Tools / Event IDs

Windows security event IDs: the cheat sheet

The 60 Windows, Sysmon, PowerShell and Defender event IDs that matter for security monitoring, what each one means and how worried to be. Linked IDs have a full page with fields, false positives and queries.

Updated 2026-11-03

Logon and accounts (Security log)

ID	Log	Event	Severity	Why it matters
4624	Security	Successful logon	Informational	Baseline of who logged on, from where and how. Logon type tells the story: 2 interactive, 3 network, 10 RDP, 9 new credentials (runas /netonly, also seen with pass-the-hash).
4625	Security	Failed logon	Low	Many failures for one account means brute force; one source failing against many accounts means password spraying.
4634	Security	Logoff	Informational	Pairs with 4624 via Logon ID to measure session length.
4647	Security	User-initiated logoff	Informational	Interactive user logged off.
4648	Security	Logon with explicit credentials	Low	runas, scheduled tasks or lateral-movement tools using another account's credentials.
4672	Security	Special privileges assigned to new logon	Informational	An admin-equivalent logon. Useful to spot admin accounts used from unusual hosts.
4720	Security	User account created	Medium	Attackers create accounts for persistence.
4722	Security	User account enabled	Low	Re-enabled dormant accounts are a persistence trick.
4723	Security	Password change attempt	Informational	User changed their own password.
4724	Security	Password reset by another account	Medium	An admin (or attacker) reset someone else's password, a common takeover step.
4725	Security	User account disabled	Low	Mass disabling can be sabotage or ransomware prep.
4726	Security	User account deleted	Medium	Covering tracks or sabotage.
4728	Security	Member added to global security group	Medium	Privilege escalation when the group is Domain Admins or another admin group.
4732	Security	Member added to local security group	Medium	Adding to local Administrators or Remote Desktop Users gives persistence.
4756	Security	Member added to universal security group	Medium	Enterprise Admins / Schema Admins are universal groups.
4738	Security	User account changed	Low	Look for "Don't require preauth" (AS-REP roasting) or password-never-expires being set.
4740	Security	Account locked out	Low	Brute force, or an old password cached on a phone or mapped drive.
4767	Security	Account unlocked	Informational	Helpdesk or self-service unlock.
4765	Security	SID History added to an account	High	SID History injection gives hidden admin rights.
4766	Security	SID History add attempt failed	High	Someone tried SID History injection.
4794	Security	DSRM administrator password set	High	The DSRM account can be used as a domain controller backdoor.

Kerberos / NTLM

ID	Log	Event	Severity	Why it matters
4768	Security	Kerberos TGT requested	Informational	Pre-auth type 0 means no pre-authentication (AS-REP roastable account).
4769	Security	Kerberos service ticket requested	Informational	Bursts of requests with encryption 0x17 (RC4) for service accounts are Kerberoasting.
4771	Security	Kerberos pre-authentication failed	Low	The Kerberos version of a failed logon: brute force or spraying against a DC.
4776	Security	NTLM credential validation	Informational	Error 0xC000006A in bulk is NTLM brute force; NTLM where Kerberos is expected can mean pass-the-hash.

Policy, logs and tampering

ID	Log	Event	Severity	Why it matters
1102	Security	Security audit log cleared	Critical	Attackers clear the Security log to hide what they did. Almost never legitimate on servers.
104	System	Event log cleared	High	A System or application log was cleared.
4719	Security	System audit policy changed	High	Turning off auditing blinds the SOC before an attack.
4739	Security	Domain policy changed	Medium	Password or lockout policy weakened.
4662	Security	Operation performed on an AD object	Informational	With the replication GUIDs (1131f6aa / 1131f6ad / 89e95b76) from a non-DC account, this is DCSync.
5136	Security	Directory object modified	Low	GPO and AdminSDHolder changes show up here.

Processes, services, tasks

ID	Log	Event	Severity	Why it matters
4688	Security	New process created	Informational	With command-line auditing on, this shows encoded PowerShell, LOLBins and ransomware commands.
4697	Security	Service installed	Medium	PsExec, Cobalt Strike and many RATs install a service.
7045	System	New service installed	Medium	The System-log version of a new service, often PsExec (PSEXESVC) or malware.
7040	System	Service start type changed	Low	Disabling security services (Defender, backup agents) before ransomware.
7036	System	Service state changed	Informational	Service started or stopped. Look for security or backup services stopping.
4698	Security	Scheduled task created	Medium	Classic persistence.
4699	Security	Scheduled task deleted	Low	Cleanup after a one-time task.
4702	Security	Scheduled task updated	Low	Existing task hijacked to run a new command.

Network and shares

ID	Log	Event	Severity	Why it matters
5140	Security	Network share accessed	Informational	Access to ADMIN$ or C$ from a workstation is lateral movement.
5145	Security	Share object access check	Informational	Detailed share access; PsExec writes to ADMIN$.
5156	Security	Windows Filtering Platform allowed a connection	Informational	Network connection log; noisy but useful for C2 hunting.

PowerShell

ID	Log	Event	Severity	Why it matters
4103	PowerShell	PowerShell module logging	Informational	Pipeline execution details.
4104	PowerShell	PowerShell script block logged	Low	The decoded script that actually ran. Best single source for malicious PowerShell.
400	PowerShell	PowerShell engine started	Informational	HostApplication shows the full command line, including -EncodedCommand.

RDP

ID	Log	Event	Severity	Why it matters
1149	RDP	RDP authentication succeeded	Informational	TerminalServices-RemoteConnectionManager: who connected over RDP and from where.
21	RDP	RDP session logon succeeded	Informational	TerminalServices-LocalSessionManager session logon.

Defender

ID	Log	Event	Severity	Why it matters
1116	Defender	Defender detected malware	High	Microsoft Defender found a threat.
1117	Defender	Defender took action on malware	Medium	Remediation result for a detection.
5001	Defender	Defender real-time protection disabled	High	Attackers turn off Defender before running tools.
5007	Defender	Defender configuration changed	Medium	Exclusions added for a folder or process are a common bypass.

Sysmon

ID	Log	Event	Severity	Why it matters
1	Sysmon	process creation	Informational	Full command line, hashes and parent process.
3	Sysmon	network connection	Informational	Which process talked to which IP and port.
7	Sysmon	image loaded	Informational	DLL side-loading hunts.
8	Sysmon	CreateRemoteThread	Medium	Process injection.
10	Sysmon	process access	Informational	Access to lsass.exe is credential dumping (Mimikatz, procdump).
11	Sysmon	file created	Informational	Dropped payloads and ransom notes.
12	Sysmon	registry object added or deleted	Informational	Run-key persistence.
13	Sysmon	registry value set	Informational	Run keys, services, Defender settings.
22	Sysmon	DNS query	Informational	Domains each process resolved.

Check a whole export instead of one ID at a time

Windows Event Triage reads exported events in your browser and flags the patterns above automatically.

Open Event Triage