Windows Event ID リファレンス
フォレンジック調査で重要となる Windows Event ID をチャネル別にまとめた索引です。EventData で最初に確認すべきフィールドを併記し、扱っている ID は詳細ガイドへ、それ以外は Microsoft Learn へリンクします。
Security
| Event ID | 名前 | メモ |
|---|---|---|
| 1102 | The audit log was cleared | Anti-forensic action. Pair with System 104. Pivot SubjectLogonId to the matching 4624. |
| 4624 | An account was successfully logged on | Read LogonType first: 2 console, 3 network, 9 runas /netonly, 10 RDP. |
| 4625 | An account failed to log on | Status + SubStatus identify the failure mode (wrong password, account locked, account disabled, AS-REP roasting clock skew). |
| 4634 | An account was logged off | Pairs with 4624 via LogonId; not always emitted for type-3. |
| 4648 | A logon was attempted using explicit credentials | runas /user, scheduled task, NetOnly logons. Captures credential-passing patterns. |
| 4672 | Special privileges assigned to new logon | Fires when a logon gets SeDebugPrivilege, SeTcbPrivilege, etc. Useful filter for admin sessions. |
| 4688 | A new process has been created | Base-OS process creation. Command-line audit must be enabled to see arguments. |
| 4720 | A user account was created | Pair with 4724 (password reset) and 4732 (group membership). |
| 4726 | A user account was deleted | Cleanup signal — often paired with 4720 minutes earlier. |
| 4740 | A user account was locked out | WorkstationName field reveals which host triggered the lockout — often a stale stored credential, not an attacker. |
| 4768 | A Kerberos authentication ticket (TGT) was requested | Domain-controller-side record of every TGT issue. Status 0x6 = bad username; 0x18 = bad password. |
| 4769 | A Kerberos service ticket was requested | Kerberoasting fingerprint when TicketEncryptionType is 0x17 (RC4) against a service account. |
| 4776 | Credential validation attempt (NTLM) | Domain controller's NTLM authentication record. Status 0xC0000064 = unknown user, 0xC000006A = wrong password. |
| 4663 | An attempt was made to access an object | SACL-driven object access audit. SAM hive reads, .dmp file writes, ransomware sweeps — needs SACL configured per object. |
System
| Event ID | 名前 | メモ |
|---|---|---|
| 104 | Log was cleared (System) | Service Control Manager's counterpart to Security 1102. Often missed by attackers who only clear Security. |
| 7045 | A service was installed in the system | MITRE T1543.003. PsExec signature when ImagePath is %SystemRoot%\PSEXESVC.exe. |
| 7036 | Service entered the running/stopped state | Pair with 7045 to confirm a service actually ran, not just got installed. |
| 6005 | Event Log service was started | Boot signal. Pair with 6006 to spot reboots in a timeline. |
| 6006 | Event Log service was stopped | Clean shutdown. Missing 6006 before 6005 implies a crash. |
Microsoft-Windows-PowerShell/Operational
| Event ID | 名前 | メモ |
|---|---|---|
| 4104 | Scriptblock logging | Captures the script body after decoding and reflection — the highest-value PowerShell record on the system. |
| 4103 | Module logging | Per-pipeline parameter logging. Useful complement to 4104 — together they reconstruct invocation context. |
| 400 | Engine state changed (started) | PowerShell session started. Pairs with 403 on exit. |
Microsoft-Windows-Sysmon/Operational
| Event ID | 名前 | メモ |
|---|---|---|
| 1 | Process creation | Command-line, hashes, parent process. The richest single record an analyst can get from Windows. |
| 3 | Network connection | Per-connection record with source/dest IP, port, process. Watch for short-lived 443 to unknown hosts. |
| 7 | Image (DLL) loaded | Suspicious DLL loads from %TEMP%, unsigned modules in lsass.exe. |
| 11 | File created | Persistence drops in autorun paths, ScreenSaver hijack files, Office macro caches. |
| 13 | Registry value set | Run/RunOnce, Image File Execution Options, debugger hijacks. |
| 22 | DNS query | Per-process DNS resolution. Beacon-like cadence + unknown apex is a strong signal. |
Microsoft-Windows-TaskScheduler/Operational
| Event ID | 名前 | メモ |
|---|---|---|
| 106 | Task registered | MITRE T1053.005. Pair with 200/201 to see whether the task actually ran. |
| 200 | Action started | Per-action launch. The TaskName field is your pivot back to 106 (register). |
| 201 | Action completed | Pairs with 200 — gap implies action is still running or got killed. |
Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
| Event ID | 名前 | メモ |
|---|---|---|
| 21 | Session logon succeeded | RDP session established. Source IP in the record is your attribution anchor. |
| 25 | Session reconnection succeeded | Picks up an existing disconnected RDP session. |
| 23 | Session logoff succeeded | Clean RDP logoff. |