Windows event log cheat sheet: by the question you are asking

How to use this

The event ID lookup answers "what is 4688". This sheet answers the question you had before that one: "which events tell me whether somebody logged on to this host from somewhere else". Find the question, read across.

Two warnings that apply to every row. An empty result is frequently a configuration finding: several of the most useful events are off until somebody enables the audit subcategory. And the Security log rolls by size, 20 MB by default on many builds, which on a busy domain controller can be hours. Check the oldest record in the log before you conclude anything from an absence.

Who logged on, from where, and how

Event	Log	Default	Tells you	Does not tell you
4624	Security	On	A successful logon: account, logon type, source address, logon ID, authentication package	What they did. Follow the logon ID into 4688 and 4634
4625	Security	On for servers. Verify on clients with auditpol	A failed logon, with a status and sub-status code for why	Whether a later success was the same actor
4648	Security	On	A logon with explicit credentials (runas, a mapped drive with other credentials), recorded on the source host	That the target accepted it. Pair with 4624 on the target
4672	Security	On	The new logon holds administrator-equivalent privileges	Which privilege was then used
4776	Security	On (DCs and the host for local accounts)	An NTLM credential validation, with the workstation name as the client supplied it	A reliable source. The workstation name is client-controlled
4778, 4779	Security	Off (Audit Other Logon/Logoff Events)	RDP session reconnect and disconnect, with the client name and address	The initial connection. That is a 4624 type 10
1149	TerminalServices-RemoteConnectionManager/Operational	On	An RDP connection reached authentication, with source address	That the logon succeeded
21, 22, 24, 25	TerminalServices-LocalSessionManager/Operational	On	RDP session logon, shell start, disconnect, reconnect. Often survives when Security has rolled	Anything about non-RDP logons

Logon types worth memorising

Type	Meaning	Why it matters
2	Interactive, at the console	Also what some remote tools and runas produce
3	Network (SMB, most remote administration)	The signature of lateral movement. Credentials are not cached on the target
4	Batch	Scheduled tasks
5	Service	A service starting under an account
7	Unlock
8	NetworkCleartext	A password crossed the wire in clear, IIS basic authentication for example
9	NewCredentials	runas /netonly. Pass-the-hash tooling commonly produces this
10	RemoteInteractive	RDP. Credentials are present in memory on the target
11	CachedInteractive	Logged on with cached domain credentials, no domain controller reached

Kerberos, on the domain controller

Event	Tells you	Look for
4768	A TGT was requested	Result code 0x6 (unknown principal) in volume is username enumeration. Pre-authentication type 0 on a success means pre-auth is disabled for the account, which enables AS-REP roasting
4769	A service ticket was requested	Ticket encryption type 0x17 (RC4) for a service account in an estate that otherwise uses AES is the classic Kerberoasting signal
4771	Kerberos pre-authentication failed	Failure code 0x18 is a wrong password. Many accounts, one source address, a short window: password spraying that never produces a 4625 on a member server

Both 4768 and 4769 depend on the Kerberos audit subcategories being enabled on domain controllers.

What ran

Event	Log	Default	Tells you	Does not tell you
4688	Security	Off (Audit Process Creation)	Process name, creator process, account, token elevation	The command line, unless the separate policy "Include command line in process creation events" is also on. No hashes, ever
Sysmon 1	Microsoft-Windows-Sysmon/Operational	Needs Sysmon	Command line, hashes, parent command line, OriginalFileName, a stable ProcessGuid	Anything the config excluded. Read the config before trusting an absence
4104	Microsoft-Windows-PowerShell/Operational	Partly. Script block logging must be enabled for full coverage; some suspicious blocks are logged regardless	The decoded script text as it executed, after any -EncodedCommand or string obfuscation was undone	PowerShell 2.0 sessions, which predate the feature. Look for engine version 2 in event 400 of the classic Windows PowerShell log
Sysmon 7	Sysmon	Usually disabled for volume	Image (DLL) loads
Sysmon 10	Sysmon	Config-dependent	One process opening another, with the access mask. The LSASS access record	Whether memory was actually read

What persisted

Event	Log	Default	Tells you
7045	System	On	A service was installed: name, image path, start type, account. No audit policy needed, which makes it the most reliable record of PsExec-style movement
4697	Security	Off (Audit Security System Extension)	The same, with the subject account and logon ID, so it can be tied to a 4624
4698	Security	Off (Audit Other Object Access Events)	A scheduled task was created, with the full task XML including the action
4699, 4700, 4701, 4702	Security	Off, as above	Task deleted, enabled, disabled, updated
106, 140, 141, 200, 201	TaskScheduler/Operational	The log itself is disabled by default on many builds	Task registered, updated, deleted, action started, action completed
Sysmon 12, 13, 14	Sysmon	Config-dependent	Registry key and value changes. Run keys, service keys, IFEO
Sysmon 19, 20, 21	Sysmon	Config-dependent	WMI filter, consumer and binding created. Almost the only log of WMI persistence
5861	WMI-Activity/Operational	On	A permanent WMI event consumer binding was registered. The fallback when there is no Sysmon

Accounts and groups

Event	Tells you
4720	A user account was created, and by whom
4722, 4725, 4726	Account enabled, disabled, deleted
4724, 4723	Password reset by another account, password change by the account itself
4728, 4732, 4756	Member added to a global, local or universal security group. 4732 on a workstation for the local Administrators group is a small event with large consequences
4738	A user account was changed. Check for "Do not require Kerberos preauthentication" and password-never-expires being set
4740	Account locked out, with the caller computer name

Tampering and gaps

Event	Log	Tells you
1102	Security	The Security log was cleared, and by which account. It is the first record of the new log, so it survives
104	System	Any other log was cleared
4719	Security	System audit policy was changed. Auditing turned off is quieter than a cleared log
6005, 6006, 6008	System	Event log service started, stopped, unexpected shutdown. They bracket reboots, and a reboot is where memory evidence ended
4616	Security	The system time was changed. Every timestamp after it needs checking against a second source

Three habits

1. Pivot on the logon ID, the hexadecimal TargetLogonId in 4624. It ties a logon to every 4688 that session produced and to the 4634 or 4647 that ended it.
2. Read both ends. Lateral movement writes 4648 on the source and 4624 type 3 on the target. One without the other is a finding about logging, not about the intrusion.
3. Record the oldest event in each log you relied on. It is the difference between "there was no logon" and "there is no record of a logon after 09:40, which is as far back as the log goes".