## Windows Logs (Security)

Focus on **Event ID 4624 (Logon Success)** and **4625 (Failure)**.

### Logon Types
The key field in Event 4624.
*   **Type 2**: Interactive. (Someone sat at the keyboard).
*   **Type 3**: Network. (Someone accessed a Shared Folder or mapped a drive).
    *   *Note*: Psexec uses Type 3.
*   **Type 10**: RemoteDesktop. (RDP).
    *   *Note*: The source IP is logged here. Crucial for tracking RDP attacks.