/Windows Events Reference
Quickly search and reference Windows Security and Sysmon Event IDs.
Local processing
This tool processes your input in your browser.
Command Palette
Search for a command to run...
Filters
Found 16 events
Sysmon 1Process Creation
Process CreationProvides detailed information about newly created processes. It is equivalent to Windows Event 4688 but includes the command line and parent-child process relationships.
Useful Fields:Image, CommandLine, ParentImage, Hashes, User
Malicious Use:Detecting execution of malicious payloads, LOLBins like PowerShell or cmd.exe, and suspicious parent-child chains (e.g. Word spawning cmd.exe).
4688A new process has been created
Process CreationGenerated every time a new process starts. Requires Command Line auditing to be enabled via GPO for full visibility.
Useful Fields:New Process Name, Creator Process ID, Process Command Line
Malicious Use:Tracking attacker execution and lateral movement tools.
Sysmon 8CreateRemoteThread
Process CreationDetects when a process creates a thread in another process, a common technique for process injection.
Useful Fields:SourceImage, TargetImage, StartAddress, StartFunction
Malicious Use:Identifying process injection techniques like DLL injection or shellcode execution.
Sysmon 10ProcessAccess
Process CreationLogs when a process opens another process, which is often used for credential dumping or memory reading.
Useful Fields:SourceImage, TargetImage, CallTrace, GrantedAccess
Malicious Use:Detecting credential dumping tools like Mimikatz or procdump targeting LSASS.
Sysmon 3Network Connection
Network ConnectionLogs TCP/UDP connections on the machine.
Useful Fields:Image, DestinationIp, DestinationPort, Protocol
Malicious Use:Identifying C2 beaconing, lateral movement via RDP/SMB, or exfiltration.
Sysmon 22DNSEvent (DNS query)
Network ConnectionLogs DNS queries, regardless of whether they succeed or fail, and what process performed them.
Useful Fields:Image, QueryName, QueryStatus, QueryResults
Malicious Use:Detecting DNS tunneling, C2 domains, and DGA (Domain Generation Algorithms).
Sysmon 11FileCreate
File SystemLogs when a file is created or overwritten.
Useful Fields:Image, TargetFilename, CreationUtcTime
Malicious Use:Tracking malware drops, web shell uploads, or ransomware activity.
Sysmon 23FileDelete
File SystemLogs when a file is deleted. Can capture the deleted file if configured.
Useful Fields:Image, TargetFilename, Hashes, IsExecutable
Malicious Use:Detecting attackers wiping their tools, clearing logs, or ransomware removing volume shadow copies.
Sysmon 13RegistryEvent (Value Set)
RegistryLogs registry value modifications.
Useful Fields:Image, TargetObject, Details
Malicious Use:Identifying persistence mechanisms (e.g. Run keys) or UAC bypass attempts.
4624Logon Success
AuthenticationAn account was successfully logged on. Key indicator of valid user activity or compromised accounts.
Useful Fields:Logon Type, Account Name, Source Network Address
Malicious Use:Tracking lateral movement via compromised credentials, Pass-the-Hash (Type 3), or RDP (Type 10).
4625Logon Failure
AuthenticationAn account failed to log on. Essential for detecting brute force attacks.
Useful Fields:Logon Type, Account Name, Failure Reason, Source Network Address
Malicious Use:Detecting password spraying or brute force attacks.
4724Password Reset Attempt
AuthenticationAn attempt was made to reset an account's password by an administrator.
Useful Fields:Target Account Name, Subject Account Name
Malicious Use:Attackers resetting admin passwords to maintain persistent access to a compromised domain.
1102Audit Log Cleared
SystemThe audit log was cleared. This is highly suspicious if performed outside of regular maintenance.
Useful Fields:Subject User, Log Name
Malicious Use:Defense evasion. Attackers covering their tracks by wiping the Security Event Log.
7045Service Installed
SystemA service was installed in the system.
Useful Fields:Service Name, Service File Name, Service Start Type
Malicious Use:Detecting persistence via malicious Windows Services.
4698Scheduled Task Created
SystemA scheduled task was created.
Useful Fields:Task Name, Task Content
Malicious Use:Detecting persistence via malicious Scheduled Tasks.
5140Network Share Access
Object AccessA network share object was accessed.
Useful Fields:Share Name, Share Local Path, Account Name
Malicious Use:Tracking lateral movement, access to sensitive shares (e.g. C$, ADMIN$), or data staging.
Related Tools
Incident Response Playbook Engine
Design and execute structured security incident response workflows.
MITRE ATT&CK Reference
Search and reference common MITRE ATT&CK tactics, techniques, and procedures (TTPs).
Linux Telemetry Reference
Search and reference Linux Logs and Auditd Records.
Incident Report Generator
Create structured IT and cybersecurity incident reports from raw notes, logs, and timelines.