killchain-compendium/Forensics/Windows Event Logs.md

# Windows Event Log

## Dump Logfile

Windows event logs can be found under `C:\Windows\System32\winevt\Logs`.
Windows Event Logfiles can also be dumped via

```sh
evtx_dump $EVENT_LOG > event.log
evtx_dump -o json $EVENT_LOG > event.log
```

## Query Windows Events

One method is to use the GUI Tool `Event Viewer`, another method is to use Powershell.

Use `Win-Event` to filter categories like Security or System (same categories
like in `Event Viewer`) and Event IDs throught the following line.

```sh
Get-WinEvent -FilterHashTable @{LogName='<Category>';ID='<Event IDs>'} | fl
```

## Event IDs

### Process

* **1**: Process Creation (Applications & Services -> Microsoft -> Windows ->
  Sysmon -> Operational)
* **10**: ProcessAccess, Sysmon event where one process  opens a handle to another process
* **4688**: Process Creation (Windows Logs -> Security)

### Files

* **11**: File opened/created (Applications & Services -> Microsoft -> Windows ->
  Sysmon -> Operational)
* **4656**: File changed (Windows Logs -> Security)
* **13**: Registry value set (Applications & Services -> Microsoft -> Windows ->
  Sysmon -> Operational)
* **4657**: Registry value set (Windows Logs -> Security)

### Network

* **3** Network connection (Sysmon, path shown above)
* **22** DNS query (Sysmon, path shown above)

### Account Management

The `subject` is the account doing an action on an `object`.

* **4719**: Attempt to change a policy
* **4720**: User account creation
* **4722**: User account enabled
* **4723**: Attempt to change an account password. The user attempts to change
  their password
* **4724**: Attempt to reset the account password. The user attempts to reset
  the password of another account
* **4725**: Account disabled
* **4726**: Account removed from systemved from system
* **4728**: Attempt to add an account to a global security group (logged domain wide)
* **4729**: Attempt to remove an account from a global security group
* **4732**: User was added to a security group (like Administrators, logged on local or DC)
* **4733**: User was removed from a security group (like Administrators)
* **4738**: User account properties were changed
* **4740**: User account was locked after repeated attempt of access
* **4756**: Attempt to add an account to a universal security group (logged on entire ad forest)
* **4757**: Attempt to remove an account from a universal security group
* **4768**: Kerberos TGT request
* **4769**: Kerberos TGS request
* **4771**: Kerberos pre-auth failure
* **4776**: Validate NTLM credentials at DC. This happens when the resource is
  accessed via IP address, for legacy applications without Kerberos support or
  auth between untrusted DC domains

### Account Logon

These can be found via `Event Viewer` under `Windows Logs` -> `Security`.
The `Logon ID` is the session identifier.

* **4624**: Successful logon/login, Session created on target resource
* **4625**: Failed logon/login
* **4634** and **4647**: Logoff
* **4648**: Login Using Explicit Credentials (e.g. from another user through
  `net use /user:`)
* **4779**: Session disconnect

### AD & Entra ID

* **50126**: Invalide username or password
* **50053**: Account locked, because too many attempts were failed
* **50074**: MFA required but not provided
* **50055**: Password expired

### Active Directory Objects

* **5136**: Attribute-level modification on AD object (e.g. Group Policy Objects)
* **5137**: Directory service object was created
* **5140**: Object Access
* **5145**: Shared Access

#### Network Policy Server

RADIUS connection via VPN.

* **6272**: Network Policy Server granted access (e.g. VPN login)
* **6273**: Network Policy Server denied access (e.g. VPN login failed)
* **6274**: Network Policy Server discarded the request (e.g. incorrect request)

### Logon Types

* **2**: Interactive
* **3**: Network (e.g. SMB, PsExec)
* **4**: Batch
* **5**: Service
* **7**: Unlock, when Session is already established in some other way
* **10**: RDP

### Scheduled Tasks

* **4698**: Scheduled task creation
* **4702**: Scheduled task updated
* **4699**: Scheduled task deletion

* **106** Task registered
* **100** Task started
* **129** Created Task Process
* **200** Task launched action
* **201** Task completed

### System

* **7045**: Service installation
* **17**: Service creates named pipes for stdin, stdout and stderr

### Security

These can be found via `Event Viewer` under `Windows Logs` -> `Security`

* **1100**: Logging service disabled
* **1102**: Log deletion
* **1116**: Windows Defender Malware detection
* **1117**: Windows Defender Malware quarantined
* **4697**: Service installation (subsection of **7045**)
* **5001**: Windows Defender disabled
* **5007**: Windows Defender configuration changed

### Powershell

Applications and Services Logs -> Windows Powershell and Apps and Services Logs
-> Microsoft -> Windows -> Powershell -> Operational

* **600**: Opening Powershell
* **4104**: Powershell command executed

In addition check Powershell's history file on path
`C:\Users\%USER%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt`

## RDP

Applications and Services Logs -> Microsoft -> Windows ->
TerminalServices-LocalSessionManager -> Operational

* **21**: RDP Connect
* **24**: RDP Disconnect
* **25**: RDP Reconnect