Windows Event Logs

Windows maintains several event logs that record system, security, and application activity. The three core logs — Application, Security, and System — have existed since Windows NT 3.1. Applications can also create custom logs to control size or apply custom ACLs without affecting other logs. Event Viewer displays these under “Windows Logs”; ETW (Event Tracing for Windows) providers appear under “Applications and Services Logs”.

Log types

Log	Contents
Application	Events logged by applications (e.g., a database recording a file error). The application developer decides which events to record.
Security	Valid/invalid logon attempts and resource-use events (file/object creation, opening, deletion). Requires auditing to be enabled by an administrator.
System	Events logged by system components (e.g., driver load failures during startup).
CustomLog	Events logged by applications that create a custom log; lets an application control log size or attach ACLs independently.

Event types

Type	Meaning
Error	Significant problem (loss of data or functionality), e.g. service fails to load at startup.
Warning	Not immediately significant but may indicate a future problem (e.g., low disk space).
Information	Successful operation of an application, driver, or service.
Success Audit	Audited security access attempt that succeeded (e.g., successful logon).
Failure Audit	Audited security access attempt that failed (e.g., failed network drive access).

Log fields

Key fields in each event entry:

• Type — Warning, Error, Information, etc.
• Time — Date/time on the computer sending the log
• Computer — Computer name
• Provider Name — The log name (Application, Security, etc.)
• Source — The application or component that generated the event
• Event ID — Standardized (but not unique) identifier; see notable-event-ids below
• Description — Human-readable explanation

Notable event IDs

Security-relevant event IDs for defenders and attackers:

Event ID	Meaning
104	Event log was cleared (System log)
1102	Audit log was cleared (Security log; 517 on Windows 2003 and earlier). Clearing logs is [[amsi-bypass
4104	PowerShell script block logging (requires Script Block Logging to be enabled). Captures the contents of executed scripts.
4624	Successful logon. LogonType 3 = network login (e.g., SMB); LogonType 9 = logon with explicit outbound credentials (NewCredentials, e.g. runas /netonly).
4625	Failed logon. Watch for status codes: 0xC0000064 (bad username — user enumeration), 0xC000006A (bad password).
4648	Logon attempted using explicit credentials.
4672	Special privileges assigned to new logon (admin-equivalent).
4688	New process created.
4697	Service installed.
4698	Scheduled task created.

Event ID meanings shift between Windows versions and documentation is scattered. Microsoft’s Appendix L: Events to Monitor is the canonical reference for security-relevant events.

Security relevance

Event log tampering is a standard anti-forensic technique. MITRE ATT&CK technique T1070.001 (Clear Windows Event Logs) covers Remove-EventLog, wevtutil cl, and similar. Monitoring for events 104 and 1102 provides detection. Forwarding logs to a remote SIEM before they can be cleared is the standard defense.

Query these logs with get-winevent.

Sources

• Eventlog Key
• Event Types
• Appendix L: Events to monitor
• about_Logging_Windows
• mitre-attack-t1070-001.md

Related: get-winevent, amsi-bypass, windows-reconnaissance-commands