Windows Event IDs
Read a raw Security or Sysmon entry, and pull out the fields triage actually turns on.
Read a real raw log entry and pull out the fields an analyst actually triages on. Intermediate, about 25 minutes.
What you will be able to do
- Locate the account, source address and logon type in a raw Windows Security event without a parser (Event ID / Sysmon Reference)
- Tell apart same-named fields that appear in different blocks of one event and mean different things
- Recognize the common Security and Sysmon event IDs by what the record contains, not by memorizing a number list
- Map an event to the ATT&CK technique it commonly evidences (ATT&CK Coverage Map)
Read first: Event ID / Sysmon Reference.
Notes for teaching it
- The single most transferable skill here is reading the block structure, so it is worth stopping the class on the first question where a field name appears twice.
- Every log shown is the real sample from that event's own reference page, so a learner can open the reference alongside and see the same record annotated in full.
- The ATT&CK-mapping questions are a minority of the run and assume no prior ATT&CK knowledge: they link out per question, so they work as an introduction rather than a gate.
All questions
-
Triage this raw Windows log for Event ID 4624 ("An account was successfully logged on", channel: Security). Read it and type what was actually recorded for each field below.
An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WORKSTATION01$ Account Domain: CORP Logon ID: 0x3E7 Logon Information: Logon Type: 3 Restricted Admin Mode: - Virtual Account: No Elevated Token: No Impersonation Level: Impersonation New Logon: Security ID: S-1-5-21-3623811015-3361044348-30300820-1104 Account Name: jsmith Account Domain: CORP Logon ID: 0x3E7F2A1 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Workstation Name: WORKSTATION01 Source Network Address: 203.0.113.10 Source Port: 49234 Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V2 Key Length: 128 -
Triage this raw Sysmon log for Event ID 11 ("FileCreate", channel: Microsoft-Windows-Sysmon/Operational). Read it and type what was actually recorded for each field below.
File created: RuleName: - UtcTime: 2024-01-15 14:42:33.012 ProcessGuid: {A1B2C3D4-E5F6-4A5B-8C9D-0E1F2A3B0006} ProcessId: 7788 Image: C:\Users\jsmith\AppData\Local\Temp\invoice.exe TargetFilename: C:\Users\jsmith\AppData\Roaming\update.dll CreationUtcTime: 2024-01-15 14:42:33.012 User: CORP\jsmith -
Which MITRE ATT&CK technique ID does Event ID 4720 ("A user account was created", channel: Security) most commonly map to? (e.g. "T1078")
-
Triage this raw Windows log for Event ID 1102 ("The audit log was cleared", channel: Security). Read it and type what was actually recorded for each field below.
The audit log was cleared. Subject: Security ID: S-1-5-21-3623811015-3361044348-30300820-500 Account Name: administrator Domain Name: CORP Logon ID: 0x3E7F2A1
-
Triage this raw Sysmon log for Event ID 22 ("DNSEvent (DNS query)", channel: Microsoft-Windows-Sysmon/Operational). Read it and type what was actually recorded for each field below.
Dns query: RuleName: - UtcTime: 2024-02-11 09:43:12.204 ProcessGuid: {a1b2c3d4-1234-65a1-0000-001122334466} ProcessId: 7148 QueryName: update.example.com QueryStatus: 0 QueryResults: ::ffff:198.51.100.42; Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -
Which MITRE ATT&CK technique ID does Event ID 10 ("ProcessAccess", channel: Microsoft-Windows-Sysmon/Operational) most commonly map to? (e.g. "T1078")
-
Triage this raw Windows log for Event ID 4625 ("An account failed to log on", channel: Security). Read it and type what was actually recorded for each field below.
An account failed to log on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: S-1-0-0 Account Name: jsmith Account Domain: CORP Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xC000006D Sub Status: 0xC000006A Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: WORKSTATION01 Source Network Address: 203.0.113.15 Source Port: 49523 Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0
-
Triage this raw Windows log for Event ID 4672 ("Special privileges assigned to new logon", channel: Security). Read it and type what was actually recorded for each field below.
Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-3457937927-2839227994-823803824-500 Account Name: administrator Account Domain: CORP Logon ID: 0x8A2F1 Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege
-
Which MITRE ATT&CK technique ID does Event ID 7045 ("A service was installed in the system", channel: System) most commonly map to? (e.g. "T1078")
-
Triage this raw Sysmon log for Event ID 3 ("Network connection", channel: Microsoft-Windows-Sysmon/Operational). Read it and type what was actually recorded for each field below.
Network connection detected: RuleName: - UtcTime: 2024-01-15 14:36:02.789 ProcessGuid: {5a8f3c2b-7e41-65b0-1200-000000001b00} ProcessId: 4521 Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe User: CORP\jsmith Protocol: tcp Initiated: true SourceIsIpv6: false SourceIp: 198.51.100.23 SourceHostname: WKSTN-JSMITH.corp.local SourcePort: 51322 SourcePortName: - DestinationIsIpv6: false DestinationIp: 203.0.113.10 DestinationHostname: - DestinationPort: 443 DestinationPortName: https
Next: Decode & Convert Drill. All drills