Windows Event Log Architecture

Why Event Logs Matter

Every action on a Windows system — a user logging in, a process starting, a file being accessed, a service being installed — can generate an event log entry. For SOC analysts, event logs are the primary evidence source. When Wazuh fires an alert, it is because a specific Event ID matched a detection rule. When you investigate a suspected compromise, event logs tell you what happened, when, and by whom.

The problem: Windows default logging is inadequate for security. Out of the box, Windows logs some events but misses critical ones. Understanding what is logged, what is not, and how to close the gaps is essential knowledge before you write a single detection rule.

Event Log Architecture

Windows uses a structured event logging system introduced in Windows Vista (and carried through to Windows 11 and Server 2022).

Click to enlarge

Components

Event Structure

Every event log entry contains these fields:

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" />
    <EventID>4625</EventID>
    <Level>0</Level>
    <Task>12544</Task>
    <TimeCreated SystemTime="2026-02-15T14:23:47.123Z" />
    <Computer>WORKSTATION-01</Computer>
  </System>
  <EventData>
    <Data Name="TargetUserName">admin</Data>
    <Data Name="LogonType">10</Data>
    <Data Name="IpAddress">185.220.101.42</Data>
    <Data Name="SubStatus">0xC000006A</Data>
  </EventData>
</Event>

The Critical Event IDs

These are the Event IDs you will encounter most often in SIEM alerts, threat hunting, and forensic investigations. They span three major log channels: Security, System, and Sysmon.

Security Log — Authentication & Access

Security Log — Logon Types

When you see Event ID 4624 or 4625, the Logon Type field tells you how the authentication happened:

System Log — Service & Driver Events

Sysmon — Closing the Gaps

Sysmon (System Monitor) is a free Microsoft tool that dramatically enhances Windows logging. It adds event types that native Windows does not provide. You covered Sysmon briefly in Module 2 (Lesson 2.6). Here is the complete reference for the event types you will use most:

Click to enlarge

Log Gaps and Misconfigurations

Even with Sysmon, there are common mistakes that create blind spots:

Correlating Events Across Channels

Real attacks generate events across multiple log channels. A brute-force-to-compromise attack chain might look like this:

14:20:00  Security 4625  Failed logon (admin, Type 10, from 185.220.101.42) [×12]
14:20:47  Security 4624  Successful logon (admin, Type 10, from 185.220.101.42)
14:20:48  Security 4672  Special privileges assigned to admin
14:21:03  Sysmon   1     powershell.exe spawned by explorer.exe (encoded command)
14:21:04  Sysmon   3     powershell.exe → 203.0.113.50:443 (C2 connection)
14:21:15  Sysmon   11    C:\Users\admin\AppData\Local\Temp\update.exe created
14:21:16  Sysmon   1     update.exe started by powershell.exe
14:21:17  System   7045  New service 'WindowsUpdateHelper' installed (binary: update.exe)
14:21:18  Sysmon   12    HKLM\...\Run\WindowsUpdate created → update.exe

This 78-second sequence spans Security, Sysmon, and System logs. An analyst who only monitors one channel misses pieces of the story. Wazuh collects all three and correlates them by timestamp.

Key Takeaways

• Windows Event Logs flow from providers through channels to .evtx files on disk — forwarded in real-time to your SIEM
• The most critical Security Event IDs are: 4624 (logon), 4625 (failed logon), 4688 (process create), 4720 (account created), 4732 (group membership), 7045 (service installed)
• Logon Types in 4624/4625 reveal how authentication happened — Type 3 (network) and Type 10 (RDP) are high-priority for lateral movement
• Default Windows logging is insufficient: 4688 lacks command lines, PowerShell logging is disabled, Sysmon is not installed
• Sysmon fills critical gaps: process command lines (1), network connections (3), DLL loads (7), process injection (8), LSASS access (10), DNS queries (22)
• Attackers clear logs (1102) — centralized SIEM forwarding ensures evidence survives
• Real attacks generate events across multiple channels — correlation is how you reconstruct the full attack chain

What's Next

Lesson 3.4 examines Windows authentication and credential storage — how NTLM and Kerberos work, where credentials are cached, how attackers steal them, and the Event IDs that signal credential compromise.