# Windows Event Logs

Windows Event Logs (`.evtx` files) are the primary source of chronological historical data on a Windows system. They track logins, service starts, application crashes, and security policy changes.

They are stored in `C:\Windows\System32\winevt\Logs\`.

## The Big Three
While modern Windows has hundreds of event log files, the core three are:
1.  **System:** Events logged by Windows system components (e.g., a driver failing to load, or the system booting up).
2.  **Application:** Events logged by installed software (e.g., Microsoft Word crashing, or an antivirus detecting a file).
3.  **Security:** Events related to authentication, privilege use, and object access. *By default, only Administrators can view this log.*

## Crucial Security Event IDs (EIDs)
As a DFIR analyst, you must memorize these specific Event IDs. They are the bread and butter of finding attackers.

### Logon & Authentication
*   **EID 4624:** Successful Logon. 
    *   *Forensic Value:* Shows *who* logged in, *when*, and from *where* (Source IP). The "Logon Type" field is critical. Type 2 means Interactive (Physical keyboard). Type 3 means Network (e.g., accessing a shared folder). Type 10 means Remote Interactive (RDP).
*   **EID 4625:** Failed Logon.
    *   *Forensic Value:* A high volume of 4625s in a short time frame indicates a Brute Force or Password Spraying attack.
*   **EID 4672:** Special Privileges Assigned to New Logon.
    *   *Forensic Value:* This means the user logged in as an Administrator (or used "Run as Administrator").

### Account Management
*   **EID 4720:** A user account was created.
    *   *Forensic Value:* Attackers often create backup "backdoor" accounts (like `SysAdmin1`) just in case their malware is discovered and removed. 
*   **EID 4722 / 4724:** Account enabled / Password reset.
*   **EID 4732:** A member was added to a security-enabled local group.
    *   *Forensic Value:* Look closely if the target group is "Administrators". This is a sign of local privilege escalation.

### Process Execution
By default, Windows does not log every program that runs. However, if Advanced Audit Policy is enabled, you get:
*   **EID 4688:** A new process has been created.
    *   *Forensic Value:* Tells you exactly what time a program ran. If command-line auditing is turned on, it will even log the exact arguments (e.g., `powershell.exe -NoProfile -EncodedCommand JABX...`), which is incredibly useful for catching malicious scripts.

## Clearing Logs
*   **EID 1102:** The audit log was cleared.
    *   *Forensic Value:* The massive red flag. Attackers often run the command `wevtutil cl Security` to erase their tracks. If you see EID 1102, assume an attacker was present, had Administrator rights, and intentionally deleted evidence.