CyArt Academy
Unlock ProSign in
CYART // SCHEMA · SSO-IDP7 NODES · 7 LINKSOPEN APP1AUTHN REQUEST2LOOKUPSIGN TOKENID TOKEN / SAML3ACTOR · UserACTOR01UserSERVICE · App (SP / RP) — redirects, verifiesSERVICE02App (SP / RP)redirects, verifiesSERVICE · IdP core — sessions, MFA, policiesSERVICE03IdP coresessions, MFA, policiesDATA · Directory — users, groups, SCIMDATA04Directoryusers, groups, SCIMDATA · Signing keys — HSM, kid rotationDATA05Signing keysHSM, kid rotationCONTROL · Risk signals — new device, impossible travelCONTROL06Risk signalsnew device, impossible travelDATA · Audit — every login eventDATA07Auditevery login event

Windows and identity logs

The Windows Security events that matter (4624, 4625, 4688, 4769 and friends), what logon types and status codes mean, and how to read Entra ID and Okta sign-in logs for spraying, token theft and MFA abuse.

🔒 PROLesson·10 min read·Intermediate → Advanced
WindowsActive DirectoryEntra IDOktaidentity

01The Windows events that matter

✓What you will learn
  • Know the core Security event IDs and what each proves
  • Read logon types and 4625 status codes to separate spraying from typos
  • Spot Kerberoasting in 4769 and abuse in 4688 command lines
  • Read Entra ID and Okta sign-in logs for spraying, token theft and MFA abuse

Windows logs thousands of event IDs. An analyst needs about fifteen. Learn what each one proves and, just as important, where it is logged: on the workstation, the member server, or the domain controller.

Event IDMeaningLogged onWhy you care
4624Successful logonTarget machineWho got in, how (logon type), from where
4625Failed logonTarget machineSpraying, brute force, misconfigured services
4648Logon with explicit credentialsSource machinerunas, lateral movement with typed creds
4672Special privileges assignedTarget machineAdmin-equivalent logon; pair with 4624
4688Process createdThat machineCommand lines (only if command-line auditing is on)
4768 / 4769Kerberos TGT / service ticket requestedDomain controllerKerberoasting, unusual service access
4776NTLM credential validationDC (domain) or localNTLM use where Kerberos is expected
4720 / 4728 / 4732User created / added to global / local groupDCPersistence, privilege escalation
4698Scheduled task createdThat machinePersistence
7045Service installed (System log)That machinePsExec-style lateral movement, persistence
1102Security log clearedThat machineAlmost never legitimate on a server
!4688 without command lines is half blind

Process creation auditing logs the image name by default. "Include command line in process creation events" must be enabled by policy, or use Sysmon event 1 or EDR. powershell.exe alone tells you nothing; its arguments tell you everything.

This is an advanced module

Investigation & threat hunting is part of the Pro pass. 3 more sections — the deep dives, the final design, follow-ups and the test — unlock with it.

Enter access codeSee Pro pass

Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.

Related lessons