SOC (Security Operations Center) teams need to prioritize monitoring critical event IDs to effectively detect, respond to, and mitigate potential security incidents. Event IDs can vary based on the operating systems (e.g., Windows, Linux) and the specific logging systems in use, but there are several key categories of event IDs that should be closely watched. Below are some critical ones for Windows environments, as they are the most commonly encountered in many SOC operations:
1. Authentication and Authorization Events
- Event ID 4624 (Windows Security) – Successful logon: This event shows when a user successfully logs on to a system, which is useful for identifying potential unauthorized access.
- Event ID 4625 (Windows Security) – Failed logon: Critical for detecting brute force attacks or account lockout attempts.
- Event ID 4768 (Windows Security) – Kerberos authentication ticket (TGT) request: Tracks Kerberos authentication requests and is key to identifying possible ticket-granting ticket (TGT) abuse.
- Event ID 4769 (Windows Security) – Service ticket request: Similar to the above, but for service tickets. Can indicate Kerberos abuse or misconfigurations.
2. Privilege Escalation Events
- Event ID 4672 (Windows Security) – Special privileges assigned to new logon: This event shows when a user is assigned special privileges (e.g., administrator or service account roles), which is useful for detecting privilege escalation.
- Event ID 4648 (Windows Security) – Logon attempt using explicit credentials: Can indicate that a user or process is attempting to use another user’s credentials.
3. Account Management Events
- Event ID 4720 (Windows Security) – User account created: Indicates when a new user account is created, which can be used for tracking unauthorized user account creation.
- Event ID 4726 (Windows Security) – User account deleted: A critical event, particularly in detecting malicious users removing their traces.
- Event ID 4738 (Windows Security) – User account changed: This event tracks modifications to user accounts and is useful for detecting suspicious account changes.
- Event ID 4740 (Windows Security) – Account lockout: Monitoring this helps detect brute-force attacks or account lockout issues that could result from malicious activity.
4. Lateral Movement and Remote Access
- Event ID 5140 (Windows Security) – Network share object accessed: Tracks attempts to access network shares, which could indicate lateral movement within the network.
- Event ID 4647 (Windows Security) – User initiated logoff: Can be useful to track if users are logging off unexpectedly during suspicious activities.
- Event ID 21 (Windows Security) – Remote Desktop logon/logoff: This event logs activity related to Remote Desktop Protocol (RDP) access, useful for detecting unauthorized RDP access or misuse.
5. Security Policy Changes
- Event ID 4732 (Windows Security) – A member was added to a security-enabled local group: Indicates when a user or group is added to a local security group, which is important for monitoring changes to privileges.
- Event ID 4733 (Windows Security) – A member was removed from a security-enabled local group: Similarly, this tracks the removal of members, which can indicate malicious activity.
6. Malware and Security-Related Events
- Event ID 800 (Windows Security) – Windows Defender Antivirus: Detection of potential malware. Helps identify malicious activity at the endpoint.
- Event ID 1116 (Windows Security) – Windows Defender Antivirus scan completed: Can provide visibility into the effectiveness of antivirus scans and any malware found.
7. File Integrity Monitoring
- Event ID 4663 (Windows Security) – An attempt was made to access an object: Indicates that an object (e.g., file or folder) was accessed or modified. Key for identifying unauthorized access to sensitive files.
- Event ID 4660 (Windows Security) – Object deletion: This event helps in identifying when critical files are deleted, a possible sign of data tampering.
8. System Activity and Changes
- Event ID 104 (Windows Application) – Event log service: Indicates when event logs are cleared or altered, useful for identifying potential log tampering.
- Event ID 7030 (Windows System) – Service state change: Logs when a system service starts, stops, or crashes, and could signal abnormal activity or service abuse.
- Event ID 6008 (Windows System) – Unexpected shutdown: Useful to identify sudden system shutdowns, potentially related to a system compromise.
9. Network Traffic Anomalies
- Event ID 5156 (Windows Security) – Windows Filtering Platform Network connection: Indicates network connections that can be suspicious, especially if they are unexpected or to unusual destinations.
10. Audit Policy Changes
- Event ID 4719 (Windows Security) – System audit policy was changed: Tracks when the auditing policy is modified, which could signal an attacker trying to disable auditing or modify logging.
11. Application Layer Events
- Event ID 4000-4005 (Windows Application) – Exchange, IIS, or web server logs: Events associated with application services that can indicate potential exploitation of web applications or email servers.
These event IDs are critical for monitoring, and SOC teams should establish a baseline of normal activity so they can quickly spot deviations. Along with these, the use of Security Information and Event Management (SIEM) tools can help correlate and prioritize these logs effectively to reduce alert fatigue and focus on genuine threats.