Every action in Windows generates a numbered log entry called an Event ID. In a Windows security investigation, 10 of them will appear in almost every incident. Learn these 10 and you can read an attack timeline from the logs.

The 10 Event IDs

4624 — Successful Logon: Logon Type 2 = interactive, Type 3 = network (most common lateral movement type), Type 10 = RDP. Alert: same account Type 3 to 12 servers in 5 minutes is not normal.

4625 — Failed Logon: One user, many failures = brute force. Many users, few failures each = password spray. Sub Status 0xC000006A = wrong password; 0xC0000064 = username does not exist.

4648 — Explicit Credential Logon: Authenticated using explicitly provided credentials — not the logged-in account. This is how Pass-the-Hash shows up.

4672 — Special Privileges Assigned: Admin-level privileges granted at logon. Any standard user generating 4672 events is escalating.

4697 — Service Installed (Security Log): New Windows service registered. Unknown names or services pointing to temp directories are immediate red flags.

4720 — User Account Created: New AD account created. Randomly named account at 2 AM = backdoor.

4728 / 4732 — Member Added to Privileged Group: 4728 = global group (e.g., Domain Admins). 4732 = local administrators. Any addition to Domain Admins = Tier 1 alert.

4769 — Kerberos Service Ticket Requested: Ticket Encryption Type 0x12 = AES (expected). 0x17 = RC4 = Kerberoasting signature. Zero 0x17 events should appear in a modern environment.

4771 — Kerberos Pre-Authentication Failed: High volume against many accounts = attacker enumerating usernames.

7045 — New Service Installed (System Log): Same as 4697 but in the System log. Check both.

📁 Free handout & resources: Download the Module 11 PDF — reference tables, Event ID cheat sheet, lab guides.

Learning Objective

After this lesson, you can name all 10 Event IDs, explain what each means, and identify which indicate malicious activity versus normal operations.

Resource

The complete reference table with What to Hunt For detail for each Event ID is on pages 3–4 of the Module 11 handout.

Part of the free Intro to Cyber course by Cover6 Solutions.