Windows Event Log Security Monitoring Baseline: The 20 Event IDs Every SOC Must Be Collecting and What Each One Means

Default Windows audit settings do not generate most of the events in this guide. Enable Advanced Audit Policy via Group Policy:

Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration

Minimum required subcategories for the baseline:

For process creation events to include command-line arguments (critical for detecting obfuscated commands): Computer Configuration > Administrative Templates > System > Audit Process Creation > Include command line in process creation events = Enabled

For PowerShell script block logging: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging = Enabled

Event ID 4624: Successful Logon The most fundamental event. The critical field is LogonType:

• Type 2: Interactive (keyboard at the console)
• Type 3: Network (file share, SMB, net use)
• Type 4: Batch (scheduled tasks)
• Type 5: Service (service startup)
• Type 7: Unlock
• Type 10: RemoteInteractive (RDP, Terminal Services)
• Type 11: CachedInteractive (offline cached credential)

For lateral movement detection, focus on Type 3 logons from workstations to workstations (should be rare) and Type 10 logons (RDP) to unexpected systems. Type 3 logons using a Domain Admin account to a standard workstation are high-priority findings.

Event ID 4625: Failed Logon Critical for brute force detection. Fields to extract: SubStatus code distinguishes password failure (0xC000006A) from account disabled (0xC0000072) from account locked (0xC0000234). A high volume of 0xC000006A on a single account is a brute force in progress.

Event ID 4634 / 4647: Logoff Correlate with 4624 to calculate session duration. Unusually long sessions or sessions that span business hours boundaries deserve attention.

Event ID 4648: Logon Using Explicit Credentials Generated when a process runs using different credentials (RunAs, Invoke-Command -Credential). Legitimate uses include scheduled tasks and admin tools, but this event fired by unexpected processes from unexpected accounts is a lateral movement indicator.

Event ID 4672: Special Privileges Assigned Generated whenever an account with sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, SeBackupPrivilege) logs on. Any account with SeDebugPrivilege can dump LSASS. Monitor for non-admin accounts triggering this event.

Event ID 4673: Sensitive Privilege Use Generated when a privileged operation uses a sensitive right. SeDebugPrivilege used by a non-standard process is a credential dumping indicator.

Event ID 4720: User Account Created Monitor for new accounts created outside of the expected provisioning process (service account, HR system, IT helpdesk). Attacker persistence via new account creation is a classic technique.

Event ID 4722 / 4723 / 4724: Account Enabled / Password Change / Password Reset Account enables and password resets on disabled or dormant accounts without a corresponding helpdesk ticket are high-priority findings.

Event ID 4728 / 4732 / 4756: Member Added to Security Group 4728: member added to global security group 4732: member added to local security group 4756: member added to universal security group Any addition to Domain Admins, Enterprise Admins, Schema Admins, or Administrators local group should generate an immediate alert regardless of time of day.

Event ID 4740: Account Locked Out High volume lockouts across multiple accounts suggest a password spray attack. A single user locked out repeatedly suggests targeted brute force.

Event ID 4907: Auditing Settings Changed on Object Modifying audit settings on a sensitive object (a file, a registry key, an AD object) to reduce or disable auditing is a defense evasion tactic.

Event ID 4719: System Audit Policy Changed Any change to the audit policy should be alerting. Attackers who gain admin access sometimes disable auditing to cover their tracks.

Event ID 4688: Process Created (with command line) The most detection-rich event in Windows when command-line logging is enabled. Key patterns:

• lsass.exe as the parent process of anything unexpected (lsass should not spawn child processes)
• PowerShell with -EncodedCommand, -WindowStyle Hidden, -NoProfile -NonInteractive
• cmd.exe spawned by mshta.exe, wscript.exe, or cscript.exe (LOLBins)
• whoami.exe, net.exe user /domain, nltest.exe /dclist (enumeration commands)
• mimikatz.exe, procdump.exe by parent PID that is not a known admin process

Event ID 4104: PowerShell Script Block Logging Logs the actual content of PowerShell scripts before execution, including de-obfuscated content. Requires the GPO setting in the foundation section. Search for: IEX, Invoke-Expression, DownloadString, [Convert]::FromBase64String, and known malicious function names (Invoke-Mimikatz, Invoke-BloodHound).

Event ID 4656 / 4663: Object Access Requires per-object SACL configuration. Set SACLs on:

• LSASS process handle opens (detect credential dumping tools attempting to open LSASS)
• SAM database file (C:\Windows\System32\config\SAM) access
• NTDS.dit access attempts on domain controllers
• Sensitive directories (C:\Users\Administrator, C:\Windows\System32\drivers\etc)

Event ID 4698 / 4702: Scheduled Task Created / Modified Scheduled tasks are a common persistence mechanism. Alert on scheduled task creation that executes from temp directories, PowerShell with encoded commands, or file paths associated with common malware staging locations.

These events only appear on Domain Controllers and are critical for detecting AD-level attacks:

Event ID 4662: Operation Performed on AD Object The key event for detecting DCSync attacks. DCSync triggers 4662 events with:

• Object type: domainDNS
• Properties: {1131f6aa-9c07-11d1-f79f-00c04fc2dcd2} (DS-Replication-Get-Changes)
• Properties: {1131f6ad-9c07-11d1-f79f-00c04fc2dcd2} (DS-Replication-Get-Changes-All)

Alert on any account that is NOT a Domain Controller computer account triggering these replication rights.

Event ID 4769: Kerberos Service Ticket Request Filter for encryption type 0x17 (RC4-HMAC). In environments that have migrated to AES encryption, RC4 requests from user accounts are anomalous and may indicate Kerberoasting. Alert on: TicketEncryptionType = 0x17 AND ServiceName != krbtgt AND CallerComputerName is not a DC.

Event ID 4771: Kerberos Pre-Authentication Failed Brute force against Kerberos. High volume 4771 events against a single account or from a single source IP is a password spray or brute force attempt.

Event ID 4776: NTLM Credential Validation Generated on the DC when NTLM authentication is used. Monitor for 4776 with ErrorCode 0xC000006A (wrong password) in high volume. In environments with NTLM disabled, any 4776 event is anomalous.

Event ID 4768: TGT Requested Combine with 4769 to track Kerberos ticket chains. A TGT requested from an unusual IP for a high-privilege account outside business hours is worth investigating.