Windows generates thousands of events. Knowing the handful that matter turns a firehose into a story.
Authentication
- 4624 - successful logon (check the Logon Type: 2 interactive, 3 network, 10 RDP).
- 4625 - failed logon. A burst from one source then a 4624 = successful brute force / spray.
- 4768 / 4769 - Kerberos TGT / service-ticket requests (Kerberoasting shows up in 4769).
- 4776 - NTLM authentication.
Execution & persistence
- 4688 - a new process was created (enable command-line auditing to get the args).
- Sysmon 1 - richer process creation (parent, hashes, command line) - the detection engineer's favorite.
- 7045 - a new service was installed (odd, random service names = lateral movement / persistence).
- 4698 - a scheduled task was created.
Defense evasion (attacker cleanup)
- 1102 - the Security log was cleared. High-signal: legitimate admins rarely clear logs.
- Sysmon 4 - Sysmon service state changed (someone stopping your telemetry).
The pro move: forward everything off-box
Attackers clear local logs (1102). If your logs are already forwarded to a SIEM, clearing the host achieves nothing - and the clear event itself becomes an alert.