Lab #10 · Windows event log triage

The sample

File	events.csv (+ events.json)
SHA-256	d127db0640c496e4a0f662935fe185b30e1ee1ba1998d60aedb85c7567f95032
Contents	14 Security/System events
Context	NORTHSEA-DEV, 2026-06-16 08:41 to 09:25 UTC

⬇ Download the export (.zip)

The .zip carries the CSV, the JSON, a README disclaimer and the Synapse logo. All accounts, hosts and IPs are synthetic. Analyse in a VM.

1. Scenario

A workstation's foothold (lab #07) was the start, not the end. Using it, an attacker tried passwords, landed on a weak service account, created their own account, gave it admin, planted persistence, looked around, and reached for the next host.

You have the Security and System events. Turn them into a timeline and a containment plan.

⚠️ Disclaimer: synthetic Windows event export. All accounts, hosts and IP addresses are fictional (RFC1918 / TEST-NET). No real environment is involved.

2. Objectives

Tally the events by Event ID to frame the incident.
Trace the account takeover (failed logons, then a valid account).
Find the persistence and the privilege escalation.
Spot the discovery and the lateral movement.
Write the timeline, the IOCs and the containment actions.

3. Step-by-step triage

Load and scope

awk · jq

Before reading line by line, tally the Event IDs. The mix already tells you what kind of incident this is.

bash

awk -F, 'NR>2{print $2}' events.csv | sort | uniq -c | sort -rn
# or on the JSON:
jq -r '.[].EventID' events.json | sort | uniq -c

output

5 4625   (failed logon)
3 4688   (process creation)
1 4624   (successful logon)
1 4720   (account created)
1 4732   (added to a group)
1 7045   (service installed)
1 4698   (scheduled task)
1 4648   (explicit-credential logon)

💡 This spread, brute force, account creation, a new service and a scheduled task, is a full intrusion, not a one-off alert. Know the key IDs: 4625 fail, 4624 success, 4688 process, 4720 create user, 4732 add to group, 7045 service, 4698 task, 4648 explicit creds.

Foothold and account takeover

4688 · 4625 · 4624

Start at the entry and follow the logons: a burst of failures, then a success on a different account.

bash

grep -E ',4688,|,4625,|,4624,' events.csv

output

08:41:10  4688  alex        powershell.exe -enc (parent explorer.exe)  [ClickFix, lab #07]
09:05:01..09:05:17  4625 x5  Administrator  Failed logon LogonType=3 Source=10.10.10.5
09:06:33  4624  svc-backup  Successful logon LogonType=3 Source=10.10.10.5

🔴 Five failed logons against Administrator in 16 seconds is a brute-force (T1110). It fails, but 90 seconds later svc-backup, a weak service account, logs on successfully: the attacker pivoted to a valid account (T1078).

Persistence and privilege escalation

4720 · 4732 · 7045 · 4698

With a foothold account, the attacker makes themselves at home: a new account, admin rights, and two persistence mechanisms.

bash

grep -E ',4720,|,4732,|,7045,|,4698,' events.csv

output

09:08:12  4720  svc-backup    created account: helpdesk-svc
09:09:40  4732  svc-backup    added helpdesk-svc to Administrators
09:12:05  7045  helpdesk-svc  service WinUpdaterSvc -> C:\ProgramData\wus\svc.exe
09:14:22  4698  helpdesk-svc  task \OneDriveSync -> powershell -w hidden -File ...\t.ps1

🔴 The chain is textbook: create helpdesk-svc (T1136.001), add it to Administrators (T1548), then plant a service (T1543.003) and a scheduled task (T1053.005) both pointing at C:\ProgramData\wus\. That folder is now a key IOC.

Discovery and lateral movement

4688 · 4648

Before moving, attackers look around. Then they reuse credentials to reach the next host.

bash

grep -E 'net.exe|whoami|,4648,' events.csv

output

09:20:11  4688  helpdesk-svc  net.exe group "Domain Admins" /domain  [discovery]
09:20:40  4688  helpdesk-svc  whoami.exe /priv                         [discovery]
09:25:03  4648  helpdesk-svc  explicit-credential logon -> 10.10.10.20 [lateral movement]

🧭 net group "Domain Admins" and whoami /priv are classic discovery (T1087 / T1057). The 4648 to 10.10.10.20 is the attacker reusing credentials to move to a second host (T1021), the intrusion is spreading.

4. Timeline and containment

Timeline: 08:41 ClickFix foothold (alex) -> 09:05 brute force on Administrator -> 09:06 valid logon as svc-backup -> 09:08 create helpdesk-svc -> 09:09 make it admin -> 09:12 and 09:14 persistence (service + task) -> 09:20 discovery -> 09:25 lateral move to 10.10.10.20.
Contain now: disable helpdesk-svc and svc-backup, remove helpdesk-svc from Administrators.
Remove persistence: delete the WinUpdaterSvc service, the \OneDriveSync task, and the C:\ProgramData\wus\ files.
Isolate NORTHSEA-DEV and 10.10.10.20; reset svc-backup and alex; hunt the original foothold (labs #07, #05) and check other hosts for the same service/task.

5. IOC and ATT&CK summary

Type	Value	ATT&CK
Brute force	5x 4625 on Administrator from 10.10.10.5	T1110
Account takeover	svc-backup (valid logon)	T1078
New account	helpdesk-svc added to Administrators	T1136.001 / T1548
Persistence	svc WinUpdaterSvc + task OneDriveSync (C:\ProgramData\wus\)	T1543.003 / T1053.005
Lateral movement	4648 -> 10.10.10.20	T1021

6. References

Windows Security event IDs, Microsoft

Reference for 4624/4625/4688/4720/4732/4698/4648 and audit policy.

MITRE T1543.003, Windows Service

Persistence via a new or modified Windows service (7045).

MITRE T1053.005, Scheduled Task

Persistence and execution via scheduled tasks (4698).

Chainsaw, WithSecure

Fast triage and Sigma-rule hunting over Windows event logs.

← Back to Labs

Entirely fictional environment, for educational use only. All accounts, hosts and IPs are synthetic.

Reading the logs: a Windows intrusion, event by event

The sample

1. Scenario

2. Objectives

3. Step-by-step triage

Load and scope

Foothold and account takeover

Persistence and privilege escalation

Discovery and lateral movement

4. Timeline and containment

5. IOC and ATT&CK summary

6. References