Critical Windows Event IDs Every SOC Should Monitor (4624, 4625, 4672 and Beyond)

A SIEM ingesting every Windows event is expensive and blind at the same time: the signal drowns in millions of routine entries, and licensing costs explode. The opposite failure is just as common — collecting only what the default audit policy produces, which misses most attacker activity entirely. The fix is a curated shortlist: a few dozen Event IDs that cover authentication, privilege, persistence, and anti-forensics, collected from every machine and actually watched. This item assumes the events exist in the first place — if you have not yet deployed the Advanced Audit Policy baseline via GPO, do that first, because no collection strategy can forward events that were never generated.

Authentication — the core set

• 4624 (successful logon) — the single most useful event in Windows. The Logon Type field is where the analysis lives: type 2 (interactive), type 3 (network), type 10 (RDP). Unexpected type 10 logons to servers, or type 3 logons between workstations, are classic lateral movement traces.
• 4625 (failed logon) — brute force, password spray, and misconfigured services all surface here. Sub-status codes distinguish "bad password" from "account does not exist," which separates spraying from typos.
• 4672 (special privileges assigned) — fires when an admin-equivalent token logs on. A 4672 on a random workstation means privileged credentials touched a machine they should not, which is exactly what the tiering model exists to prevent — this event is how you verify tiering is actually holding.
• 4648 (logon with explicit credentials) — "runas" behavior; frequent in normal admin work, but bursts of it from one host are a lateral movement pattern.
• On domain controllers: 4768/4769/4771 (Kerberos TGT/service ticket requests and pre-auth failures) — the raw material for detecting kerberoasting (mass 4769 with RC4 encryption) and password spraying against Kerberos.

Account and group manipulation

• 4720 (user account created) and 4726 (deleted) — attacker-created accounts are a persistence staple; every 4720 outside your provisioning process deserves a look.
• 4728/4732/4756 (member added to security group) — filtered to privileged groups (Domain Admins, Enterprise Admins, and your Tier 0 groups), these are among the highest-signal alerts a SIEM can carry. Membership changes to these groups should be rare, ticketed events.
• 4724/4723 (password reset/change attempts) — a helpdesk resetting one password is normal; one account resetting many is takeover behavior.
• 4740 (account lockout) — clusters of lockouts across accounts indicate spraying; pair with the source host in 4625/4771.

Execution, persistence, and anti-forensics

• 4688 (process creation, with command line enabled) — the backbone of endpoint forensics and the data source for most modern detection content. Encoded PowerShell, LOLBin chains, and suspicious parent-child relationships all live here; PowerShell's own 4104 script block log completes the picture.
• 4697 (service installed) and 7045 (System log equivalent) — service creation is a top persistence and remote-execution technique (PsExec-style tooling generates these).
• 4698/4702 (scheduled task created/updated) — the other persistence classic.
• 1102 (security log cleared) — legitimate admins almost never do this. Treat it as an incident trigger, not a log line.
• 4719 (audit policy changed) — an attacker turning off your auditing looks exactly like this.
• 1149 (RDP connection, TerminalServices log) — combined with 4624 type 10, this maps RDP movement; internal RDP between workstations warrants the same suspicion as the internet-exposed variant covered in the RDP elimination item.

Collection strategy

• Forward from every machine, not just servers — initial access lands on workstations, and a DC-only collection strategy watches the castle while ignoring the gate. Windows Event Forwarding (WEF) with a curated subscription is the license-free way to do this at scale; SIEM agents with event filtering achieve the same.
• Filter at the source: collect the shortlist everywhere, the full firehose only from DCs and high-value servers. This keeps ingestion costs sane without losing coverage.
• Enrich at ingestion: logon type names, privileged-group tagging, and asset criticality labels turn raw IDs into queryable meaning — and feed directly into the detection rules covered in the companion rule-writing item.
• Validate the pipeline monthly: pick three event types, generate them on a test host (a failed logon, a test account creation, a service install), and confirm they arrive in the SIEM with acceptable latency. A silent forwarding failure is indistinguishable from a quiet network — until it matters.

This shortlist will not catch everything — no static list does — but it covers the events that appear in virtually every Windows intrusion timeline. Collect them from everywhere, alert on the high-signal subset, and every investigation you run afterward starts with evidence instead of apology.