network where one organization’s detection becomes every organization’s protection.
▶️ Related Video (82% Match):
https://www.youtube.com/watch?v=-fV7jZwZuGQ
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Yildizokan Soc – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
