Windows records an enormous amount of activity. Most of it is noise until you know which events answer the questions you actually ask during an investigation.
The three logs you will use most
- Security — logons, privilege use, account changes and audit events.
- System — services, drivers and hardware-level problems.
- Application — application crashes and errors.
- PowerShell/Operational — script execution and engine events, if enabled.
Open Event Viewer, or query the logs from PowerShell:
PowerShell
Get-WinEvent -LogName Security -MaxEvents 20
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} -MaxEvents 10
Event IDs worth recognising
| ID | Meaning | Why it matters |
|---|---|---|
| 4624 | Successful logon | Shows who logged on, from where and with what logon type |
| 4625 | Failed logon | Brute force, spraying or a broken service account |
| 4688 | Process created | Command-line logging makes this far more useful |
| 7045 | Service installed | A common persistence mechanism |
| 1102 | Audit log cleared | Often anti-forensics; investigate immediately |
| 4720 | User account created | Unexpected accounts are a red flag |
Event IDs are a starting point, not a verdict. A 4624 from an unusual country at 03:00 is interesting; the same event from the office at 09:00 is probably not.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.