Windows Event IDs Every SOC Analyst Should Know

In a Security Operations Center, many investigations begin with logs. When an alert says “possible brute-force attack,” “suspicious login,” “new admin user created,” or “malware executed,” a SOC Analyst often checks Windows Event Logs to understand what actually happened.

Windows Event IDs help analysts answer important questions:

• Who logged in?
• Was the login successful or failed?
• Which machine was accessed?
• Was the account locked out?
• Was a new user created?
• Was a user added to an admin group?
• Was a suspicious process executed?
• Was a new service installed?
• Was the security log cleared?

This guide explains the most useful Windows Event IDs for beginner and entry-level SOC Analysts.

What Are Windows Event IDs?

Windows Event IDs are numeric identifiers assigned to specific activities logged by Windows. Each Event ID represents a type of event, such as successful login, failed login, account lockout, user creation, process creation, service installation or audit log clearing.

For SOC Analysts, Event IDs are useful because they convert system activity into searchable evidence. In SIEM tools such as Splunk, Microsoft Sentinel, QRadar or Elastic, analysts can search these event IDs to investigate suspicious activity.

Why Windows Event IDs Matter for SOC Analysts

Windows is widely used in enterprise environments. Active Directory, Windows servers, user workstations, domain controllers and business applications all generate security-relevant events. These events are very important for detecting attacks such as credential theft, brute-force attempts, lateral movement, privilege escalation and malware execution.

SOC Analysts Use Windows Event IDs To Investigate:

• Successful and failed logons
• Brute-force attacks
• Account lockouts
• Suspicious administrator activity
• New user account creation
• User added to privileged group
• Service installation
• Suspicious process execution
• PowerShell activity
• Event log clearing
• Lateral movement attempts

Where Are Windows Event Logs Found?

Windows Event Logs can be viewed locally using Event Viewer. In enterprise environments, these logs are usually forwarded to a SIEM or log management platform.

Common Windows Log Locations

Windows Event IDs for Logon and Authentication

Authentication events help SOC Analysts investigate account compromise, brute-force attacks, lateral movement, RDP activity and suspicious access patterns.

1 Event ID 4624 — Successful Logon

Event ID 4624 means an account successfully logged on. Microsoft says this event is generated when a logon session is created on the destination machine. It is one of the most important event IDs for SOC investigations. :contentReference[oaicite:1]{index=1}

Why SOC Analysts Care

• Detect successful login after multiple failures
• Identify unusual login times
• Check logins from suspicious hosts
• Investigate lateral movement
• Review admin account usage

Important Fields to Check

• Account Name
• Logon Type
• Source Network Address
• Workstation Name
• Authentication Package
• Logon Process
• Target Server

2 Event ID 4625 — Failed Logon

Event ID 4625 means an account failed to log on. Microsoft’s audit policy reference lists Event ID 4625 as “An account failed to log on.” :contentReference[oaicite:2]{index=2}

Why SOC Analysts Care

• Detect brute-force attacks
• Identify password spraying attempts
• Find repeated failures against privileged accounts
• Investigate failed RDP or VPN logins
• Detect attempts against disabled or unknown accounts

Important Fields to Check

• Account Name
• Failure Reason
• Status and Sub Status
• Source Network Address
• Logon Type
• Workstation Name

3 Event ID 4634 — Logoff

Event ID 4634 means an account was logged off. Microsoft Sentinel’s Windows security event set reference includes user sign-in and sign-out events such as 4624 and 4634. :contentReference[oaicite:3]{index=3}

Why SOC Analysts Care

• Helps build user activity timeline
• Confirms session termination
• Supports investigation of unusual session duration
• Useful during incident reconstruction

4 Event ID 4648 — Logon Using Explicit Credentials

Event ID 4648 indicates that a logon was attempted using explicit credentials. This can be normal for administrative work, but it can also be useful for detecting lateral movement or credential misuse.

Why SOC Analysts Care

• Detect use of alternate credentials
• Investigate lateral movement
• Identify admin account usage from unusual hosts
• Correlate with remote access activity

5 Event ID 4672 — Special Privileges Assigned to New Logon

Event ID 4672 indicates that special privileges were assigned to a new logon. This commonly appears when privileged accounts log in.

Why SOC Analysts Care

• Monitor privileged account usage
• Detect admin logins at unusual times
• Correlate with account compromise events
• Track high-risk user activity

Windows Event IDs for Account Management

Account management events help SOC Analysts detect unauthorized user creation, deletion, password resets and account changes.

6 Event ID 4720 — User Account Created

Event ID 4720 means a user account was created. This is important because attackers may create new accounts to maintain access.

Why SOC Analysts Care

• Detect unauthorized user creation
• Investigate persistence attempts
• Monitor helpdesk/admin account activity
• Correlate with privileged group additions

What to Check

• Who created the account?
• What account was created?
• Was it created during business hours?
• Was it later added to a privileged group?
• Was it used for login shortly after creation?

7 Event ID 4722 — User Account Enabled

Event ID 4722 means a user account was enabled. This can be normal, but it may be suspicious if an old or disabled account is re-enabled unexpectedly.

8 Event ID 4725 — User Account Disabled

Event ID 4725 means a user account was disabled. This is useful for account lifecycle monitoring and incident response actions.

9 Event ID 4726 — User Account Deleted

Event ID 4726 means a user account was deleted. Unauthorized deletion of accounts may indicate malicious activity, insider risk or cleanup attempts.

10 Event ID 4723 and 4724 — Password Change or Reset

Event ID 4723 is related to password change attempts, while Event ID 4724 is related to password reset attempts. These events are useful during compromised account investigations.

Windows Event IDs for Group and Privileged Access Changes

Attackers often try to increase privileges after gaining access. Group membership changes are therefore very important for SOC Analysts.

11 Event ID 4728 — Member Added to Global Security Group

Event ID 4728 indicates a member was added to a security-enabled global group. This is important when the group is privileged.

12 Event ID 4732 — Member Added to Local Security Group

Event ID 4732 indicates a member was added to a security-enabled local group. This can be important when users are added to local administrators groups.

13 Event ID 4756 — Member Added to Universal Security Group

Event ID 4756 indicates a member was added to a security-enabled universal group. In Active Directory environments, this may be important for privilege and access monitoring.

Why SOC Analysts Care

• Detect privilege escalation
• Monitor admin group changes
• Identify unauthorized access expansion
• Investigate insider activity
• Correlate with new account creation

Windows Event IDs for Account Lockout and Kerberos/NTLM Authentication

14 Event ID 4740 — User Account Locked Out

Event ID 4740 means a user account was locked out. It is useful for detecting brute-force attacks, password spraying, misconfigured services or user password issues.

What to Check

• Locked account name
• Caller computer name
• Time of lockout
• Failed login events before lockout
• Whether multiple accounts were locked
• Whether a single source is causing lockouts

15 Event ID 4768 — Kerberos Authentication Ticket Requested

Event ID 4768 is generated when the Key Distribution Center issues a Kerberos Ticket Granting Ticket on a domain controller. Microsoft describes it as an event generated each time the KDC issues a Kerberos TGT. :contentReference[oaicite:4]{index=4}

16 Event ID 4769 — Kerberos Service Ticket Requested

Event ID 4769 is related to Kerberos service ticket requests. It can be useful in domain authentication and lateral movement investigations.

17 Event ID 4771 — Kerberos Pre-Authentication Failed

Event ID 4771 is useful when investigating Kerberos authentication failures. Repeated pre-authentication failures may indicate password guessing, password spraying or misconfigured systems.

18 Event ID 4776 — NTLM Authentication Attempt

Event ID 4776 is related to NTLM authentication. It can help identify NTLM-based authentication failures or account misuse patterns.

Windows Event IDs for Process Execution, Services and PowerShell

Process execution and service events are important because attackers often run commands, scripts, tools and malware after gaining access.

19 Event ID 4688 — New Process Created

Event ID 4688 indicates a new process was created. This event is extremely useful if command-line auditing is enabled.

Why SOC Analysts Care

• Detect suspicious PowerShell
• Identify malware execution
• Review command-line activity
• Investigate living-off-the-land techniques
• Correlate process execution with user login activity

Suspicious Process Examples

• powershell.exe with encoded commands
• cmd.exe launching suspicious scripts
• wscript.exe or cscript.exe executing unknown files
• rundll32.exe executing unusual DLL paths
• regsvr32.exe used with remote content
• certutil.exe downloading files

20 Event ID 4104 — PowerShell Script Block Logging

Event ID 4104 appears in PowerShell operational logs when script block logging is enabled. It is useful for reviewing suspicious PowerShell commands and scripts.

Why SOC Analysts Care

• Detect encoded or obfuscated PowerShell
• Review downloaded scripts
• Identify credential theft commands
• Investigate suspicious automation
• Correlate with malware or lateral movement

21 Event ID 7045 — New Service Installed

Event ID 7045 is generated when a new service is installed on the system. Attackers may create services for persistence or remote execution.

What to Check

• Service name
• Service file path
• Account used to create the service
• Timestamp
• Whether the service name is suspicious
• Whether the binary path is unusual

22 Event ID 4697 — Service Installed in the System

Event ID 4697 can also indicate that a service was installed. Depending on auditing and log source, analysts may look at both 7045 and 4697 when investigating suspicious service activity.

Windows Event IDs for Scheduled Tasks, Shares and File Access

23 Event ID 4698 — Scheduled Task Created

Event ID 4698 means a scheduled task was created. Attackers may create scheduled tasks for persistence, execution or repeated malicious activity.

What to Check

• Task name
• Task action
• Command or script path
• User who created the task
• Execution schedule
• Whether the task name tries to look legitimate

24 Event ID 5140 — Network Share Accessed

Event ID 5140 indicates a network share object was accessed. It can help investigate lateral movement, file access and suspicious share enumeration.

25 Event ID 5145 — Detailed File Share Access

Event ID 5145 provides more detailed information about file share access. It can be useful when investigating unauthorized file access or data exposure.

26 Event ID 4663 — Object Access Attempt

Event ID 4663 indicates an attempt to access an object such as a file, folder or registry key, when auditing is configured. It can be useful for sensitive file access monitoring.

Windows Event IDs for Defense Evasion and Audit Changes

Attackers may try to hide their activity by clearing logs or changing audit settings. These events should be treated seriously.

27 Event ID 1102 — Audit Log Cleared

Event ID 1102 indicates that the audit log was cleared. This is a high-risk event because attackers often clear logs to remove evidence.

Why SOC Analysts Care

• Detect possible evidence destruction
• Investigate insider activity
• Correlate with admin logins
• Review activity before log clearing
• Escalate if unauthorized

28 Event ID 4719 — System Audit Policy Changed

Event ID 4719 indicates that system audit policy was changed. Attackers may change auditing to reduce visibility.

29 Event ID 4616 — System Time Changed

Event ID 4616 means the system time was changed. Time changes can affect log timelines and may be suspicious in some investigations.

Windows Defender and Malware-Related Event IDs

Microsoft Defender events can help SOC Analysts investigate malware detections and endpoint protection activity.

30 Event ID 1116 — Malware Detected

Event ID 1116 is commonly associated with Microsoft Defender detecting malware. SOC Analysts should check the threat name, file path, action taken and affected host.

31 Event ID 1117 — Malware Action Taken

Event ID 1117 is commonly associated with action taken against detected malware, such as quarantine or removal.

32 Event ID 5007 — Defender Configuration Changed

Event ID 5007 can indicate configuration changes in Microsoft Defender. Security teams should review unexpected changes to protection settings.

Windows Event ID Cheat Sheet for SOC Analysts

Practical Investigation Example 1: Brute-Force Attack

Scenario: SIEM generates an alert for multiple failed logins for one user account.

Events to Check

• 4625: Failed logon attempts
• 4624: Successful logon after failures
• 4740: Account lockout
• 4771/4776: Kerberos or NTLM authentication failures

Investigation Questions

• Which account was targeted?
• How many failed logins occurred?
• What source IP or host caused the failures?
• Was there a successful login after failures?
• Was MFA triggered or bypassed?
• Were other accounts targeted from the same source?
• Is the source internal, VPN, cloud or external?

Practical Investigation Example 2: Suspicious Admin Account Creation

Scenario: A new user account was created and added to an administrator group.

Events to Check

• 4720: User account created
• 4732: Member added to local security group
• 4728: Member added to global security group
• 4624: Successful logon by new account
• 4672: Special privileges assigned

Investigation Questions

• Who created the account?
• Was the action approved?
• Was the account added to an admin group?
• Was the account used immediately?
• Was this performed outside business hours?
• Was the creator account compromised?

Practical Investigation Example 3: Suspicious PowerShell Activity

Scenario: EDR or SIEM alerts on suspicious PowerShell execution.

Events to Check

• 4688: PowerShell process creation
• 4104: PowerShell script block logging
• 4624: User login before execution
• 7045: Service created after script execution
• 4698: Scheduled task created after script execution

Investigation Questions

• Who executed PowerShell?
• What was the command line?
• Was it encoded or obfuscated?
• Did it download external content?
• What process launched PowerShell?
• Did it create persistence?
• Did it connect to suspicious domains or IPs?

Sample SIEM Query Ideas for Windows Event IDs

Exact syntax depends on your SIEM tool. The logic below can be adapted for Splunk, Microsoft Sentinel, QRadar or Elastic.

Common Mistakes Beginner SOC Analysts Make

SOC Interview Questions on Windows Event IDs

Useful Official Resources

• Microsoft: Windows Security Event ID Reference
• Microsoft: Windows Event Forwarding for Intrusion Detection
• Microsoft: Events to Monitor
• Microsoft: SecurityEvent Query Examples
• MITRE ATT&CK Framework

Related Career Guides

• SIEM Tools Explained for Beginners
• Top 40 SOC Analyst Interview Questions and Answers
• How to Investigate a Phishing Email
• SOC Analyst Career Roadmap 2026
• SOC Analyst Training Program

Final Thoughts: Windows Event IDs Are Core SOC Skills

Windows Event IDs are one of the most practical skills for SOC Analysts. They help you investigate logins, failed logins, account changes, privilege usage, process execution, PowerShell activity and defense evasion.

You do not need to memorize hundreds of events. Start with the core events in this article, understand the investigation context, and practice building timelines from multiple logs.

Frequently Asked Questions