SOC › Module 4 › Lesson 1
Windows Auth Logs
Windows auth literacy names Event ID 4624/4625, logon types, and failure reasons — read patterns on YOUR $SOC_LAB WinEvent samples only.
Visual · t29_windows_auth_logs
Windows auth literacy. $SOC_LAB only. Original Cyberlium.
Opening
4625 failed logon floods L1 queues — literacy names IDs and fields before you escalate stranger domain controllers.
Windows Security Event Log records authentication: 4624 successful logon, 4625 failed logon, 4648 explicit credentials, 4776 NTLM validation. Key fields: Account Name, Source Network Address, Logon Type, Failure Reason, Workstation Name. Brute-force detection literacy counts 4625 by user/source on lab samples — not live credential attacks. Cyberlium maps Windows auth fields on YOUR $SOC_LAB synthetic Security.xml or JSON — fictional users and IPs only. Next: Linux Auth Logs.
1. Windows auth events (named)
4624: success — note Logon Type (2 interactive, 3 network, 10 RDP). 4625: failure — note Status/Sub Status codes. 4776: NTLM auth pass/fail. Defender use: threshold rules on repeated 4625 from one IP.
On $SOC_LAB, list three fields you would pull from one 4625 sample line.
Command guide
Try these commands — Windows auth events (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Windows Event 4625 — https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 MITRE T1110 — https://attack.mitre.org/techniques/T1110/ Sigma win security — https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
grep '"event_id":4625' "$SOC_LAB/logs/auth.jsonl"
python3 - <<'PY'
import json, os
lab = os.environ.get('SOC_LAB', os.path.expanduser('~/cyberlium-lab/t29-soc'))
for line in open(os.path.join(lab,'logs','auth.jsonl')):
e = json.loads(line)
if e.get('event_id')==4625:
print(f"[{e['ts']}] {e['host']} {e['user']} from {e['src_ip']} — {e['reason']}")
PYPrimary tools to practice this lesson: grep, python3. Reference sites: Windows Event 4625 (https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625); MITRE T1110 (https://attack.mitre.org/techniques/T1110/); Sigma win security (https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why L1 must read failure codes
Bad password vs account locked vs unknown user change triage path. Misreading codes wastes L2 time and hides real brute force among password typos.
Students compare lab sample codes to Microsoft docs — no production domain exports.
3. Literacy ≠ live brute force
Forbidden: password spraying live portals to 'generate 4625.' Allowed: Windows auth card — four event IDs, three fields, one lab detection question on $SOC_LAB file.
Ship: Windows auth card for YOUR lab sample. Next: Linux Auth Logs.
4. What you ship: Windows auth card for $SOC_LAB
Event IDs, key fields, lab detection question. $SOC_LAB named. NO live brute force. chmod 600.
5. What you record before the next lesson
Date. Windows auth card. $SOC_LAB named. File t29-m04-l01-windows-auth-logs.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run password spray to populate 4625. Import employer DC logs without ticket.
Right
Write Windows auth card for YOUR $SOC_LAB sample. Next: Linux Auth Logs.
Mission: read Windows auth on YOUR lab sample
1) Contrast 4624 vs 4625. 2) Name two key fields. 3) Write one detection question (count failures by IP). 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Logon Type tells you interactive vs network vs RDP — context changes severity.
Knowledge Check
APPLY: Event ID 4625 indicates:
Multiple choice
Knowledge Check
APPLY: True or False: Logon Type distinguishes interactive, network, and RDP logons.
True or False
Knowledge Check
APPLY: Windows auth literacy on Cyberlium uses:
Multiple choice