A SIEM is only as useful as the log sources feeding it and the analyst reading the output. Windows Event Logs generate enormous volume, and most of it is noise. These five Event IDs consistently separate signal from noise across real triage work — they belong on every watchlist and every detection rule set, regardless of industry.
The five to know
- 4624 / 4625 — Successful / Failed Logon. The foundation of authentication monitoring. Watch the Logon Type field closely: Type 3 (network) and Type 10 (RDP) from unexpected sources are high-value signals, especially spikes of 4625 preceding a single 4624.
- 4688 — A new process has been created. Process creation logging with command-line auditing enabled is one of the highest-value data sources in the entire Windows log ecosystem — it's how you catch LOLBins, encoded PowerShell, and living-off-the-land execution.
- 4720 — A user account was created. New accounts outside a change window, especially ones created and immediately added to privileged groups, are a classic persistence signal.
- 4732 — A member was added to a security-enabled local group. Privilege escalation and persistence both frequently show up here first — particularly additions to the local Administrators group.
- 7045 — A service was installed on the system. Malware and post-exploitation frameworks routinely install themselves as a Windows service for persistence. Unrecognised service names or binaries running from temp directories are an immediate red flag.
Co-published with NexSecure Cybersecurity · Nathaniel T.O, SOC Analyst
Building this into your detection stack
None of these Event IDs are useful in isolation — the value comes from correlation. A 4720 followed within minutes by a 4732 adding that same account to Domain Admins is a materially different alert than either event on its own. If you're building detection rules from scratch, start by correlating these five before adding more exotic data sources — they cover a disproportionate share of real-world intrusion activity for the engineering effort required.
Key takeaways
- Enable command-line process auditing — 4688 without it is far less useful.
- Correlate account-creation and group-membership events; either alone is weak, together they're strong.
- New Windows services (7045) from unusual paths are one of the highest-signal persistence indicators available.