Event Log Labs
Reading the Windows event log like a witness statement: which IDs matter, how to turn on the ones that are off by default, and what each one proves.
- Event IDs 7045 and 4698: Spotting Persistence on Windows 11
A new service and a new scheduled task are the two most common ways malware survives a reboot on Windows. Both are logged. Here is how to read those events and separate them from normal software installs.
Attack and detection · Intermediate · T1543.003, T1053.005
- Event ID 4624 and Logon Types: Who Signed In to a Windows PC
Security event 4624 records every successful logon, but the Logon Type field is what makes it useful. Here is what each type means on Windows 11 and which ones should make you look twice.
Forensic artifact · Beginner · T1078
- Scheduled Task Persistence on Windows 11: The Attack and Its Artifacts
How a persistent scheduled task is planted on Windows 11, demonstrated in an isolated lab, and the exact registry keys, XML files, and event IDs it leaves behind for a defender to find.
Attack and detection · Intermediate · T1053.005
- How to Tell If a Windows 11 PC Was Remotely Accessed
RDP, TeamViewer and AnyDesk each leave a different trail on Windows 11. Here are the exact event IDs, log files and registry keys that show who connected, when, and from where.
Forensic artifact · Beginner · T1021.001, T1219