Event IDs, Logging, & SIEMs
Last updated
Last updated
4624
Sucessful Logon
4625
Failed Logon
4634
Sucessful Logoff
4647
User-initiated Logoff
4548
Logon using Explicit Credentials
4672
Special Privileges Assigned
4768
Kerberos Ticket (TGT) Requested
4769
Kerberos Service Ticket Requested
4771
Kerberos Pre-auth Failed
4776
Attempted to Validate Credentials
4778
Session Reconnected
4779
Session Disconnected
4720
Account created
4722
Account enabled
4724
Attempt to reset a password
4728
User added to a global group
4732
User added to a local group
4756
User added to a universal group
Hunt for event ID 4625 (Logon Failed) and Logon Type 3 (Network Logon) Looking for rapid succession of failed attempts to the same machine, or multiple machines.