Windows Event IDs: answer key
Every question with its answer and the reasoning. Work the drill first, or the key only tells you what, not how.
-
Triage this raw Windows log for Event ID 4624 ("An account was successfully logged on", channel: Security). Read it and type what was actually recorded for each field below.
An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WORKSTATION01$ Account Domain: CORP Logon ID: 0x3E7 Logon Information: Logon Type: 3 Restricted Admin Mode: - Virtual Account: No Elevated Token: No Impersonation Level: Impersonation New Logon: Security ID: S-1-5-21-3623811015-3361044348-30300820-1104 Account Name: jsmith Account Domain: CORP Logon ID: 0x3E7F2A1 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Workstation Name: WORKSTATION01 Source Network Address: 203.0.113.10 Source Port: 49234 Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V2 Key Length: 128Answer: Logon Type: 3 · Account Name (Subject): WORKSTATION01$ · Account Name (New Logon): jsmith · Source Network Address: 203.0.113.10
Event ID 4624: "An account was successfully logged on." Records that a logon session was created on the computer being accessed. Captures the account (Subject and New Logon), the Logon Type (Interactive, Network, RemoteInteractive/RDP, Service, Batch, Unlock, NewCredentials, etc.), the process that requested the logon, and the source workstation/IP. The foundational record of successful authentication on a host. It is the starting point for reconstructing who logged on where and how, correlating lateral movement across a network, and building an authentication timeline during an investigation. The Logon ID field ties it to related events like 4634, 4647, 4672, 4627, and to 4769 on a domain controller via the Logon GUID.
Read more: Full reference: Event ID 4624
-
Triage this raw Sysmon log for Event ID 11 ("FileCreate", channel: Microsoft-Windows-Sysmon/Operational). Read it and type what was actually recorded for each field below.
File created: RuleName: - UtcTime: 2024-01-15 14:42:33.012 ProcessGuid: {A1B2C3D4-E5F6-4A5B-8C9D-0E1F2A3B0006} ProcessId: 7788 Image: C:\Users\jsmith\AppData\Local\Temp\invoice.exe TargetFilename: C:\Users\jsmith\AppData\Roaming\update.dll CreationUtcTime: 2024-01-15 14:42:33.012 User: CORP\jsmithAnswer: Image: C:\Users\jsmith\AppData\Local\Temp\invoice.exe · TargetFilename: C:\Users\jsmith\AppData\Roaming\update.dll · CreationUtcTime: 2024-01-15 14:42:33.012
Event ID 11: "FileCreate." Logs file creation and overwrite operations, including the target path and the process that performed it. One of the highest-value events for catching malware dropping payloads into autostart locations, temp/download directories, or other common staging paths during initial infection.
Read more: Full reference: Event ID 11
-
Which MITRE ATT&CK technique ID does Event ID 4720 ("A user account was created", channel: Security) most commonly map to? (e.g. "T1078")
Answer: T1136
Marks the starting point for tracking a new identity in the environment. Unexpected or off-hours account creation, especially by a non-IT account, is a classic indicator of an adversary establishing persistence. This maps to Create Account (T1136). See the full technique writeup on the ATT&CK Coverage Map for detection guidance and mitigations.
Read more: Full reference: Event ID 4720
-
Triage this raw Windows log for Event ID 1102 ("The audit log was cleared", channel: Security). Read it and type what was actually recorded for each field below.
The audit log was cleared. Subject: Security ID: S-1-5-21-3623811015-3361044348-30300820-500 Account Name: administrator Domain Name: CORP Logon ID: 0x3E7F2A1
Answer: Account Name (Subject): administrator · Domain Name: CORP · Logon ID: 0x3E7F2A1
Event ID 1102: "The audit log was cleared." Generated by the Windows Eventlog service itself (Provider Microsoft-Windows-Eventlog, not the Security-Auditing provider) every time the Security event log is cleared. The event's LogFileCleared payload records the SID, account name, domain, and logon ID of whoever performed the clear. Because it's written by the Eventlog service as part of the clear operation, 1102 is the canonical 'someone cleared the Security log' tripwire and normally shouldn't occur at all in routine operation. Microsoft's own guidance is to monitor and investigate every occurrence. Forwarding it off-host / alerting on it in real time matters because it can otherwise be lost along with the rest of the log it documents.
Read more: Full reference: Event ID 1102
-
Triage this raw Sysmon log for Event ID 22 ("DNSEvent (DNS query)", channel: Microsoft-Windows-Sysmon/Operational). Read it and type what was actually recorded for each field below.
Dns query: RuleName: - UtcTime: 2024-02-11 09:43:12.204 ProcessGuid: {a1b2c3d4-1234-65a1-0000-001122334466} ProcessId: 7148 QueryName: update.example.com QueryStatus: 0 QueryResults: ::ffff:198.51.100.42; Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnswer: QueryName: update.example.com · Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe · QueryStatus: 0 · QueryResults: ::ffff:198.51.100.42;
Event ID 22: "DNSEvent (DNS query)." Logs DNS queries made by a process, whether the result succeeded, failed, was cached, or not. Telemetry for this event was added for Windows 8.1 and is not available on Windows 7 and earlier. Per-process DNS query logging helps identify malware beaconing to C2 domains, DNS tunneling, or domain-generation-algorithm activity by tying specific lookups back to the requesting process.
Read more: Full reference: Event ID 22
-
Which MITRE ATT&CK technique ID does Event ID 10 ("ProcessAccess", channel: Microsoft-Windows-Sysmon/Operational) most commonly map to? (e.g. "T1078")
Answer: T1003.001
This is the primary Sysmon telemetry for detecting credential-dumping tools reading LSASS memory and other process-injection precursors, by examining the target image and requested access rights (GrantedAccess). This maps to LSASS Memory (T1003.001). See the full technique writeup on the ATT&CK Coverage Map for detection guidance and mitigations.
Read more: Full reference: Event ID 10
-
Triage this raw Windows log for Event ID 4625 ("An account failed to log on", channel: Security). Read it and type what was actually recorded for each field below.
An account failed to log on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: S-1-0-0 Account Name: jsmith Account Domain: CORP Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xC000006D Sub Status: 0xC000006A Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: WORKSTATION01 Source Network Address: 203.0.113.15 Source Port: 49523 Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0
Answer: Logon Type: 3 · Account Name (Account For Which Logon Failed): jsmith · Sub Status: 0xC000006A · Source Network Address: 203.0.113.15
Event ID 4625: "An account failed to log on." Logged for any failed logon attempt, regardless of the reason, on the computer where the attempt was made. Captures the target account, the Logon Type attempted, the source workstation/IP, and a Status/Sub Status code identifying the specific failure reason. The central event for detecting brute-force attacks, password-spraying, account enumeration, and account lockouts. The Status/Sub Status codes let an analyst distinguish a simple mistyped password from a disabled, locked-out, or expired account, or a logon-hours/authorized-workstation violation.
Read more: Full reference: Event ID 4625
-
Triage this raw Windows log for Event ID 4672 ("Special privileges assigned to new logon", channel: Security). Read it and type what was actually recorded for each field below.
Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-3457937927-2839227994-823803824-500 Account Name: administrator Account Domain: CORP Logon ID: 0x8A2F1 Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege
Answer: Account Name (Subject): administrator · Logon ID: 0x8A2F1 · Privilege granting LSASS memory access (used by tools like Mimikatz): SeDebugPrivilege
Event ID 4672: "Special privileges assigned to new logon." Fires whenever a new logon session is granted one or more sensitive privileges from a fixed list (SeTcbPrivilege, SeBackupPrivilege, SeCreateTokenPrivilege, SeDebugPrivilege, SeEnableDelegationPrivilege, SeAuditPrivilege, SeImpersonatePrivilege, SeLoadDriverPrivilege, SeSecurityPrivilege, SeSystemEnvironmentPrivilege, SeAssignPrimaryTokenPrivilege, SeRestorePrivilege, and SeTakeOwnershipPrivilege), and lists exactly which were assigned. Flags every logon session that carries administrator-equivalent power. Because SYSTEM logons trigger it constantly, analysts typically filter for non-SYSTEM/non-service accounts to spot unexpected privileged sessions: a common signal for privilege escalation or misuse of an admin account.
Read more: Full reference: Event ID 4672
-
Which MITRE ATT&CK technique ID does Event ID 7045 ("A service was installed in the system", channel: System) most commonly map to? (e.g. "T1078")
Answer: T1543.003
Because it's written to the System log by the Service Control Manager itself, it is enabled by default on every Windows system with no advanced audit-policy configuration required, making it one of the most reliable, universally available artifacts for detecting service-based persistence and lateral movement. Classic example: PsExec drops PSEXESVC.exe as a temporary service on the target, generating a 7045 that is a strong indicator of PsExec-based lateral movement. The ImagePath is the primary triage field: services pointing at Temp, AppData, or other non-standard paths are a strong red flag. This maps to Windows Service (T1543.003). See the full technique writeup on the ATT&CK Coverage Map for detection guidance and mitigations.
Read more: Full reference: Event ID 7045
-
Triage this raw Sysmon log for Event ID 3 ("Network connection", channel: Microsoft-Windows-Sysmon/Operational). Read it and type what was actually recorded for each field below.
Network connection detected: RuleName: - UtcTime: 2024-01-15 14:36:02.789 ProcessGuid: {5a8f3c2b-7e41-65b0-1200-000000001b00} ProcessId: 4521 Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe User: CORP\jsmith Protocol: tcp Initiated: true SourceIsIpv6: false SourceIp: 198.51.100.23 SourceHostname: WKSTN-JSMITH.corp.local SourcePort: 51322 SourcePortName: - DestinationIsIpv6: false DestinationIp: 203.0.113.10 DestinationHostname: - DestinationPort: 443 DestinationPortName: httpsAnswer: Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe · DestinationIp: 203.0.113.10 · DestinationPort: 443 · User: CORP\jsmith
Event ID 3: "Network connection." Logs TCP/UDP network connections initiated by a process, including source/destination hostnames, IP addresses, port numbers, and IPv6 status. Disabled by default because of the volume it generates. Ties outbound or inbound network activity to a specific process and ProcessGuid, which is essential for identifying C2 beaconing, lateral movement, or exfiltration channels during an investigation.
Read more: Full reference: Event ID 3