Windows Logon Events Cheat Sheet: Event IDs, Types and Failure Codes
A shift-ready reference for Windows logon event IDs, logon types and failure codes, with KQL, SPL and PowerShell to show who logged on, from where and how.
5 Nov 20268 min read
All
Alert Triage
Detection Engineering
Incident Response
Threat Intelligence
Threat Hunting
SIEM and Tools
Career and Certs
Cheat Sheets
Threat News
3 posts found
How to Hunt for C2 Beaconing in Proxy and EDR Logs
Find regular callback traffic in proxy and EDR logs with interval analysis in KQL and SPL, then separate real command and control from noisy legitimate software.
5 Nov 20269 min read
How to Detect LSASS Memory Access with Sysmon Event ID 10
Build a tuned LSASS access detection from Sysmon Event ID 10, with Splunk, Sentinel and Sigma versions, plus triage steps and the hardening that reduces your risk.
2 Nov 202612 min read