Lesson 2.1: Windows security events
Windows records security-relevant actions as numbered events in its Security log: logons and failures, logon types, special privileges, accounts created and added to groups, and even the log being cleared. A handful of IDs answer most first questions in an investigation. In the lab you continue the jump01 case from section 1 with the server's Security events, forwarded to the SIEM before the attacker could delete them: you find the password guessing, the successful RDP logon from the internet, the admin rights, the backdoor account, and the attempt to cover the tracks.
17 min
You will learn to
- Recognise the key Security event IDs
- Read logon types
- Explain failure sub-status codes
- Find account creation and group changes
- Recognise log clearing
Key terms
- 4624 / 4625
- Successful and failed logon.
- Logon type
- How the logon happened: 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 10 remote interactive (RDP).
- 4672
- Special privileges assigned to a new logon (an administrator-equivalent session).
- 4720 / 4732 / 4728
- User account created; member added to a local group; member added to a domain global group.
- 1102
- The Security audit log was cleared.
- 4688
- A new process was created (with command line if that policy is enabled).
← The OWASP Top 10, and what attacks look like in a log · All lessons · Hash functions →