26/08/2026
Windows Event IDs and Sysmon Event IDs are essential for every SOC Analyst.
In this video, we explore the most important Windows Security Event IDs and Sysmon Event IDs used during SOC monitoring, threat detection, incident investigation, and threat hunting.
You will learn how Windows Event Logs and Sysmon provide visibility into attacker activity and how SOC analysts can use these events to investigate suspicious behavior.
🔐 Windows Event IDs Covered
4624 – Successful Logon
4625 – Failed Logon
4634 – Logoff
4672 – Special Privileges Assigned
4688 – Process Creation
4697 – Service Installed
1102 – Audit Log Cleared
🛡️ Important Sysmon Event IDs
Event ID 1 – Process Creation
Event ID 3 – Network Connection
Event ID 7 – Image Loaded
Event ID 8 – CreateRemoteThread
Event ID 10 – Process Access
Event ID 11 – File Created
Event ID 13 – Registry Value Set
Event ID 22 – DNS Query
Event ID 23 – File Delete
Event ID 24 – Clipboard Change
Event ID 25 – Process Tampering
🔎 SOC Investigation Perspective
We also discuss how analysts can correlate these events to identify:
✅ Brute-force attacks
✅ Suspicious logons
✅ Malicious process ex*****on
✅ PowerShell activity
✅ Network connections
✅ Malware ex*****on
✅ Persistence
✅ Registry modifications
✅ DNS-based suspicious activity
✅ File creation and deletion
✅ Process injection/tampering
The goal is not simply to memorize Event IDs — learn what the event means, why it matters, and how a SOC analyst investigates it.
🎯 Who Should Watch?
This video is useful for:
SOC Analysts
Cybersecurity Beginners
Blue Team Analysts
Incident Responders
Threat Hunters
SIEM Analysts
Cybersecurity Students
Anyone preparing for SOC interviews
🚀 If you're learning SOC
Subscribe to SOC SIVA for practical cybersecurity training, SOC investigations, SIEM use cases, Windows logs, Sysmon, threat hunting, incident response and hands-on attack simulations.
LEARN | ANALYZE | DEFEND 🛡️
