knowledge

Overview

Windows Event Logs are structured records of system activity generated by Windows components, applications, drivers, and services. They serve as the primary audit and forensic data source on Windows systems — SOC analysts use them to detect attacks, incident responders use them to reconstruct timelines, and pentesters review them to understand the environment or cover tracks. Logs are stored in .evtx format, accessible via Event Viewer, wevtutil, Get-WinEvent, or SIEM ingestion agents.

Default log storage path: C:\Windows\System32\winevt\logs

Terminology

TermDefinition
EventAn individual record entry in an event log; the atomic unit of log data
Event IDA numeric identifier that uniquely identifies the type of event within its source
ChannelA logical destination for events — organizes events by source and type (e.g., Security, System)
ProviderThe component or application that generates and publishes events (e.g., Microsoft-Windows-Security-Auditing)
SACLSystem Access Control List; records access attempts to secured objects in the Security log
ACEAccess Control Entry; individual rule within an ACL or SACL that defines what access triggers auditing
Logon TypeNumeric code indicating how a logon occurred (2=interactive, 3=network, 4=batch, 5=service, 7=unlock, 10=remote interactive)
.evtxWindows XML Event Log file format; binary container for event records
ETLEvent Trace Log; binary file produced by ETW-based tracing
Forwarded EventsLog that aggregates events pushed from remote hosts via Windows Event Forwarding (WEF)
SubscriptionA WEF configuration that defines which events to collect from which remote machines

Core Concepts

Default Log Channels

LogPurpose
ApplicationEvents from installed software and application-layer components
SecurityLogon events, object access, privilege use, policy changes, and account management
SetupEvents generated during Windows installation; Active Directory-related events on domain controllers
SystemEvents from Windows OS components — drivers, services, hardware
Forwarded EventsAggregated events forwarded from remote hosts via WEF

Beyond these five, Windows has hundreds of additional logs under Applications and Services Logs — including Microsoft-Windows-Sysmon/Operational, Microsoft-Windows-PowerShell/Operational, and Microsoft-Windows-WinRM/Operational.

Anatomy of an Event Record

Every event contains the following fields:

FieldDescription
Log NameThe channel the event was written to (e.g., Security, System)
SourceThe provider or application that generated the event
Event IDThe numeric identifier for the event type
Task CategorySub-classification within the source (e.g., “Logon” within the Security provider)
LevelSeverity of the event — see severity table below
KeywordsFiltering tags applied by the provider (e.g., Audit Success, Audit Failure)
UserAccount context under which the event was generated
ComputerHostname of the system that generated the event
Date and TimeUTC timestamp of when the event occurred
DescriptionHuman-readable text that varies per Event ID and includes key forensic data
Event DataStructured XML data containing event-specific fields (e.g., SubjectLogonId, TargetUserName)

The Keywords field is especially useful in Event Viewer for filtering by Audit Success vs Audit Failure. Event Data fields (like SubjectLogonId) enable correlation across events — an analyst can trace all activity tied to a specific logon session.

Severity Levels

LevelValueMeaning
Critical1Significant failure requiring immediate attention
Error2Non-critical issue related to a service or component
Warning3Potential problem worth investigating
Information4Normal operational event
Verbose5Diagnostic or progress messages

SACL and Object Access Auditing

A System Access Control List (SACL) enables administrators to log access attempts to secured objects — files, registry keys, processes, Active Directory objects. Each ACE within a SACL specifies:

  • The trustee (user or group) whose access should be audited
  • The access types that trigger an event (read, write, delete, etc.)
  • Whether to log successes, failures, or both

SACL-triggered events appear in the Security log. Without a SACL configured on the target object, events like 4656 (handle requested) and 5145 (share object access check) will not fire. SACL configuration is done through the Advanced Security Settings for a file or object.

A comprehensive list of Windows privileges: https://docs.microsoft.com/en-us/windows/win32/secauthz/privilege-constants

Custom XML Queries in Event Viewer

Event Viewer’s built-in filters only expose common fields. For precise, multi-condition filtering, use raw XML queries:

Path: Filter Current Log → XML tab → Edit Query Manually

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[EventData[Data[@Name='SubjectLogonId']='0x3E7']]
    </Select>
  </Query>
</QueryList>

This example retrieves all Security events where the SubjectLogonId equals 0x3E7 (the SYSTEM account’s logon ID) — useful for filtering all events performed under the SYSTEM context.

XML queries support:

  • Filtering on any EventData field by name and value
  • System-level fields (EventID, Level, TimeCreated)
  • Boolean operators (and, or)
  • Multiple <Select> paths in a single query

Reference: https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/advanced-xml-filtering-in-the-windows-event-viewer/ba-p/399761

Accessing Event Logs

MethodDescription
Event Viewer GUIeventvwr.msc — view, filter, export; can open saved .evtx files via “Open Saved Log”
wevtutil (CMD)Query, export, clear, and manage logs from the command line — see Windows Command Line
Get-WinEvent (PS)PowerShell cmdlet with advanced filtering via FilterHashtable, FilterXML, FilterXPath — see Windows PowerShell
Windows Event ForwardingCollects logs from remote hosts centrally without agents; configured via subscriptions
SIEM AgentsBeats/Winlogbeat, NXLog, or Splunk Universal Forwarder ship logs to a central SIEM — see Elastic Stack, Intro to SIEM

Important Windows Event IDs

System Log Events

Event IDEvent NameSecurity Relevance
1074System Shutdown / RestartRecords initiating process, type (shutdown/restart), and reason code — useful for correlating with suspicious activity or post-exploitation cleanup
6005Event Log Service StartedSystem startup indicator; establishes timeline anchors
6006Event Log Service StoppedSystem shutdown indicator; establishes timeline anchors
6013Windows UptimeReports uptime in seconds — confirms system was not recently rebooted (important for volatile memory preservation decisions)
7040Service Start Type ChangedA service’s startup type was modified (e.g., Automatic → Disabled or Manual → Auto) — attackers modify service startup for persistence
7045New Service InstalledA new service was installed — common persistence and privilege escalation vector; review the service binary path for suspicious paths

Security Log Events

Event IDEvent NameSecurity Relevance
1102Audit Log ClearedThe Security audit log was cleared — highest-priority post-exploitation anti-forensics indicator; immediate investigation required
1116Antimalware DetectionWindows Defender detected malware — note the threat name, file path, and detection action
1118Antimalware Remediation StartedDefender began removing the detected threat
1119Antimalware Remediation SucceededDefender successfully removed the threat
1120Antimalware Remediation FailedDefender failed to remove the threat — file may still be present
4624Successful LogonA user account successfully logged on — inspect Logon Type and LogonID for context
4625Failed LogonLogon attempt failed — high-frequency failures indicate brute force; review Failure Reason and TargetUserName
4648Logon with Explicit CredentialsA process used explicit credentials (e.g., RunAs, lateral movement via Pass-the-Hash) — Source and Target account mismatch is suspicious
4656Handle to Object RequestedA process requested a handle to a secured object — only fires if a SACL is configured on the target object
4672Special Privileges Assigned to New LogonA privileged account logged on with sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, etc.) — indicates admin or SYSTEM-level access
4698Scheduled Task CreatedA new scheduled task was created — common attacker persistence mechanism; review the task action and trigger
4700Scheduled Task EnabledA previously disabled scheduled task was re-enabled
4701Scheduled Task DisabledA scheduled task was disabled — attacker may be disabling defensive tasks
4702Scheduled Task UpdatedAn existing scheduled task’s configuration was modified
4719System Audit Policy ChangedThe system audit policy was modified — attackers may disable audit categories to suppress future logging
4738User Account ChangedA user account’s properties were modified (password reset, group membership, account enabled/disabled)
4771Kerberos Pre-Authentication FailedFailed Kerberos TGT request — AS-REP Roasting or brute force against domain accounts
4776NTLM Authentication AttemptThe DC attempted to validate NTLM credentials — failed attempts indicate NTLM brute force or credential spraying
5001Windows Defender Real-Time Protection ChangedReal-time protection was disabled or its configuration was altered — strong indicator of attacker disabling AV
5140Network Share Was AccessedA network share object was accessed — review ShareName, SubjectUserName, and IpAddress for lateral movement indicators
5145Network Share Object Access CheckDetailed permission check on a shared folder/file; only fires if SACL is configured
5157Windows Filtering Platform Blocked ConnectionWindows Firewall blocked an outbound or inbound connection — may indicate C2 or lateral movement attempts being stopped

Log Storage and Rotation

Event logs have configurable maximum sizes and retention behaviors:

ModeBehavior
Circular (Overwrite as needed)New events overwrite oldest events when the log is full — default for most logs
Retain (Archive the log, do not overwrite)Log is archived when full; no new events until manually cleared
AutoBackupLog is automatically backed up and cleared when full

Security log size should be increased significantly in high-activity environments — the default 20 MB fills quickly under attack conditions. Centralized log forwarding (SIEM or WEF) protects against local log clearing (Event ID 1102).

References / Images