Instant forensic decoding and correlation database for Windows Security Auditing events, Sysmon telemetry, Windows Logon Types, and NTSTATUS error codes. Map log anomalies to MITRE ATT&CK techniques and investigative playbooks.
Try searching by numeric Event ID, NTSTATUS hex code (e.g. 0xC000...), or broader terms like "Logon", "Privilege", or "Kerberos".
Windows Event Logs (stored in C:\Windows\System32\Winevt\Logs\ as binary .evtx files) constitute the definitive evidentiary record of authentication, process creation, service execution, and privilege delegation on Windows endpoints and Domain Controllers.
However, raw event logs are notoriously verbose. Threat actors attempt to blend into administrative noise or perform defense evasion by clearing security logs (Event ID 1102). Examiners must correlate multiple event IDs and NTSTATUS substatus codes to piece together an adversary's kill chain:
Identify repeated Event ID 4625 logs. Inspect the SubStatus: code 0xC000006A indicates valid usernames tested with incorrect passwords, while 0xC0000234 indicates account lockout.
Correlate Event ID 4624 with Logon Type 3 (Network SMB) or Logon Type 10 (RemoteInteractive RDP), followed immediately by Event ID 7045 (New Service Installation via PsExec).
Monitor Sysmon Event ID 1 and Security Event ID 4688 with Command Line Auditing enabled to catch PowerShell (Event ID 4104), MSBuild, certutil, or bitsadmin executing encoded payloads.
| Logon Type | Classification | Forensic Significance |
|---|---|---|
| Logon Type 2 | Interactive | User logged on locally via the physical keyboard/console. |
| Logon Type 3 | Network | Connection from network (SMB file share, IPC$, PsExec, WMI, pass-the-hash). |
| Logon Type 4 | Batch | Scheduled task execution or batch scripting service. |
| Logon Type 5 | Service | Service started by the Service Control Manager (SCM). |
| Logon Type 7 | Unlock | Workstation was unlocked by the user. |
| Logon Type 8 | NetworkCleartext | Logon with cleartext credentials (e.g. IIS basic authentication). |
| Logon Type 9 | NewCredentials | Clone of caller credentials via RunAs /netonly (credential impersonation). |
| Logon Type 10 | RemoteInteractive | User logged on remotely via Remote Desktop (RDP) or Terminal Services. |
| Logon Type 11 | CachedInteractive | User logged on with cached domain credentials while disconnected from DC. |
%SystemRoot%\System32\Winevt\Logs\ as individual binary .evtx files (e.g. Security.evtx, System.evtx, Application.evtx, and Microsoft-Windows-Sysmon%4Operational.evtx). On legacy Windows XP/2003 systems, logs were stored in .evt format.
wevtutil cl Security or calls ClearEventLog(), Windows immediately logs Event ID 1102 ("The audit log was cleared") in the Security log, and Event ID 104 in the System log. These events record the exact timestamp and username who wiped the log. Furthermore, unallocated disk clusters and Volume Shadow Copies (VSS) frequently preserve previous copies of the .evtx files.
cmd.exe to calc.exe).