Windows Security Event IDs

Question 1

4624

Answer 1

Logon Success - Good baseline — analyze where/when/how they log in

Question 2

4625

Answer 2

Logon Failed - Look for brute force, wrong creds

Question 3

4688

Answer 3

Process Creation - Detect malicious binaries, PowerShell, cmd

Question 4

7030

Answer 4

Service Creation - Persistence technique (T1543 in MITRE)

Question 5

800

Answer 5

Powershell Script Block Logging - Needed to see what PowerShell actually did