How to Analyze Windows Event Logs

What’s in a Windows Security event

Each Windows Security event carries an EventID, a TimeCreated SystemTime, the Computer it came from, and an EventData block of named <Data> fields. For authentication events the fields that matter most are TargetUserName, IpAddress, LogonType, and — on failures — Status and SubStatus. LogTriage’s parser reads both the XML export and binary .evtx, mapping each recognized EventID to a normalized event: 4625 becomes a failed POST /windows/logon, 4624 a successful one, and 4688 a process event whose path includes the executable name.

What to look at first

1. 4625 failed logons grouped by IpAddress. One source failing against many TargetUserName values is password spraying; one source hammering one account is brute force. Both are LogonType 3 in the common remote case.
2. The SubStatus on each 4625. 0xC000006A (bad password) versus 0xC0000064 (no such account) tells you whether the attacker already has valid usernames.
3. A 4624 success from an attacker IpAddress after a run of failures. This is the compromise moment. Note the WorkstationName and AuthenticationPackageName — an NTLM logon from a name like ATTACKER-VM is a red flag.
4. 4672 special privileges assigned to the account that just logged on — an early sign the compromised identity is privileged.
5. 4688 process creation with a suspicious CommandLine (for example net group "Domain Admins" /domain), and 4720 / 4728 for account creation and Domain Admins membership — the persistence stage.

Common patterns and what they mean

Pattern	Likely meaning
Many 4625 from one IP across many usernames, SubStatus 0xC000006A	Password spraying
Many 4625 against one username from one IP	Brute force
4625 with SubStatus 0xC0000064 across many names	Username enumeration
4625 failures then a 4624 success, same IP	Successful compromise after guessing
4720 then 4728 (add to Domain Admins)	Backdoor account + privilege escalation
4698 scheduled task creation with encoded PowerShell	Persistence

Where manual log review breaks down

The Security log on a domain controller can produce thousands of 4625 events an hour from ordinary mistyped passwords and stale cached credentials, so the campaign that matters — one source, many accounts, one eventual success — is genuinely hard to see by scrolling. LogTriage groups failed logons by source IP inside a session window and raises a credential-stuffing pattern when the volume and failure rate cross the threshold, escalating to critical when a successful logon appears in the same session. The attacker IP is also checked against confirmed-malicious CIDR ranges, so a logon attempt from a known Tor exit is flagged even before the pattern completes. There is a published, sample-validated Sigma rule for the 4625 spraying case, LTR-0012, and a companion use case on Windows credential stuffing.