Lion Cipher Lab

Read and hunt in Windows Event Logs

• Digital Forensics & IR (DFIR)
• Beginner
• ~50 min
• Free · no account required

Why it matters

When something goes wrong on a Windows machine, the event log is usually the first place a defender looks and often the only durable record of what happened. Logons, failed logons, new user accounts, installed services, and (once you turn it on) every process that started with its full command line all land here. Learning to open the right channel, jump to the Event ID that matters, and pull the same records with one PowerShell query turns a wall of noise into a timeline you can reason about. Just as important is the honest part most tutorials skip: out of the box Windows logs far less than…

What you'll learn

• understanding what the Windows event log, channels, and Event IDs are
• navigating Event Viewer and its Security, System, Application, and Sysmon channels
• recognising the key security Event IDs (4624, 4625, 4672, 4688, 4720, 7045) and what they mean
• filtering and searching a log by Event ID in Event Viewer
• querying logs with PowerShell Get-WinEvent and a FilterHashtable
• reading logon types and interpreting a failed-logon burst
• enabling process-creation and command-line auditing so the logs are worth hunting in

Steps in this lab

1. What an event log, a channel, and an Event ID are
2. Open Event Viewer and find the channels
3. The security Event IDs worth memorising
4. Filter and search inside Event Viewer
5. Do the same thing faster with PowerShell
6. Read a failed-logon burst
7. The honest catch: default logging is thin
8. What you actually learned, and the one habit to keep

Open the full interactive lab →