If you suspect a Windows system has been compromised, you don’t need to guess what happened—the system has likely already recorded the entire narrative. By analyzing five specific Event IDs, security professionals can reconstruct the timeline of an attack from the initial entry to the final cleanup.

1. The Entry Point: Brute Force Detection (IDs 4625 & 4624)

The first sign of a breach often appears in the login logs. Attackers frequently use brute-force or credential-stuffing attacks to gain access.

• Event ID 4625 signifies a failed login attempt.
• Event ID 4624 signifies a successful login.

The Context: A single failed login is common, but a “wall of failures” followed immediately by one success is a definitive indicator of a successful brute-force attack.

• Example: Imagine reviewing your logs and seeing 1,000 instances of Event ID 4625 for the “Admin” account over five minutes, followed by a single Event ID 4624 from an unfamiliar IP address. This pattern suggests the attacker finally guessed the correct password.

2. Monitoring the Action: Process Creation (ID 4688)

Once inside, an attacker needs to execute commands to navigate the network or steal data. Event ID 4688 tracks every process that is run on the system.

The Context: This ID allows you to see exactly “what they ran” after they gained access.

• Example: If you see Event ID 4688 recording the execution of powershell.exe followed by whoami or net user, it indicates the attacker is performing reconnaissance to understand their level of privilege on the machine.

3. Establishing a Backdoor: Account Creation (ID 4720)

Attackers don’t want to rely on the stolen credentials forever; they often create their own way back into the system. Event ID 4720 is triggered whenever a new user account is created.

The Context: This is a “classic backdoor” technique. By creating a new local or domain account, the attacker ensures they can return even if the original compromised password is changed.

• Example: A sudden Event ID 4720 for an account named “BackupAdmin” or “SVC_Task” that wasn’t authorized by your IT department is a major red flag that an attacker is trying to maintain persistence.

4. Covering the Tracks: Clearing the Logs (ID 1102)

Experienced attackers know that their actions are being recorded, so they often attempt to delete the evidence. Event ID 1102 is generated when the security log is cleared.

The Context: Attackers clear logs specifically to “cover their tracks”. In a healthy environment, security logs are almost never cleared manually.

• Example: If your monitoring system alerts you to Event ID 1102, it is often the “smoking gun” of an active breach. It means someone with high-level privileges is trying to hide a sequence of events that occurred just moments prior.

Summary Checklist for Defenders

When auditing a suspicious Windows box, prioritize these fingerprints to understand the breach:

• 4625/4624: Look for the transition from “the wall of failures” to success.
• 4688: Identify the malicious tools or scripts the attacker executed.
• 4720: Check for unauthorized accounts used as backdoors.
• 1102: Note the moment the attacker tried to go dark by deleting evidence.

The breach is already written down; you just need to know where to look.