Spotting the Adversary with Windows Event Log Monitoring

Windows 7
ID Level Event Log Event Source
Account Lockouts 4740 Informational Security Microsoft-Windows-Security-Auditing
User Added to 4728, Informational Security Microsoft-Windows-Security-Auditing
Privileged Group 4732,
4756
Successful User 4624 Informational Security Microsoft-Windows-Security-Auditing
Account Login
Failed User 4625 Informational Security Microsoft-Windows-Security-Auditing
Account Login
Account Login with
Explicit Credentials
4648 Informational Security Microsoft-Windows-Security-Auditing
Windows XP
Table 16: Windows 7 Account Activity Events
ID Type Event Log Event Source
Account Lockouts 644 Success Audit Security Security
Failed Login 529 Failure Audit Security Security
Successful Login 528 Success Audit Security Security
User Initiated Logoff 551 Success Audit Security Security
Account Login with Explicit 552 Success Audit Security Security
Credentials
Successful Network Login 540 Success Audit Security Security
User Account Created 624 Success Audit Security Security
Change Password Attempt 627 Success Audit Security Security
User Added to Privileged Group 632, 636,
660
Success Audit Security Security
Table 17: Windows XP Account Activity Events
4.8 Kernel Driver Signing
Introduction of kernel driver signing in the 64-bit version of Windows Vista significantly improves
defenses against malicious drivers or activities in the kernel. Any indication of a protected driver being
altered may indicate malicious activity or a disk error and should warrant investigation.
Windows 7
33