Reading logs like an analyst
Windows Security log cheat-sheet:
- 4624 (logon success — check Logon Type: 3=network, 10=RDP) · 4625 (failure — reason codes!) · 4672 (special privileges assigned) · 4688 (process creation, with command line if audit policy on — TURN IT ON) · 4698 (scheduled task created = classic persistence) · 7045 (System log: new service installed).
Attack patterns in logs:
- Password spray: many accounts, few failures each, same source → look ACROSS users, not per-user counts.
- Impossible travel: logon Lahore 09:00, logon Frankfurt 09:40.
- Lateral movement: 4624 type-3 bursts + PsExec-style service installs (7045) + RDP (4624 type-10) to servers.
- Exfil: abnormal outbound volume to new domains, DNS TXT spikes, cloud uploads from servers that never do that.
Linux auth.log: 'Accepted password for' from foreign IPs, new UID-0 accounts in /etc/passwd, cron edits, 'sudo: command not allowed' bursts.
Write your first three detections (do this in your home lab):
- 4625 count > 10 in 5 min from one source → brute-force alert
- 4624 type-10 (RDP) to a DC from a non-admin workstation → lateral movement alert
- New scheduled task (4698) containing powershell -enc → persistence alert
Every SOC interview asks "walk me through a detection you built." Now you have three.