The reference library
Windows Event ID Reference
Find the event. Understand the fields. Search by number, status code or topic, and filter by source to put the evidence in context.
77 references found
Process Create
Sysmon Event 1 fires every time a process is created, capturing a richer dataset than the native Windows Event 4688 — including full command line, parent command line, file hashes (MD5, SHA2…
Sysmon · 3Network Connection
Sysmon Event 3 fires for every TCP and UDP network connection initiated by a process, recording the source process, destination IP, port, hostname (via DNS), and protocol. Unlike Windows Fir…
Sysmon · 7Image Loaded
Sysmon Event 7 fires every time a DLL or other image file is loaded into a process, recording the loading process, the loaded image path, its hash, signing status, and signature details. It …
Sysmon · 10Process Access
Sysmon Event 10 fires when one process opens a handle to another process using OpenProcess(), recording the source process, target process, the access rights requested (GrantedAccess), and t…
Sysmon · 11File Create
Sysmon Event 11 fires every time a file is created or overwritten, recording the creating process, the full target file path, and creation timestamp. It is the primary data source for detect…
Sysmon · 13Registry Value Set
Sysmon Event 13 fires every time a registry value is set — capturing the process that made the change, the full registry key path, the value name, and the data written. It is the highest-fid…
Sysmon · 22DNS Query
Sysmon Event 22 records a DNS query made through the Windows DNS client, including the requesting process and query results. It can help connect domain resolution to application activity. In…
System · 41Kernel Power — Unexpected Shutdown / Crash
Logged when Windows restarts unexpectedly without a clean shutdown — indicates a crash, power failure, or hard reset.
Other · 1000Application Error
Logged by the Application Error Reporting service when an application crashes with an unhandled exception.
Other · 1001Windows Error Reporting — Application or System Crash
Logged by Windows Error Reporting when an application crashes or a BSOD occurs, including the fault module and exception code.
System · 1074System Shutdown / Restart Initiated by Process or User
Logged when a process or user initiates a clean shutdown or restart. Records the initiating process, the user, the shutdown type, and a reason code — the forensic record of WHO rebooted the …
Security · 1102Audit Log Cleared
Logged when the Security event log is cleared. This is one of the clearest signs of an attacker covering their tracks.
Defender · 1116Windows Defender — Malware Detected
Logged when Windows Defender detects a threat — malware, PUA, or suspicious file.
Defender · 1117Windows Defender — Malware Remediation Action
Logged when Windows Defender takes a remediation action on a detected threat — quarantine, removal, block, or allow. Always follows Event ID 1116 (threat detected). The action outcome determ…
PowerShell · 4103PowerShell Module Logging
Logged for each PowerShell pipeline execution, capturing the module and function called. Less detailed than Script Block Logging (4104) but lower overhead.
PowerShell · 4104PowerShell Script Block Logging
Logged when PowerShell executes a script block — captures the actual code being run, even if it was de-obfuscated at runtime. One of the most valuable PowerShell forensic data sources.
Security · 4624Successful Logon
Logged every time an account successfully authenticates to a Windows system. One of the highest-volume events in the Security log — a DC in a large domain can generate millions per day. The …
Security · 4625Failed Logon
Event ID 4625 records a failed logon on the computer handling the attempt. Start with Status and SubStatus, the account, source and Logon Type. A bad password or unknown account can result f…
Security · 4634Account Logoff
Logged when an account's logon session ends. Paired with 4624 it lets you reconstruct the full duration of a session.
Security · 4647User Initiated Logoff
Logged when a user explicitly logs off (Start → Logoff). Complements 4634, which covers all session terminations including automatic ones.
Security · 4648Logon with Explicit Credentials
Logged when a process attempts to authenticate using explicitly provided credentials — e.g. runas, net use, or Pass-the-Hash attacks.
Security · 4657Registry Value Modified
Logged on the system where the change occurs when a registry value is created, modified, or deleted on a key that has a System Access Control List (SACL) configured for auditing. Requires th…
Security · 4662Operation Performed on Active Directory Object
Logged when an operation is performed on an Active Directory object — such as a user, computer, or the domain partition itself. The critical event for detecting DCSync attacks and unauthoriz…
Security · 4663Object Access Attempt
Logged when an attempt is made to access an audited object (file, folder, registry key, etc.). Requires SACL (System Access Control List) to be configured on the object.
Security · 4670Permissions Changed on Object
Logged when the Discretionary Access Control List (DACL) on an object is modified, changing who can access it and with what permissions.
Security · 4672Special Privileges Assigned to New Logon
Logged immediately after a successful 4624 logon when the authenticated account holds one or more sensitive Windows privileges. Fires for Domain Admins, local Administrators, and any account…
Security · 4673Privileged Service Called
Logged when a process or user attempts to use a sensitive privilege such as SeDebugPrivilege, SeImpersonatePrivilege, or SeTakeOwnershipPrivilege. High-volume or unexpected 4673 events indic…
Security · 4688Process Created
Logged every time a new process is created on Windows. Requires Process Creation auditing to be enabled via Group Policy. With command-line logging enabled, 4688 captures the full arguments …
Security · 4689Process Exited
Logged when a process terminates. Paired with 4688 it gives the full lifetime of a process.
Security · 4697Service Installed in Service Control Manager
Logged in the Security log when a new service is installed in the Service Control Manager. Complements System log Event ID 7045 — both events fire for the same service installation but are w…
Security · 4698Scheduled Task Created
Logged when a new scheduled task is registered on the system via schtasks.exe, PowerShell, COM API, or Group Policy. One event fires per task creation, on the host where the task is register…
Security · 4699Scheduled Task Deleted
Logged when a scheduled task is removed from the system — via schtasks.exe /delete, PowerShell Unregister-ScheduledTask, or the Task Scheduler COM API. Fires on the host where the task was r…
Security · 4700Scheduled Task Enabled
Logged when a previously disabled scheduled task is enabled — via schtasks.exe /change /enable, PowerShell Enable-ScheduledTask, or the Task Scheduler COM API.
Security · 4701Scheduled Task Disabled
Logged when a scheduled task is disabled — via schtasks.exe /change /disable, PowerShell Disable-ScheduledTask, or the Task Scheduler COM API. The task remains registered but will not fire u…
Security · 4702Scheduled Task Modified
Logged when an existing scheduled task is updated — its name, trigger, action, or run-as account is changed. Fires on the host where the task is registered.
Security · 4719System Audit Policy Changed
Logged when the system's audit policy is modified — which controls what events get recorded in the Security log.
Security · 4720User Account Created
Logged when a new user account is created in Active Directory or locally on a Windows system. Fires on the domain controller for AD accounts and on the local machine for local accounts. Ever…
Security · 4722User Account Enabled
Logged when a previously disabled user account is re-enabled. Attackers re-enable dormant accounts to gain access that inherits the original account's credentials, group memberships, and Ser…
Security · 4723Password Change Attempted
Logged when a user attempts to change their own password — a self-service action that does not require admin privileges. Fires on both success and failure. A failed 4723 on an admin or servi…
Security · 4724Password Reset Attempted
Logged when an administrator resets another user's password. Unlike Event ID 4723 (self-service), this requires elevated privileges — only admins, helpdesk accounts with delegated rights, or…
Security · 4725User Account Disabled
Logged when a user account is disabled, preventing future logons without permanently deleting the account. While usually benign (offboarding), attackers disable accounts to lock out legitima…
Security · 4726User Account Deleted
Logged when a user account is permanently deleted from Active Directory or a local system. Fires on the DC for domain accounts and on the local machine for local accounts. Attackers delete b…
Security · 4727Security-Enabled Global Group Created
Logged when a new security-enabled global group is created in Active Directory. Global security groups replicate to all domain controllers and are available domain-wide, making them effectiv…
Security · 4728Member Added to Global Security Group
Logged when an account is added to an Active Directory global security group — including the most sensitive groups in the domain: Domain Admins, Enterprise Admins, Schema Admins, and Group P…
Security · 4729Member Removed from Global Security Group
Logged when an account is removed from an Active Directory global security group. The complement to Event ID 4728 (member added). Includes removals from high-value groups such as Domain Admi…
Security · 4731Security-Enabled Local Group Created
Logged when a new security-enabled local group is created on a Windows system. Local groups are machine-specific — unlike global groups, they do not replicate to other systems. Attackers cre…
Security · 4732Member Added to Local Security Group
Logged when an account is added to a local security group on a Windows system. The most security-critical groups are local Administrators (full machine control), Backup Operators (file syste…
Security · 4733Member Removed from Local Security Group
Logged when an account is removed from a local security group on a Windows system. The complement to Event ID 4732 (member added to local group). Fires for all local group removals including…
Security · 4735Security-Enabled Local Group Changed
Logged when a local security group's properties are modified — including its name, description, or type. This event covers changes to the group object itself, not membership changes. Members…
Security · 4738User Account Changed
Logged when a user account's attributes are modified — not creation, deletion, or group membership. Covers changes to account flags (UAC), account name, description, expiry, and other AD obj…
Security · 4740Account Lockout
Logged on the domain controller when a user account is locked out after exceeding the failed logon threshold.
Security · 4741Computer Account Created
Logged when a new computer account is created in Active Directory. The default MachineAccountQuota (10) allows any domain user — not just admins — to create computer accounts, making this a …
Security · 4742Computer Account Changed
Logged when an existing computer account in Active Directory is modified. Attackers modify computer accounts to enable post-creation attack capabilities: adding SPNs for Kerberoasting, setti…
Security · 4743Computer Account Deleted
Logged when a computer account is deleted from Active Directory. Attackers delete computer accounts as post-attack cleanup after MachineAccountQuota abuse, Kerberoasting, RBCD attacks, or DC…
Security · 4754Security-Enabled Universal Group Created
Logged when a new security-enabled universal group is created in Active Directory. Universal security groups replicate to the Global Catalog and can contain members from any domain in the fo…
Security · 4756Member Added to Universal Security Group
Logged when an account is added to a universal security group in Active Directory.
Security · 4767User Account Unlocked
Logged when a locked-out user account is unlocked by an administrator or automated system. Account lockouts (Event ID 4740) happen when failed logon attempts exceed the lockout policy thresh…
Security · 4768Kerberos Authentication Ticket (TGT) Requested
Logged on the domain controller when a client requests a Kerberos Ticket Granting Ticket (TGT) — the first step in Kerberos authentication. Every Kerberos-authenticated logon begins with a 4…
Security · 4769Kerberos Service Ticket Requested
Logged on the domain controller each time a client requests a Kerberos Service Ticket (TGS) to access a specific service. Every Kerberos-authenticated connection to a file share, SQL server,…
Security · 4770Kerberos Service Ticket Renewed
Fires on the domain controller when a Kerberos service ticket (TGS) is renewed. Kerberos tickets have a maximum lifetime (typically 10 hours) and a renewal window (typically 7 days) — within…
Security · 4771Kerberos Pre-authentication Failed
Logged on the domain controller when Kerberos pre-authentication fails — effectively the Kerberos equivalent of Event ID 4625. Fires when a client submits an incorrect password, targets a no…
Security · 4776NTLM Credential Validation
Logged on the domain controller each time it validates NTLM credentials — for both successful and failed authentications. Unlike 4625 (which fires on the machine where the logon was attempte…
Security · 4778Session Reconnected to Window Station
Logged when a user reconnects to an existing Remote Desktop session. Indicates RDP re-connection activity.
Security · 4779Session Disconnected from Window Station
Logged when a user disconnects from a Remote Desktop session without fully logging off — the session remains active in memory.
Security · 4794DSRM Admin Password Set
Logged on a domain controller whenever the Directory Services Restore Mode (DSRM) administrator password is set or changed. DSRM is an offline recovery mode — its password is set once at DC …
Security · 4907Auditing Settings Changed on Object
Logged when the System Access Control List (SACL) on an object is modified, changing what activity is audited on that object.
Security · 4946Windows Firewall Exception Added
Logged when a new firewall exception rule is added to the Windows Firewall.
Security · 5140Network Share Accessed
Logged when a network share is accessed. Captures who accessed which share and from where.
Security · 5145Network Share Object Access Checked
Logged when access is checked on a file or folder within a network share — more granular than 5140 (share level) but very high volume.
Other · 5857WMI Provider Activity
Logged when a WMI provider is loaded or invoked. Captures the WMI namespace, provider name, and the initiating process, providing visibility into WMI consumer activity.
Other · 5858WMI Provider Error
Logged when a WMI provider operation fails. Contains the provider name, error code, and the initiating process — useful for detecting failed WMI execution attempts and probing activity.
System · 6005Event Log Service Started
Logged when the Windows Event Log service starts — effectively marks system startup.
System · 6006Event Log Service Stopped
Logged when the Windows Event Log service stops — marks a clean, controlled shutdown.
System · 6008Unexpected System Shutdown
Logged at the next boot to record that the previous shutdown was unexpected — power loss, a crash (BSOD), a hung system, or a forced/hard reset. The clean shutdown sequence never completed.
System · 7034Service Crashed Unexpectedly
Logged when a Windows service terminates unexpectedly (not by request).
System · 7036Service State Changed
Logged when a service enters a running or stopped state.
System · 7045New Service Installed
Logged when a new service is installed on the system. The System log equivalent of Security Event 4697.