Investigate Windows sign-in events
Find your own successful and failed sign-ins and privileged sessions in the Windows Security log, then filter them the way a SOC analyst would.
Environment
Your own Windows PC or a Windows VM. Use PowerShell as Administrator.
Before you start
- Read Log Data (p.317), Host Operating System Logs (p.318) and Security Information and Event Management (p.325).
You will
- Find events 4624, 4625 and 4672
- Filter by time and event ID
- Explain the fields that matter in an investigation
Steps
-
1
Lock your screen (Win+L), mistype your own password once, then sign in properly.
-
2
Open Event Viewer → Windows Logs → Security and filter the current log for Event IDs 4624, 4625 and 4672.
-
3
Open your 4625 (failed logon) event and note the Account Name, Failure Reason, Logon Type and time.
-
4
Do the same in PowerShell:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-1)} | Format-List TimeCreated, Message. -
5
Count today's successful sign-ins:
(Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).Date}).Count. -
6
Write one detection rule in plain English, for example 'alert if more than 10 failed logons for one account in 5 minutes', and note what false positives it might produce.
Check your understanding
- ?What does Event ID 4672 tell you?
- ?Why do SIEMs collect these logs centrally instead of leaving them on each PC?
- ?How would you tune your alert rule to cut false positives?