Windows Event Log Investigation: Authentication & Persistence Detection

Prerequisites

• COA-K001: SOC Architecture & Alert Lifecycle
• COA-K002: MITRE ATT&CK for SOC Analysts
• FND-K004: OS Fundamentals (Windows section)

Why This Lesson Matters

Windows Event Logs are the primary evidence source in most enterprise SOC investigations. Understanding the meaning of specific Event IDs, how to correlate them across channels, and how to recognise attacker activity patterns is the single most important technical skill for an L1/L2 Windows-environment analyst.

1. Windows Event Log Architecture

Windows maintains separate log channels for different event categories:

Events have five common fields in every record: - EventID — identifies the event type - TimeCreated — UTC timestamp - Computer — hostname where the event was generated - Security/UserID — SID of the subject (the actor) - EventData — payload; fields vary by EventID

1.1 Authentication Events (Security Channel)

Logon Types (Event 4624):

1.2 Process Events

Why Sysmon Event 1 is preferred over 4688: - Sysmon 1 includes the full command line by default - Sysmon 1 includes parent process image path (not just PID) - Sysmon 1 includes file hashes (MD5, SHA256, Imphash) - 4688 command line requires an additional audit policy setting to be enabled

1.3 Persistence Events

2. Correlated Detection: The Persistence Installation Chain

A threat actor who has established a foothold will install persistence to survive reboots. The Windows event sequence for service-based persistence is predictable:

Timeline of service persistence installation:

14:31:03  Event 4672 — SubjectUserName: SYSTEM  (elevated token obtained)
14:31:04  Event 7045 — ServiceName: "WindowsUpdateHelper"
                        ImagePath: "C:UsersPublicsvc.exe"
                        ServiceType: Own Process
                        StartType: Auto Start                    ← T1543.003
14:31:05  Event 4688 / Sysmon 1 — Image: C:UsersPublicsvc.exe
                                   ParentImage: services.exe    ← service executed
14:31:06  Sysmon 3   — svc.exe → 185.220.101.5:443            ← C2 connection

2.1 Red Flags in Service Records

2.2 PowerShell Queries for Persistence Detection

# New services installed in the last 24 hours
Get-WinEvent -LogName System -FilterHashtable @{Id=7045} |
  Where-Object {$_.TimeCreated -gt (Get-Date).AddDays(-1)} |
  Select-Object TimeCreated,
    @{n='ServiceName'; e={$_.Properties[0].Value}},
    @{n='ImagePath';   e={$_.Properties[1].Value}}

# Scheduled tasks created in the last 24 hours
Get-WinEvent -LogName Security -FilterHashtable @{Id=4698} |
  Where-Object {$_.TimeCreated -gt (Get-Date).AddDays(-1)} |
  Select-Object TimeCreated, Message

# Run key additions (Sysmon 13 required)
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
  Where-Object {$_.Id -eq 13 -and $_.Message -like "*CurrentVersionRun*"} |
  Select-Object TimeCreated, Message

3. Brute Force Detection Pattern

A brute-force SSH or RDP attack followed by a successful login has a distinctive Event ID signature:

14:30:00  Event 4625 × N  (N failed logons from same IP)
             → FailureReason: Unknown user name or bad password
             → IpAddress: 185.220.101.5
14:30:47  Event 4624      (successful logon)
             → LogonType: 10 (RemoteInteractive = RDP)
             → IpAddress: 185.220.101.5
             → TargetUserName: alice
14:30:48  Event 4672      (alice assigned admin token)

Query to surface brute-force patterns:

# Count failed logons by source IP in last hour
Get-WinEvent -LogName Security -FilterHashtable @{Id=4625} |
  Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-1)} |
  Group-Object {$_.Properties[19].Value} |   # IpAddress field index
  Sort-Object Count -Descending |
  Select-Object Count, Name

4. Common Mistakes

Mistake 1: Relying on 4688 without enabling command line logging. By default, Event 4688 does not include the CommandLine. Enable "Audit Process Creation" with "Include command line in process creation events" via GPO, or deploy Sysmon.

Mistake 2: Ignoring Logon Type in Event 4624. A Type 3 (network) logon from a workstation to a server is a lateral movement indicator. A Type 2 (interactive) from an IP address that is not on-premises is suspicious.

Mistake 3: Only checking the Security channel. Service installation fires in the System channel (Event 7045), not Security. Many analysts miss this.

Mistake 4: Not correlating the service image path with the filesystem. A service pointing to C:UsersPublicupdate.exe should trigger a file investigation — what is that binary, when was it created, what is its hash?

5. Practice Exercises

1. You see Event 4624 with LogonType=3, TargetUserName=Administrator, IpAddress=10.0.0.42. What should you investigate next and why?

2. Event 7045 fires: ServiceName=MicrosoftEdgeUpdater, ImagePath=C:UsersobAppDataRoamingedgeupd.exe. List four specific red flags in this record.

3. Write a PowerShell one-liner that extracts all Event 4625 failures from the last 2 hours, grouped by TargetUserName, sorted by count descending.

6. Lab

Assessment mode: flag

challenge_spec_id: 371 — Service persistence trace

A SIEM alert fired: "New service installed outside change window." You are given a Windows Event Log EVTX file.

Task: 1. Filter for Event 7045 entries 2. Identify the malicious service by its suspicious ImagePath 3. Correlate with Event 4672 to identify the actor who installed it 4. The flag is the value of the ServiceName field of the malicious service

7. Framework Alignment

8. Further Reading

• Windows Security Log Encyclopedia — https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/ — Every Event ID explained
• SwiftOnSecurity Sysmon Config — https://github.com/SwiftOnSecurity/sysmon-config — Reference Sysmon deployment
• Sigma Rules: Windows process creation — https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
• SANS Poster: Hunt Evil — Quick-reference for suspicious Windows process relationships

["Identify the Windows Event IDs for successful logon, failed logon, process creation, scheduled task creation, and new service installation, and state which log channel each lives in", "Interpret the Logon Type field of Event 4624 to distinguish interactive, RDP, network/lateral-movement, and service logon events", "Correlate Event 4672 followed by Event 7045 in a EVTX file to identify a service persistence installation chain and extract the malicious service name"]

Prerequisites → Why this matters → Event Log architecture (channels, common fields) → Authentication events (4624/4625/4648/4672 with Logon Type table) → Process events (4688 vs Sysmon 1) → Persistence events (4698/7045/Sysmon 13) → Correlated detection: service persistence chain → Brute-force detection pattern → PowerShell queries → Common mistakes → Practice exercises → Lab (flag, spec 371) → Framework alignment → Further reading