Sysmon configuration that catches real adversaries
An opinionated take on Sysmon: which event IDs actually matter in IR, why olafhartong/sysmon-modular is the right baseline, and the configuration mistakes that blind you to real attacks.
DFIR blog: Windows Event Log forensics & .evtx parsing
Event ID 4663: An attempt was made to access an object
Event ID 4663 logs access to a file, folder or registry key audited by a SACL: who touched what, with which access mask. Setup, key fields and hunts.
Event ID 4672: Special privileges assigned to new logon
Event ID 4672 fires when a logon gets admin-equivalent privileges like SeDebugPrivilege. What it means, why it pairs with 4624, and how to track privileged sessions with it.
Event ID 4688: A new process has been created (command line)
Event ID 4688 logs every process creation in the Security log. How to enable command-line auditing, the fields that matter, how it compares to Sysmon Event ID 1, and triage patterns.
Event ID 4720 explained: detecting rogue account creation in AD
4720 fires every time a user account is created, local or domain. Read it with 4722, 4724, and 4732 and you catch persistence and lateral-movement accounts within minutes.
Event ID 4768: Kerberos TGT requests and AS-REP roasting
Event ID 4768: A Kerberos authentication ticket (TGT) was requested. How result codes and the pre-auth flag reveal AS-REP roasting, password spraying and delegation abuse.
Event ID 4769: Kerberos service tickets and kerberoasting
Event ID 4769: A Kerberos service ticket was requested. Which fields reveal kerberoasting (RC4 0x17 tickets), how to separate it from normal TGS noise, and how it pairs with 4768.
Event ID 7036 explained: service state changes for DFIR triage
7036 fires every time a service starts or stops. Paired with 7045 it confirms whether persistence actually ran. On its own it reveals service abuse, defense evasion, and boot anomalies.
How to open an EVTX file (Windows, Mac, Linux: 5 ways)
How to open a .evtx file: in your browser, Event Viewer, wevtutil, EvtxECmd or python-evtx. Works on Windows, macOS and Linux; pick by OS and how much you want to install.