账户登录事件（4624 4625）：4624事件表示账户成功登录，其中包含重要信息，如登录的账户名、登录的IP地址（如果是远程登录）、登录类型（如交互式登录、网络登录等）。4625事件则代表账户登录失败，通过分析登录失败的原因（如密码错误、账户不存在等）可以帮助检测潜在的暴力破解攻击。对象访问事件（4663）：记录了对文件...
LogParser.exe -i:EVT “SELECT EventID as EventID,TimeGenerated as LoginTime,EXTRACT_TOKEN(Strings,5,’|’) as username,EXTRACT_TOKEN(Strings,19,’|’) as ip FROM C:\Users\172.16.5.30\sec.evtx where EventID=4625″ EventID :该值为System节点下的EventID; TimeGenerated:该值情况类似于EventI...
<13>May 08 10:45:44 microsoft.windows.test AgentDevice=WindowsLog<tab>AgentLogFile=Security<tab>PluginVersion=7.2.9.108<tab>Source=Microsoft-Windows-Security-Auditing<tab>Computer=microsoft.windows.test<tab>OriginatingComputer=10.0.0.2<tab>User=<tab>Domain=<tab>EventID=4624<tab>EventIDCode=4624<ta...
0x02 FullEventLogView: FullEventLogView官方版是一款查看Windows事件日志的工具,包括事件描述,支持查看本地计算机的事件、也可以查看远程计算机的事件,并可以将事件导出为text、csv、tab-delimited、html、xml等类型的文件。 我们可以将所要分析的日志都放入在同一文件夹, 可以自定义从时间、事件ID、事件等级等去筛选...
Event 4624 S: An account was successfully logged on. Event 4625 F: An account failed to log on. Event 4648 S: A logon was attempted using explicit credentials. Event 4675 S: SIDs were filtered. Audit Network Policy Server Audit Other Logon/Logoff Events ...
1.1 在搜索框中搜索 “事件查看器”,双击打开。(事件查看器的位置在C:\WINDOWS\system32,名字为eventvwr.msc) 1.2 展开左侧的 “Windows 日志” 然后双击 “安全”。(其他的日志可能需要选择其他选项) 1.3 点击最右边”操作” 栏中的 “删选当前日志…” ...
Logon GUID[Type = GUID]: a GUID that can help you correlate this event with another event that can contain the sameLogon GUID, "4769(S, F): A Kerberos service ticket was requested event on a domain controller. It also can be used for correlation between a 4624 event and several other...
eventlog[Security,,"Success Audit",,^4624$,,skip] 1. Zabbix agent(active);数据类型选择Log;监控间隔60秒。 其中,监控项Key的参数用大括号包裹、用逗号分隔,下面解释下各参数的含义: Security:事件的日志名称。 "Success Audit":事件的severity。
windows日志分析工具-LogonTracer 0x01 Windows应急日志常用的几个事件ID 4624:这个事件ID表示成功登陆的用户,用来筛选该系统的用户登陆成功情况。 4625:这个事件ID表示登陆失败的用户。 4768:这个事件ID表示Kerberos身份验证票证请求(TGT请求) 4769:这个事件ID表示已发出Kerberos服务票证请求(ST请求)...
Since the logon type is 5, it's normal for the Source Network Address and Source Port fields to have no values. The logon type 5 means a service was started by the Service Control Manager. https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624 ...