HackBlue

Tools · Workbench

Windows security and Event Logs

Tutorials on Windows Event IDs, PowerShell logging, Microsoft Defender, local accounts, services, and the audit policy that decides what gets recorded.

  • 27 lessons
  • 4.5 h of reading
  • 6 topics
Start with lesson 1All workbenches

Windows writes a remarkable amount of security evidence, but only if the audit policy asks for it and someone knows which event to open. These tutorials cover the event IDs people search for most, the PowerShell to query them, and the settings that make the log worth reading.

Use a Windows VM or a test machine you administer. Changes to audit policy and Defender are shown on a single host first.

Event IDs

11 lessons

  1. 01How to read Windows Event ID 4625: failed logons, status codes, and logon typesDecode the fields in a 4625 event, translate status and sub-status codes like 0xC000006A, and tell password guessing from a stale saved credential.12 min
  2. 02Windows Event ID 4624 logon types explained: 2, 3, 5, 7, 10, and 11Understand each logon type in a successful 4624 event, which ones expose credentials on the target, and how to filter out the noise from service logons.11 min
  3. 03Windows Event ID 4688: enable process creation logging with command linesTurn on process creation auditing and command-line capture, read parent and child process fields, and spot suspicious command lines.10 min
  4. 04Windows account creation and change events: 4720, 4722, 4724, 4726, and 4738Track who created, enabled, reset, changed, or deleted a user account, and alert on accounts created outside your provisioning process.9 min
  5. 05Detect privileged group changes: Event IDs 4728, 4732, and 4756Know which event fires for global, local, and universal security groups, and alert on additions to Domain Admins, Administrators, and other privileged groups.9 min
  6. 06Event ID 1102 and 104: detecting cleared Windows event logsRecognize when the Security or other logs were cleared, find who did it, and make sure the evidence already left the machine.8 min
  7. 07Event ID 7045 and 4697: detecting new Windows servicesFind newly installed services in the System and Security logs, read the image path, and separate software installs from malicious service creation.9 min
  8. 08Event ID 4698: how to detect new scheduled tasks on WindowsEnable the audit setting for scheduled task events, read the task XML inside 4698, and compare against the Task Scheduler operational log.9 min
  9. 09Find the source of an Active Directory account lockout with Event ID 4740Locate the PDC emulator, read the Caller Computer Name in 4740, then follow 4625 and 4771 on that host to find the stale credential or attacker.9 min
  10. 10Event ID 4672: tracking administrator logons with special privilegesUse 4672 to see when accounts with administrative privileges log on, link it to 4624 by Logon ID, and build a list of who acts as an admin where.8 min
  11. 11How to investigate Remote Desktop logons: Event IDs 1149, 4624 type 10, 21, 24, and 25Reconstruct RDP sessions across the Security and TerminalServices logs: connection, authentication, logon, disconnect, and reconnect.11 min

Log tooling

4 lessons

  1. 01Get-WinEvent tutorial: fast filtering with FilterHashtable and XPathQuery Windows event logs efficiently from PowerShell, extract fields from event XML, query remote machines, and avoid the slow Where-Object trap.11 min
  2. 02Windows advanced audit policy: what to enable with auditpol and Group PolicyCheck the effective audit policy with auditpol, enable the subcategories that produce useful security events, and avoid the legacy-policy conflict.11 min
  3. 03How to set Windows event log size and export logs with wevtutilCheck how many hours your Security log actually holds, raise its maximum size, and export logs to .evtx files for investigation.8 min
  4. 04Windows Event Forwarding (WEF) setup: collect security logs without an agentConfigure a Windows Event Collector, create a source-initiated subscription by Group Policy, and forward selected Security and PowerShell events.11 min

PowerShell logging

3 lessons

  1. 01PowerShell script block logging: enable Event ID 4104 and read itTurn on script block logging, find 4104 events in the PowerShell Operational log, reassemble long scripts, and see decoded commands that obfuscation tried to hide.11 min
  2. 02PowerShell transcription and module logging (Event ID 4103) explainedCompare script block logging, module logging, and transcription, enable transcripts to a protected share, and know what each one captures.9 min
  3. 03PowerShell execution policy explained: why it is not a security boundaryUnderstand Restricted, RemoteSigned, AllSigned, and Bypass, how scopes combine, and which controls actually stop untrusted scripts.8 min

Hardening

3 lessons

  1. 01AppLocker vs App Control for Business (WDAC): application allowlisting basicsUnderstand how each allowlisting technology decides what may run, start with audit mode, read the block events, and roll out rules safely.11 min
  2. 02Windows Defender Firewall with PowerShell: profiles, rules, and loggingCheck firewall profiles, list inbound allow rules, scope a rule to a management subnet, and turn on dropped-packet logging.9 min
  3. 03BitLocker basics: check encryption status and protect recovery keysCheck BitLocker state with manage-bde and Get-BitLockerVolume, understand TPM and PIN protectors, and back up recovery keys to AD or Entra ID.9 min

Microsoft Defender

3 lessons

  1. 01Check Microsoft Defender status and run scans with PowerShellUse Get-MpComputerStatus, Get-MpPreference, Update-MpSignature, and Start-MpScan to confirm Defender is healthy, current, and not weakened by exclusions.9 min
  2. 02Microsoft Defender Attack Surface Reduction rules: audit, enable, and read eventsTurn on ASR rules in audit mode, read Event IDs 1121 and 1122, and enable the high-value rules that block Office child processes and credential theft from LSASS.11 min
  3. 03Microsoft Defender event IDs: 1116 detections, 5001 protection off, 5007 config changesKnow the Defender Operational log events that matter for detection and tampering, and query them across a lab machine.8 min

Accounts and services

3 lessons

  1. 01Windows LAPS: unique local administrator passwords on every machineUnderstand why shared local admin passwords enable lateral movement, enable built-in Windows LAPS, and retrieve and rotate a password safely.10 min
  2. 02Auditing Windows services: unquoted paths, weak permissions, and service accountsFind services with unquoted paths containing spaces, binaries in writable folders, and services running as privileged user accounts, and fix them.10 min
  3. 03How to use Sysinternals Autoruns to review Windows startup persistenceUse Autoruns and autorunsc to list Run keys, services, tasks, WMI subscriptions, and more, hide signed Microsoft entries, and compare against a baseline.10 min