## Windows Event Logs

The "Black Box" of Windows. Stored in `.evtx` format.
Viewer: `Event Viewer` (`eventvwr.msc`).

### Main Logs
1.  **Security**: Logins, Privilege use. (Most important for us).
2.  **System**: Drivers, Service crashes, Reboot.
3.  **Application**: App crashes (SQL Server logs, etc).

### Critical Event IDs to Memorize
If you are a SOC Analyst, tattoo these on your arm.

*   **4624**: Successful Logon.
    *   Look at **Logon Type**:
        *   Type 2: Interactive (Keyboard/Local).
        *   Type 3: Network (SMB/Shared Folder).
        *   Type 10: RDP (Remote Desktop).
*   **4625**: Failed Logon. (Brute force indicator).
*   **4720**: User Created. (Did a hacker add a backdoor user?).
*   **4672**: Special Privileges Assigned. (Admin logon).
*   **1102**: Audit Log Cleared. (Hacker trying to cover tracks. HUGE RED FLAG).
*   **7045**: Service Installed (System Log). (Persistence mechanism).

### Sysmon (System Monitor)
Default Windows logs are okay. **Sysmon** (from Sysinternals) is amazing. It logs process creation, network connections, and DNS Lookups.