Cheat Sheets Forensics

Windows Event IDs Cheat Sheet

The Windows Security, System and PowerShell event IDs used in investigations, with logon types, 4625 failure codes and the log each one lives in.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page
On this page

Windows records security-relevant activity as numbered events in .evtx logs under C:\Windows\System32\winevt\Logs\. These are the IDs investigators search for first. Load an exported log into Log Forensics to group and filter them in your browser. Several events only appear when the matching audit policy is enabled.

Logons and sessions (Security log)

ID Meaning Why it matters
4624 An account successfully logged on Who, from where (IpAddress, WorkstationName) and how (logon type)
4625 An account failed to log on Bursts point to password guessing; read the status codes below
4634 An account was logged off Pair with 4624 through the TargetLogonId to get session length
4647 User initiated logoff Interactive logoff started by the user
4648 A logon was attempted using explicit credentials runas, mapped drives with other credentials, lateral movement
4672 Special privileges assigned to new logon An administrator-equivalent logon
4740 A user account was locked out Too many failures; the record names the caller computer
4767 A user account was unlocked
4778 A session was reconnected to a Window Station RDP or fast user switching reconnect
4779 A session was disconnected from a Window Station RDP disconnect

Logon types (field LogonType in 4624, 4625, 4634)

Type Name Typical source
2 Interactive Keyboard at the console
3 Network SMB share, net use, many remote admin tools
4 Batch Scheduled tasks
5 Service A service starting under an account
7 Unlock Workstation unlocked
8 NetworkCleartext Credentials sent in clear text, e.g. IIS basic authentication
9 NewCredentials runas /netonly
10 RemoteInteractive Remote Desktop (RDP)
11 CachedInteractive Logon with cached domain credentials, no domain controller reached
12 CachedRemoteInteractive RDP with cached credentials
13 CachedUnlock Unlock with cached credentials

Why a logon failed (4625 Status / SubStatus)

Code Meaning Reading
0xC000006D Bad user name or authentication information Generic status; look at the SubStatus
0xC0000064 User name does not exist Many different names: account enumeration or spraying
0xC000006A Correct user name, wrong password Many tries on one name: password guessing
0xC0000234 Account locked out
0xC0000072 Account disabled
0xC0000193 Account expired
0xC0000071 Password expired
0xC0000224 Password must change at next logon
0xC000006F Logon outside allowed hours
0xC0000070 Logon from an unauthorised workstation
0xC000015B Logon type not granted to this account

Accounts and groups (Security log)

ID Meaning
4720 A user account was created
4722 A user account was enabled
4723 An attempt was made to change an account's password
4724 An attempt was made to reset an account's password
4725 A user account was disabled
4726 A user account was deleted
4738 A user account was changed
4728 A member was added to a security-enabled global group
4732 A member was added to a security-enabled local group (e.g. Administrators)
4756 A member was added to a security-enabled universal group
4768 A Kerberos authentication ticket (TGT) was requested
4769 A Kerberos service ticket was requested
4771 Kerberos pre-authentication failed
4776 The computer attempted to validate the credentials for an account (NTLM)

Processes, services and tasks

ID Log Meaning
4688 Security A new process has been created (command line only if enabled)
4689 Security A process has exited
4697 Security A service was installed in the system
4698 Security A scheduled task was created
4699 Security A scheduled task was deleted
4702 Security A scheduled task was updated
7045 System A new service was installed (look for odd paths, cmd /c, encoded PowerShell)
7034 System A service terminated unexpectedly
7036 System A service entered the running or stopped state
7040 System A service's start type was changed
106 TaskScheduler/Operational A scheduled task was registered
200 / 201 TaskScheduler/Operational A task action started / completed

Every service install (7045) also leaves a key under SYSTEM\CurrentControlSet\Services; compare both with Registry Forensics and Windows Registry Forensic Artifacts Cheat Sheet.

Log tampering and system state

ID Log Meaning
1102 Security The audit log was cleared
104 System An event log was cleared
4719 Security System audit policy was changed
6005 System The Event Log service was started (boot)
6006 System The Event Log service was stopped (clean shutdown)
6008 System The previous system shutdown was unexpected
1074 System A process or user initiated a shutdown or restart

PowerShell and remote access

ID Log Meaning
4103 PowerShell/Operational Module logging: pipeline execution details
4104 PowerShell/Operational Script block logging: the actual script text, decoded
400 / 403 Windows PowerShell PowerShell engine started / stopped (shows the host application)
1149 TerminalServices-RemoteConnectionManager/Operational RDP user authentication succeeded (source IP)
21 TerminalServices-LocalSessionManager/Operational RDP session logon succeeded
24 / 25 TerminalServices-LocalSessionManager/Operational RDP session disconnected / reconnected
5140 Security A network share object was accessed
5145 Security A network share object was checked for access (detailed file share)

Reading patterns

  • Password spraying vs. guessing. Many 4625 with 0xC0000064 across many names from one source is spraying or enumeration; many 0xC000006A on one name is a brute-force attack. A 4624 from the same source right after is the event that matters.
  • RDP logon. Look for 4624 type 10 together with 1149 and LocalSessionManager 21; type 3 alone is usually file sharing, not a desktop session.
  • Persistence. 7045 or 4697 (new service), 4698 (new task) and 4720 + 4732 (new account added to Administrators) are classic indicators of compromise.
  • Gaps. A 1102 or 104, or missing time ranges, means part of the story was removed; check other logs and the registry for the same period.

Try these tools

Log Forensics

Parse Windows Event Log (.evtx) files and text logs - syslog, auth.log/secure, Apache/nginx access and error logs.

Registry Forensics

Parse a Windows registry hive - SYSTEM, SOFTWARE, SAM, NTUSER.DAT, UsrClass.dat or Amcache.hve - entirely in your browser.

Executable Forensics

Inspect Windows PE, Linux ELF and macOS Mach-O executables in your browser - headers, sections with per-section entropy, imports/exports.

See also

  • Cheat sheet Windows Registry Forensic Artifacts Cheat Sheet
    Where Windows records autoruns, USB devices, UserAssist, ShellBags, RecentDocs, RunMRU, BAM, ShimCache, Amcache.
  • Glossary Brute-force attack
    A brute-force attack tries every possible password or key, or a huge list of likely ones, until one works.
  • Glossary Indicator of compromise (IOC)
    An indicator of compromise (IOC) is a piece of observable evidence, such as a file hash, IP address or domain.
  • Glossary Malware
    Malware is any software designed to harm a device or steal from its user, including viruses, worms, ransomware, spyware and trojans.

Frequently Asked Questions

Many events are only written when the matching audit policy is on. Process creation (4688) needs the "Audit Process Creation" policy, its command line needs a separate setting, and PowerShell 4104 needs script block logging enabled by Group Policy.

No, administrators clear logs too. It is a strong lead because attackers clear logs to hide, so check who cleared it (the event records the account) and whether that fits a planned task.

Back to the cheat sheets
AdSense Placeholder
Slot: footer_leaderboard