Event ID 4624
An account was successfully logged on
LogonWindows Security
High-priority SOC reference for authentication, credential use, and session triage.
Open event guide
Windows Security Event IDs
Browse complete Windows Security event guides by category, with investigation context, key fields, false positives, ATT&CK mappings, KQL, and SPL.
78 events found
P1
Event ID 4625
An account failed to log on
LogonWindows Security
High-priority SOC reference for authentication, credential use, and session triage.
Open event guide
Event ID 4634
An account was logged off
LogonWindows Security
High-priority SOC reference for authentication, credential use, and session triage.
Open event guide
Event ID 4647
User initiated logoff
LogonWindows Security
Priority SOC reference for authentication, credential use, and session triage.
Open event guide
Event ID 4648
A logon was attempted using explicit credentials
LogonWindows Security
High-priority SOC reference for authentication, credential use, and session triage.
Open event guide
Event ID 4672
Special privileges assigned to new logon
LogonWindows Security
High-priority SOC reference for authentication, credential use, and session triage.
Open event guide
Event ID 4768
A Kerberos authentication ticket (TGT) was requested
KerberosWindows Security
High-priority SOC reference for Kerberos authentication and ticket activity review.
Open event guide
Event ID 4769
A Kerberos service ticket was requested
KerberosWindows Security
High-priority SOC reference for Kerberos authentication and ticket activity review.
Open event guide
Event ID 4770
A Kerberos service ticket was renewed
KerberosWindows Security
Specialized SOC reference for Kerberos authentication and ticket activity review.
Open event guide
Event ID 4771
Kerberos pre-authentication failed
KerberosWindows Security
Priority SOC reference for Kerberos authentication and ticket activity review.
Open event guide
Event ID 4776
The domain controller attempted to validate credentials (NTLM)
LogonWindows Security
High-priority SOC reference for authentication, credential use, and session triage.
Open event guide
Event ID 4778
A session was reconnected to a Window Station
SessionWindows Security
Specialized SOC reference for remote session reconnect and disconnect review.
Open event guide
Event ID 4779
A session was disconnected from a Window Station
SessionWindows Security
Specialized SOC reference for remote session reconnect and disconnect review.
Open event guide
Event ID 4688
A new process has been created
ProcessWindows Security
High-priority SOC reference for process execution and lifecycle analysis.
Open event guide
Event ID 4689
A process has exited
ProcessWindows Security
Priority SOC reference for process execution and lifecycle analysis.
Open event guide
Event ID 4697
A service was installed in the system
ServiceWindows Security
High-priority SOC reference for service state and operational integrity review.
Open event guide
Event ID 4698
A scheduled task was created
ScheduledTaskWindows Security
High-priority SOC reference for scheduled-task persistence and task lifecycle review.
Open event guide
Event ID 4699
A scheduled task was deleted
ScheduledTaskWindows Security
Priority SOC reference for scheduled-task persistence and task lifecycle review.
Open event guide
Event ID 4700
A scheduled task was enabled
ScheduledTaskWindows Security
Specialized SOC reference for scheduled-task persistence and task lifecycle review.
Open event guide
Event ID 4701
A scheduled task was disabled
ScheduledTaskWindows Security
Specialized SOC reference for scheduled-task persistence and task lifecycle review.
Open event guide
Event ID 4702
A scheduled task was updated
ScheduledTaskWindows Security
Priority SOC reference for scheduled-task persistence and task lifecycle review.
Open event guide
Event ID 4657
A registry value was modified
RegistryWindows Security
Priority SOC reference for registry persistence and configuration-change review.
Open event guide
Event ID 4663
An attempt was made to access an object
ObjectAccessWindows Security
Priority SOC reference for object access, ACL, and permission-change review.
Open event guide
Event ID 4670
Permissions on an object were changed
ObjectAccessWindows Security
Specialized SOC reference for object access, ACL, and permission-change review.
Open event guide
Event ID 4720
A user account was created
AccountMgmtWindows Security
High-priority SOC reference for account lifecycle and identity-change review.
Open event guide
Event ID 4722
A user account was enabled
AccountMgmtWindows Security
Priority SOC reference for account lifecycle and identity-change review.
Open event guide
Event ID 4723
An attempt was made to change an account's password
AccountMgmtWindows Security
Priority SOC reference for account lifecycle and identity-change review.
Open event guide
Event ID 4724
An attempt was made to reset an account's password
AccountMgmtWindows Security
High-priority SOC reference for account lifecycle and identity-change review.
Open event guide
Event ID 4725
A user account was disabled
AccountMgmtWindows Security
Priority SOC reference for account lifecycle and identity-change review.
Open event guide
Event ID 4726
A user account was deleted
AccountMgmtWindows Security
Priority SOC reference for account lifecycle and identity-change review.
Open event guide
Event ID 4728
A member was added to a security-enabled global group
GroupMgmtWindows Security
Priority SOC reference for privileged group membership and authorization review.
Open event guide
Event ID 4729
A member was removed from a security-enabled global group
GroupMgmtWindows Security
Specialized SOC reference for privileged group membership and authorization review.
Open event guide
Event ID 4732
A member was added to a security-enabled local group
GroupMgmtWindows Security
High-priority SOC reference for privileged group membership and authorization review.
Open event guide
Event ID 4733
A member was removed from a security-enabled local group
GroupMgmtWindows Security
Specialized SOC reference for privileged group membership and authorization review.
Open event guide
Event ID 4735
A security-enabled local group was changed
GroupMgmtWindows Security
Specialized SOC reference for privileged group membership and authorization review.
Open event guide
Event ID 4738
A user account was changed
AccountMgmtWindows Security
High-priority SOC reference for account lifecycle and identity-change review.
Open event guide
Event ID 4740
A user account was locked out
AccountMgmtWindows Security
High-priority SOC reference for account lifecycle and identity-change review.
Open event guide
Event ID 4756
A member was added to a security-enabled universal group
GroupMgmtWindows Security
Specialized SOC reference for privileged group membership and authorization review.
Open event guide
Event ID 4767
A user account was unlocked
AccountMgmtWindows Security
Priority SOC reference for account lifecycle and identity-change review.
Open event guide
Event ID 1102
The audit log was cleared
AuditLogWindows Security
High-priority SOC reference for audit-log clearing and evidence-removal review.
Open event guide
Event ID 4719
System audit policy was changed
AuditPolicyWindows Security
High-priority SOC reference for audit policy and logging coverage review.
Open event guide
Event ID 4907
Auditing settings on object were changed
AuditPolicyWindows Security
Specialized SOC reference for audit policy and logging coverage review.
Open event guide
Event ID 4616
The system time was changed
SystemWindows Security
Priority SOC reference for system lifecycle, clock, and audit health review.
Open event guide
Event ID 5140
A network share object was accessed
FileShareWindows Security
High-priority SOC reference for file-share access and lateral movement review.
Open event guide
Event ID 5145
A network share object was checked for access
FileShareWindows Security
Priority SOC reference for file-share access and lateral movement review.
Open event guide
Event ID 4103
PowerShell Module Logging
PowerShellWindows Security
High-priority SOC reference for PowerShell command and script-block investigation.
Open event guide
Event ID 4104
PowerShell Script Block Logging
PowerShellWindows Security
High-priority SOC reference for PowerShell command and script-block investigation.
Open event guide
Event ID 4608
Windows is starting up
SystemWindows Security
Specialized SOC reference for system lifecycle, clock, and audit health review.
Open event guide
Event ID 4609
Windows is shutting down
SystemWindows Security
Specialized SOC reference for system lifecycle, clock, and audit health review.
Open event guide
Event ID 4610
An authentication package has been loaded by the LSA
LSAWindows Security
Specialized SOC reference for Local Security Authority package and authentication extension review.
Open event guide
Event ID 4611
A trusted logon process has been registered with the LSA
LSAWindows Security
Specialized SOC reference for Local Security Authority package and authentication extension review.
Open event guide
Event ID 4612
Internal audit queue resources exhausted
SystemWindows Security
Specialized SOC reference for system lifecycle, clock, and audit health review.
Open event guide
Event ID 4614
A notification package has been loaded by the SAM
LSAWindows Security
Specialized SOC reference for Local Security Authority package and authentication extension review.
Open event guide
Event ID 4621
Administrator recovered system from CrashOnAuditFail
SystemWindows Security
Specialized SOC reference for system lifecycle, clock, and audit health review.
Open event guide
Event ID 4649
A replay attack was detected
LogonWindows Security
Priority SOC reference for authentication, credential use, and session triage.
Open event guide
Event ID 4675
SIDs were filtered
KerberosWindows Security
Specialized SOC reference for Kerberos authentication and ticket activity review.
Open event guide
Event ID 4692
Backup of data protection master key was attempted
DPAPIWindows Security
Specialized SOC reference for DPAPI master-key backup and recovery review.
Open event guide
Event ID 4693
Recovery of data protection master key was attempted
DPAPIWindows Security
Specialized SOC reference for DPAPI master-key backup and recovery review.
Open event guide
Event ID 4706
A new trust was created to a domain
TrustWindows Security
Priority SOC reference for domain trust relationship review.
Open event guide
Event ID 4713
Kerberos policy was changed
PolicyWindows Security
Specialized SOC reference for domain or local security policy review.
Open event guide
Event ID 4714
Encrypted data recovery policy was changed
PolicyWindows Security
Specialized SOC reference for domain or local security policy review.
Open event guide
Event ID 4715
The audit policy (SACL) on an object was changed
PolicyWindows Security
Priority SOC reference for domain or local security policy review.
Open event guide
Event ID 4716
Trusted domain information was modified
TrustWindows Security
Priority SOC reference for domain trust relationship review.
Open event guide
Event ID 4765
SID History was added to an account
AccountMgmtWindows Security
High-priority SOC reference for account lifecycle and identity-change review.
Open event guide
Event ID 4766
An attempt to add SID History to an account failed
AccountMgmtWindows Security
Priority SOC reference for account lifecycle and identity-change review.
Open event guide
Event ID 4780
ACL was set on accounts in administrators groups
ObjectAccessWindows Security
Priority SOC reference for object access, ACL, and permission-change review.
Open event guide
Event ID 4794
An attempt was made to set the Directory Services Restore Mode
DSRMWindows Security
High-priority SOC reference for Directory Services Restore Mode password-change review.
Open event guide
Event ID 4964
Special groups have been assigned to a new logon
LogonWindows Security
Priority SOC reference for authentication, credential use, and session triage.
Open event guide
Event ID 5027
Windows Firewall Service unable to retrieve security policy
FirewallWindows Security
Specialized SOC reference for Windows Firewall service and policy-health review.
Open event guide
Event ID 5028
Windows Firewall Service unable to parse new security policy
FirewallWindows Security
Specialized SOC reference for Windows Firewall service and policy-health review.
Open event guide
Event ID 5030
The Windows Firewall Service failed to start
FirewallWindows Security
Priority SOC reference for Windows Firewall service and policy-health review.
Open event guide
Event ID 5035
The Windows Firewall Driver failed to start
FirewallWindows Security
Priority SOC reference for Windows Firewall service and policy-health review.
Open event guide
Event ID 5038
Code integrity determined image hash is not valid
CodeIntegrityWindows Security
Priority SOC reference for code integrity and image tampering review.
Open event guide
Event ID 5376
Credential Manager credentials were backed up
CredentialMgrWindows Security
Priority SOC reference for Credential Manager backup and restore review.
Open event guide
Event ID 5377
Credential Manager credentials were restored from backup
CredentialMgrWindows Security
Priority SOC reference for Credential Manager backup and restore review.
Open event guide
Event ID 5827
Netlogon denied a vulnerable secure channel connection (machine)
NetlogonWindows Security
Priority SOC reference for Netlogon secure-channel enforcement review.
Open event guide
Event ID 5828
Netlogon denied a vulnerable secure channel connection (trust)
NetlogonWindows Security
Priority SOC reference for Netlogon secure-channel enforcement review.
Open event guide
Event ID 6145
Errors occurred while processing security policy in GPOs
GroupPolicyWindows Security
Specialized SOC reference for Group Policy security settings processing review.
Open event guide