Most Common Windows Event IDs to Hunt – Mind Map


Windows Event Logs mindmap provides a simplified view of Windows Event logs and their capacities that enables defenders to enhance visibility for different purposes:

  • Log collection (eg: into a SIEM)
  • Threat hunting
  • Forensic / DFIR
  • Troubleshooting

Scheduled tasks:

  • Event ID 4697 , This event generates when new service was installed in the system.
  • Event ID 106, This event is logged when the user registered the Task Scheduler task.
  • Event ID 4702, This event generates when scheduled task was updated.
  • Event ID 140,This event is logged when the time service has stopped advertising as a time source because the local machine is not an Active Directory Domain Controller.

Read more…