Windows Event Log

A system service on Windows OS that log events, which are any occurrence or action that can be identified by software or hardware

These events are recorded, stored and managed in a standardised way by the Windows Event Log, which runs inside the service host process svchost.exe.

By default the logs are stored in C:\Windows\System32\winevt\logs with the file extension .evtx.

They can be retrieved in PowerShell with the Cmdlet Get-WinEvent.

Tools for Interaction

• Windows Event Viewer GUI.
• wevutil: CLI tool for the Windows Event Viewer.
• Get-WinEvent: PowerShell Cmdlet.

Log Format

Each log is stored in standardised format with the following elements:

• Log name: the name of the event log where the events will be written. By default, events are logged for system, security, and applications.
• Source: where the log originated from, typically the name of a program or software application.
• Event ID: a unique identifier for sysadmins to identify a specific logged event. Can be looked up in this searchable database.
• Level: severity level of the event. This can be information, error, verbose, warning, critical.
• User: username of who logged onto the host when the event occurred.
• Opcode: code for identifying the specific operation that the event reports.
• Logged: date and time when the event occurred.
• Task Category: the type of recorded event log. Can help understand the purpose of the event.
• Keywords: flags that allow us to categorise events in ways beyond the other classification options. These are generally broad categories, such as “Audit Success” or “Audit Failure” in the Security log.
• Computer: name of the computer where the event is logged
• XML Data: all the above information is also included in an XML format along with additional event data.

Log Categories

Logs are divided into 5 categories:

• System Log: The system log contains events related to the Windows system and its components. A system-level event could be a service failing at startup.
• Security Log: Include security-related events such as failed and successful logins, and file creation/deletion. These can be used to detect various types of attacks that we will cover in later modules.
• Application Log: Stores events related to any software/application installed on the system. For example, if Slack has trouble starting it will be recorded in this log.
• Setup Log: Holds any events that are generated when the Windows operating system is installed. In a domain environment, events related to Active Directory will be recorded in this log on domain controller hosts.
• Forwarded Events: Logs that are forwarded from other hosts within the same network.

Event Types

There are 5 types of events logged on a Windows system:

• Error: Indicates a major problem, such as a service failing to load during startup, has occurred.
• Warning: A less significant log but one that may indicate a possible problem in the future. One example is low disk space. A Warning event will be logged to note that a problem may occur down the road. A Warning event is typically when an application can recover from the event without losing functionality or data.
• Information: Recorded upon the successful operation of an application, driver, or service, such as when a network driver loads successfully. Typically not every desktop application will log an event each time they start, as this could lead to a considerable amount of extra “noise” in the logs.
• Success Audit: Recorded when an audited security access attempt is successful, such as when a user logs on to a system.
• Failure Audit: Recorded when an audited security access attempt fails, such as when a user attempts to log in but types their password in wrong. Many audit failure events could indicate an attack, such as Password Spraying.

Event Security Level

Each event can have one of five security levels associated with it:

1. Critical: This indicates a significant issue related to an application or a system that requires urgent attention by a sysadmin that, if not addressed, could lead to system or application instability.
2. Error: An issue related to the system or service that does not require immediate attention.
3. Warning: A potential problem that a sysadmin should dig into.
4. Information: An event that occurred on the system but did not cause any issues.
5. Verbose: Progress or success messages.

Events to monitor

In an Active Directory environment this list provides event to monitor for signs of compromise.

This searchable database provides a way to look up Event IDs.

System Logs

Event ID 1074 (System Shutdown/Restart)

• Indicates when and why the system was shut down or restarted.
• Can reveal unexpected shutdowns or restarts, potentially indicating malicious activity such as malware infection or unauthorised user access.

Event ID 6005 (The Event log service was started)

• Marks the time when the Event Log Service was started.
• Can signify a system boot-up, providing a starting point for investigating system performance or potential security incidents.
• Can also be used to detect unauthorised system reboots.

Event ID 6006 (The Event log service was stopped)

• Signifies the moment when the Event Log Service was stopped.
• Typically seen when the system is shutting down.
• Abnormal occurrences could point to intentional service disruption to cover illicit activities.

Event ID 6013 (Windows uptime)

• Occurs once a day and shows the uptime of the system in seconds.
• A shorter than expected uptime could mean the system has been rebooted, signifying a potential intrusion or unauthorised activities.

Event ID 7040 (Service status change)

• Indicates a change in service startup type (e.g. manual to automatic or vice versa).
• Changes to a crucial service’s startup type could be a sign of system tampering.

Security Logs

Event ID 1102 (The audit log was cleared)

• Clearing the audit log is often a sign of an attempt to remove evidence of an intrusion or malicious activity.

Event ID 1116 (Antivirus malware detection)

• Logs when Defender detects malware.
• A surge in these events could indicate a targeted attack or widespread malware infection.

Event ID 1118 (Antivirus remediation activity has started)

• Signifies that Defender has begun removing or quarantining detected malware.
• Important to monitor to ensure remediation activities are successful.

Event ID 1119 (Antivirus remediation activity has succeeded)

• Signifies that the remediation process for detected malware has been successful.
• Regular monitoring helps ensure identified threats are effectively neutralised.

Event ID 1120 (Antivirus remediation activity has failed)

• Indicates that the remediation process has failed.
• Should be closely monitored and addressed immediately to ensure threats are neutralised.

Event ID 4624 (Successful Logon)

• Records successful logon events.
• Vital for establishing normal user behaviour.
• Abnormal behaviour, such as logons at odd hours or from different locations, could signify a security threat.

Event ID 4625 (Failed Logon)

• Logs failed logon attempts.
• Multiple failed attempts could signify a brute-force attack in progress.

Event ID 4648 (A logon was attempted using explicit credentials)

• Triggered when a user logs on with explicit credentials to run a program.
• Anomalies could indicate lateral movement within a network.

Event ID 4656 (A handle to an object was requested)

• Triggered when a handle to an object (such as a file, registry key, or process) is requested.
• Useful for detecting attempts to access sensitive resources.

Event ID 4672 (Special Privileges Assigned to a New Logon)

• Logged whenever an account logs on with super user privileges.
• Helps ensure that super user privileges are not being abused or used maliciously.

Event ID 4698 (A scheduled task was created)

• Triggered when a scheduled task is created.
• Useful for detecting persistence mechanisms, as attackers often use scheduled tasks to maintain access and run malicious code.

Event ID 4700 & 4701 (A scheduled task was enabled/disabled)

• Records the enabling or disabling of a scheduled task.
• Scheduled tasks are often manipulated by attackers for persistence or to run malicious code.

Event ID 4702 (A scheduled task was updated)

• Triggered when a scheduled task is updated.
• Monitoring these updates can help detect changes that may signify malicious intent.

Event ID 4719 (System audit policy was changed)

• Records changes to the audit policy on a computer.
• Could indicate someone attempting to cover their tracks by turning off or modifying auditing.

Event ID 4738 (A user account was changed)

• Records any changes made to user accounts, including privileges, group memberships, and account settings.
• Unexpected changes can be a sign of account takeover or insider threats.

Event ID 4771 (Kerberos pre-authentication failed)

• Similar to 4625 but specifically for Kerberos authentication.
• An unusual number of these logs could indicate an attacker attempting to brute force the Kerberos service.

Event ID 4776 (The domain controller attempted to validate credentials)

• Tracks both successful and failed attempts at credential validation by the domain controller.
• Multiple failures could suggest a brute-force attack.

Event ID 5001 (Antivirus real-time protection configuration has changed)

• Indicates that the real-time protection settings of Defender have been modified.
• Unauthorised changes could indicate an attempt to disable or undermine Defender.

Event ID 5140 (A network share object was accessed)

• Logged whenever a network share is accessed.
• Critical for identifying unauthorised access to network shares.

Event ID 5142 (A network share object was added)

• Signifies the creation of a new network share.
• Unauthorised network shares could be used to exfiltrate data or spread malware.

Event ID 5145 (A network share object was checked for access)

• Indicates that someone attempted to access a network share.
• Frequent checks may indicate a user or malware attempting to map out network shares.

Event ID 5157 (The Windows Filtering Platform has blocked a connection)

• Logged when the Windows Filtering Platform blocks a connection attempt.
• Helpful for identifying malicious traffic on the network.

Event ID 7045 (A service was installed in the system)

• A sudden appearance of unknown services may suggest malware installation, as many malware types install themselves as services.