Windows Systems for Security
The enterprise OS whose logs carry half the incidents
Windows dominates desktops and much of enterprise infrastructure. Analysts must know its accounts, services, logs (Event Viewer / Windows Event Log) and the artifacts attackers leave when they land.
What you will learn
- Map Windows accounts, services and Event Logs to their security meaning
- Know the high-signal Event IDs (4624/4625/4688/1102)
- Recognize persistence and execution artifacts (registry, services, scheduled tasks)
What is this?
Windows is the enterprise desktop OS and bundles Active Directory (AD), the dominant directory service. Its security surface is defined by accounts and group policy, services, the Registry (configuration store), PowerShell (execution engine) and Windows Event Log — the primary forensic data source. Enterprise detections are mostly written as Event-ID queries over these logs.
Why do you need it?
- A large share of enterprise breaches happen on Windows endpoints; the SOC's biggest log volume is Windows Security events.
- AD is the crown jewels: credential theft from AD lets attackers impersonate anything.
- PowerShell abuse is how many compromises get executed and persisted.
- Knowing Event IDs turns 'check the logs' into a 20-second structured query.
Mental model
A building manager's console
A Windows domain
Active Directory is the master key system: every lock, keyholder and log entry is managed centrally. The Event Log is the security camera feed — most incidents are reconstructed from its timestamps.
How it works
- Local vs domain accounts: local SAM on the box; domain accounts and group policies from the AD domain controller.
- Events are logged to channels (Security, System, Application) with numeric Event IDs.
- High-signal Security IDs: 4624 logon success, 4625 logon failure, 4688 process creation, 4672 privileged logon, 1102 audit log cleared.
- Windows services and scheduled tasks persist processes across reboots — favorite persistence homes.
- The Registry stores configuration and autorun entries that attackers modify for persistence.
- PowerShell can execute inline, from scripts or via the command line with different visibility modes (script block logging).
Windows forensic signal map.
In production
- A SIEM rule correlates '512 4625 followed by 4624' on a single account — brute force that broke through.
- An investigation of a new service named 'svchost' registered outside the system folder pivots to scheduled-task and registry checks.
- PowerShell script-block logging catches a base64-obfuscated download cradle that killed endpoint logs.
Best practices
- Enable and centralize Security event logs with process-command-line capture.
- Audit logon, account management, process creation and credential validation (AuditPol/advanced policy).
- Watch AD for golden-ticket symptoms: impossible travel, new admin accounts, and DCSync-like replication patterns.
- Rotate local admin passwords (LAPS) and gate RDP with MFA.
Common mistakes
- Relying on default event logging, which by default omits command lines — the gold nugget of process forensics.
- Forgetting that event 1102 (log cleared) is itself data; many defenders overlook it.
- Treating PowerShell as 'always suspicious' — it's a top execution vector, but volume demands tuning, not alarm.
Debugging tips
- Query the Security channel by Event ID first — 4625 storms and 4688 spikes are the fastest lenses.
- Cross-reference user SIDs from 4624 against AD for 'was this even a valid account?'.
- Enable logging THEN reproduce — many forensic gaps come from logging that was never on.
Security considerations
- Credential-harvesting techniques (LSASS dump, mimikatz-style actions) target in-memory credentials; LSASS protection and LSA credential delegation settings mitigate.
- Signed and constrained PowerShell plus execution policy are configs, not absolutes — attackers bypass them; logging is the dependable control.
Interview checkpoint
Quick quiz
Which Event ID announces a successful logon?
Clearing the Windows Event Log is itself a serious security signal.