<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-windows-event-logs
description: >-
  Parse, filter, and correlate Windows Event Logs for threat detection and
  forensic analysis. Covers Security, System, Sysmon, and PowerShell logs
  with key Event IDs for authentication, process creation, and persistence.
domain: cybersecurity
subdomain: blue-team
tags:
  - windows-event-logs
  - forensics
  - siem
  - threat-hunting
  - incident-response
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1070.001"]
---

# Analyzing Windows Event Logs

## Overview

Windows Event Logs are the primary telemetry source for detecting adversary
activity on Windows systems. Security, System, Sysmon, and PowerShell
operational logs provide authentication events, process creation, service
installation, scheduled tasks, and script execution visibility.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Windows Event Viewer or `wevtutil` | Native log access |
| PowerShell `Get-WinEvent` | Programmatic log queries |
| Sysmon installed | Enhanced process/network telemetry |
| Python `python-evtx` | Offline EVTX parsing (`pip install python-evtx`) |
| Log forwarding (WEF/WEC) | Centralized collection |

## Key Concepts

### Critical Security Event IDs

| Event ID | Log | Description | ATT&CK |
|---|---|---|---|
| 4624 | Security | Successful logon | T1078 |
| 4625 | Security | Failed logon | T1110 |
| 4648 | Security | Explicit credential logon | T1078 |
| 4672 | Security | Special privileges assigned | T1078 |
| 4688 | Security | Process creation | T1059 |
| 4698 | Security | Scheduled task created | T1053.005 |
| 4720 | Security | User account created | T1136.001 |
| 4732 | Security | Member added to local group | T1098 |
| 7045 | System | Service installed | T1543.003 |
| 1102 | Security | Audit log cleared | T1070.001 |

### Sysmon Event IDs

| EID | Description | Use Case |
|---|---|---|
| 1 | Process creation | Full command line, parent process |
| 3 | Network connection | Outbound C2 detection |
| 7 | Image loaded | DLL sideloading |
| 8 | CreateRemoteThread | Process injection |
| 10 | ProcessAccess | Credential dumping (lsass) |
| 11 | FileCreate | Malware drop, staging |
| 13 | Registry value set | Persistence mechanisms |
| 22 | DNS query | DNS-based C2 or exfil |

### Logon Type Reference

| Type | Name | Meaning |
|---|---|---|
| 2 | Interactive | Console logon |
| 3 | Network | SMB, net use, PsExec |
| 4 | Batch | Scheduled task |
| 7 | Unlock | Workstation unlock |
| 9 | NewCredentials | RunAs /netonly |
| 10 | RemoteInteractive | RDP |

### PowerShell Query Patterns

```powershell
# Failed logons in last 24 hours
Get-WinEvent -FilterHashtable @{
    LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)
} | Select-Object TimeCreated,
    @{N='User';E={$_.Properties[5].Value}},
    @{N='Source';E={$_.Properties[19].Value}}

# Process creation with command line
Get-WinEvent -FilterHashtable @{
    LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-1)
} | Where-Object {$_.Properties[8].Value -match 'powershell|cmd'}

# Scheduled task creation
Get-WinEvent -FilterHashtable @{
    LogName='Security'; Id=4698
} | ForEach-Object {
    [xml]$xml = $_.ToXml()
    [PSCustomObject]@{
        Time = $_.TimeCreated
        TaskName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TaskName'} | Select-Object -Expand '#text'
        User = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -Expand '#text'
    }
}

# Audit log cleared (anti-forensics detection)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102}
```

### Offline EVTX Parsing with Python

```python
import Evtx.Evtx as evtx
import xml.etree.ElementTree as ET

with evtx.Evtx("Security.evtx") as log:
    for record in log.records():
        root = ET.fromstring(record.xml())
        event_id = root.find(".//{http://schemas.microsoft.com/win/2004/08/events/event}EventID").text
        if event_id == "4624":
            data = root.findall(".//{http://schemas.microsoft.com/win/2004/08/events/event}Data")
            logon_type = data[8].text
            user = data[5].text
            print(f"Logon: {user} Type:{logon_type}")
```

## Workflow

1. **Scope** — Define time range and systems of interest
2. **Collect** — Export EVTX files or query via WEF/SIEM
3. **Filter** — Focus on critical Event IDs (4624, 4625, 4688, 4698, 7045, 1102)
4. **Correlate** — Link logon events to process creation to network activity
5. **Timeline** — Build chronological sequence of adversary actions
6. **Detect** — Identify anomalies: unusual logon types, off-hours activity, new services
7. **Report** — Document findings with Event ID evidence chain

## Detection

```yaml
title: Windows Event Logs Detection
id: 6958b867-b07a-428a-a3ff-f8ce4f3e1e3f
status: experimental
description: Detects suspicious activity related to analyzing windows event logs techniques in blue team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*windows*"
  condition: selection
level: medium
tags:
  - attack.t1070.001
  - attack.defense_evasion
falsepositives:
  - Security team running authorized detection validation tools
```

## Verification

| Check | Method |
|---|---|
| Log collection active | `wevtutil gl Security` — enabled, not full |
| Sysmon running | `sc query sysmon64` — RUNNING state |
| Audit policy set | `auditpol /get /category:*` — success/failure enabled |
| PowerShell logging | Check `ScriptBlockLogging` and `ModuleLogging` GPO |
| WEF subscriptions | `wecutil es` — subscriptions listed |

## References

- [Windows Security Log Encyclopedia](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/)
- [MITRE ATT&CK Data Sources](https://attack.mitre.org/datasources/)
- [Sysmon Documentation](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon)
- [SANS Windows Event Log Poster](https://www.sans.org/posters/windows-forensic-analysis/)
