Event IDs, Password Attack Signatures, and Risk Documentation
4.4.DSkill
Expanding the Event ID Vocabulary
You already know 4624 and 4625 from 2.2.3. Four more Event IDs round out what you need for real log analysis:
📋 Event ID Reference — click each one
Successful logonROUTINE
A logon succeeded. Normal on its own — but unusual timing, location, or device makes it worth a second look.
⚠️Event 1102 deserves special treatment. Unlike every other event on this list, there's almost no innocent explanation for it appearing unexpectedly. If you see it in an investigation, that's the finding — not one clue among several.
4.4.D.3–5Concept
Reading Password Attack Signatures in Logs
Password spraying and credential stuffing can look superficially similar — both involve failed logins in a short window — but their actual log patterns are distinct once you know what to look for.
Many different users, same password, same IP, seconds apart — one guess per account, betting that at least one user chose that exact password.
🔑Offline password attacks are the exception that proves the rule: they can never be detected in logs at all, because the cracking happens entirely on the adversary's own machine, against a stolen hash database — the real login system is never touched.
4.1.DSkill
Assessing Risk: High, Moderate, Low
Risk from a device vulnerability depends on what's at stake and how likely exploitation actually is.
Level
Example
High
An organization hasn't installed a patch for a known critical vulnerability on its email server
Moderate
A water treatment plant's pump controls allow remote username/password access without MFA
Low
An employee's laptop has an open Telnet port with minimal potential impact
💡Notice that risk level tracks two things at once: how sensitive or critical the affected system is, and how weak the actual protection is. A critical system with strong protection and a low-value system with a wide-open door can land at similar risk levels for very different reasons.
Skill
Documenting a Compromised Server's Risk
ExampleGuided Example — Writing Up the Finding
During an investigation, you find Event 1102 in the security log, followed shortly by a 4688 entry showing a process launched from C:\Users\Public\svc_update.exe — a path that doesn't match any legitimate installed software.
Step 1 — Identify
An audit log clear event (1102) immediately followed by a process launch from an unrecognized, non-standard path (4688).