Event IDs that matter

A few numbers tell most of the story

Windows writes security events with numeric Event IDs. The export here (/srv/soc-data/windows/security.log) is CSV with the Event ID in the second column. The ones that matter on this desk:

• 4625 — an account failed to log on
• 4624 — an account logged on successfully
• 4688 — a new process was created
• 4720 — a user account was created

Look at the columns, then count the failed logons — the Windows equivalent of the SSH brute force you already saw:

head -n 1 /srv/soc-data/windows/security.log
grep -c ',4625,' /srv/soc-data/windows/security.log

In the terminal

student@vulntech:~$ head -n 1 /srv/soc-data/windows/security.log
TimeCreated,EventID,Description,Account,SourceIP,Process,CommandLine
student@vulntech:~$ grep -c ',4625,' /srv/soc-data/windows/security.log
12

Tip: These events are CSV, so awk -F, (comma as the field separator) lets you pick out a single column — the account, the IP or the command line.