Windows Event Triage
Look up what a Windows event ID means and why it matters, or paste exported events to have brute force, password spraying, new admin accounts, malicious services, encoded PowerShell, Kerberoasting, DCSync and log clearing flagged for you.
● Runs in your browser. Logs never leave your device.Event ID lookup
Security, System, Sysmon, PowerShell, RDP, DefenderAnalyze exported events
Findings
Paste exported events and press Analyze.
Event ID breakdown
What it detects
Credential attacks
Brute force, password spraying, a success right after failures, lockouts, Kerberoasting (RC4 service tickets), DCSync and LSASS access.
Persistence & privilege
New accounts, members added to admin groups, new services with suspicious paths, scheduled tasks, SID History and DSRM changes.
Execution & tampering
Encoded PowerShell, download cradles, Mimikatz, AMSI bypass, LOLBins, shadow copy deletion, Defender disabled and logs cleared.
IOC Triage gives a verdict for each one from 15 threat-intel sources with a right-click.