# 🖥️ Windows Security Event Codes 
#CS #Win #logs 

A quick-reference guide to the most common Windows Event Codes encountered in cybersecurity. 🛡️ Use this cheat sheet to identify and investigate key events efficiently. 🔍

---

## 📋 Common Windows Event Codes

| **Event ID** | **Event Name**                             | **Description**                                                                 |
|--------------|-------------------------------------------|-------------------------------------------------------------------------------|
| 4624         | Successful Logon                          | Indicates a successful account logon.                                         |
| 4625         | Failed Logon                              | Tracks failed account logon attempts.                                         |
| 4634         | Logoff                                    | Logged when a user logs off or a session ends.                                |
| 4672         | Special Privileges Assigned to New Logon  | Assigned when a user logs on with admin or special privileges.               |
| 4688         | Process Creation                          | Logs whenever a new process is created.                                      |
| 4689         | Process Termination                       | Logs whenever a process is terminated.                                       |
| 4697         | Service Installation                      | Triggered when a new service is installed.                                   |
| 4700         | Scheduled Task Enabled                    | Indicates that a scheduled task has been enabled.                            |
| 4701         | Scheduled Task Disabled                   | Indicates that a scheduled task has been disabled.                           |
| 4719         | System Audit Policy Changed               | Tracks changes to the system audit policy.                                   |
| 4720         | User Account Created                      | Logs the creation of a new user account.                                     |
| 4722         | User Account Enabled                      | Triggered when a disabled user account is enabled.                           |
| 4723         | Attempt to Change Password                | Indicates an attempt to change a user’s password.                            |
| 4725         | User Account Disabled                     | Logs when a user account is disabled.                                        |
| 4738         | User Account Changed                      | Indicates changes made to an existing user account.                          |
| 4740         | Account Locked Out                        | Triggered when an account is locked out due to failed logons.                |
| 4767         | Account Unlocked                          | Logged when a previously locked account is unlocked.                         |
| 4776         | Credential Validation                     | Indicates that a credential validation attempt has been made.                |
| 4798         | User Account Enumeration                  | Triggered when a process enumerates user accounts.                           |
| 4799         | Group Membership Enumeration              | Logged when a process enumerates group memberships.                          |
| 5038         | Code Integrity Violation                  | Triggered when a file fails a code integrity check.                          |
| 5140         | File Share Access                         | Logs access to shared files or folders.                                      |
| 5145         | File Share Permission Change              | Tracks changes to shared file or folder permissions.                         |
| 5156         | Allowed Connection                        | Indicates a successful network connection was allowed by the firewall.       |
| 5157         | Blocked Connection                        | Indicates that the firewall blocked a network connection.                    |
| 5379         | Credential Manager Credentials Retrieved  | Logged when credentials are retrieved from the Windows Credential Manager.   |

## Windows Logon Type Codes

|Logon Type|Description|
|---|---|
|**2**|Console|
|**3**|Network|
|**4**|Batch (Scheduled Tasks)|
|**5**|Windows Services|
|**7**|Screen Lock/Unlock|
|**8**|Network (Cleartext Logon)|
|**9**|Alternate Credentials Specified (RunAs)|
|**10**|Remote Interactive (RDP)|
|**11**|Cached Credentials (e.g., Offline DC)|
|**12**|Cached Remote Interactive (RDP, similar to Type 10)|
|**13**|Cached Unlock (Similar to Type 7)|


---

## 🔍 Key Use Cases

### Logon and Authentication Monitoring
- **4624**: Monitor successful logons.
- **4625**: Investigate brute-force attempts or unauthorized access.
- **4740**: Detect account lockouts.

### Process and Service Tracking
- **4688**: Track new processes, which may indicate malicious activity.
- **4697**: Investigate suspicious service installations.

### User Account Management
- **4720**: Detect unauthorized account creation.
- **4725/4722**: Monitor account disabling/enabling.
- **4738**: Audit changes to user accounts.

### Network Activity
- **5140**: Monitor access to shared files and folders.
- **5156/5157**: Review allowed and blocked connections for firewall events.

---

## 💡 Pro Tips

1. **Use Filters**: In the Event Viewer, apply filters to narrow down specific Event IDs for faster analysis.
2. **Centralized Logging**: Use tools like Splunk or Elastic Stack to centralize and visualize event logs.
3. **Correlate Events**: Combine multiple Event IDs to detect complex attack patterns (e.g., failed logons followed by account lockouts).

Stay vigilant and use these Event Codes to strengthen your cybersecurity defenses! 🚀