Essential Windows Security Event IDs for Blue Team Log Analysis
A concise reference guide to the most valuable Windows Event Log IDs for detecting account tampering, lateral movement, and privilege escalation.
1. Authentication & Logon Events
Event ID 4624 (Successful Logon) and Event ID 4625 (Failed Logon) are the cornerstone of authentication monitoring. However, looking at the event count alone is insufficient; analysts must understand Logon Types.
Logon Type 2 represents interactive logon (keyboard and monitor), Type 3 represents network logon (file shares, SMB, PsExec), and Type 10 represents Remote Desktop (RDP). Seeing sudden bursts of Event 4625 with Logon Type 3 indicates network-based password spraying.
Logon Type 2 - Interactive (Console login)
Logon Type 3 - Network (SMB shares, RPC, PsExec)
Logon Type 7 - Unlock (Screen unlocked)
Logon Type 10 - RemoteInteractive (Terminal Services / RDP)2. Process Creation and Termination
Event ID 4688 records when a new process is created. By default, Windows does not log the complete command-line string. Enabling "Include command line in process creation events" via Group Policy is mandatory for modern SOC visibility.
Even with 4688 enabled, Sysmon Event ID 1 is superior because it records cryptographic hashes (SHA-256) of every executable image and unique Process GUIDs that survive PID reuse.
3. Special Privilege & Group Membership
Watch Event ID 4728 (A member was added to a security-enabled global group) and Event ID 4732 (member added to local group). When an account is added to "Domain Admins" or local "Administrators" outside of approved change windows, an urgent alert should fire immediately.
4. Persistence via Services & Scheduled Tasks
Adversaries establish persistence using scheduled tasks and Windows services. Event ID 4697 (A service was installed in the system) and TaskScheduler Operational Event ID 106 (User scheduled task created) allow defenders to catch persistence mechanisms before reboot.