5 Windows Event IDs every system administrator should be monitoring
If you manage Windows machines, the event logs are already recording thousands of events an hour. Most admins don't have time to read through them, and you don't need to. Microsoft's own security monitoring guidance points to a fairly small set of event IDs that cover the most common attack patterns, and Windows logs most of them by default (4698 needs "Audit Other Object Access Events" turned on). These are the five we'd start with.
4625
Failed Logon
Five or more 4625 events for the same account in a short window usually means someone is guessing passwords. If a run of 4625s is followed by a 4624 (successful logon) for that account, assume one of the guesses worked. To cut the noise, filter out machine accounts (names ending in $) and service accounts you know about, and pay most attention to failures with Logon Type 3 (network) and Type 10 (RDP).
4624
Successful Logon (Type 3 and Type 10)
Your machines log hundreds of these a day, and most are routine. The ones to look at are Logon Type 10 (RDP) from IPs you don't expect and Logon Type 3 (network) from workstations to servers. A Type 3 logon from one workstation to another is a common sign of lateral movement and should be checked. Also watch for Type 9 (NewCredentials), which often shows up with pass-the-hash or runas /netonly.
7045
New Service Installed
Every new service on a Windows machine gets a 7045 in the System log. PsExec relies on this: it installs a temporary service on the remote host. If you didn't install a service and it has a random name, points to a temp folder, or runs as SYSTEM, look into it right away. The same event also shows attackers installing a service so their foothold survives a reboot.
4698
Scheduled Task Created
Scheduled tasks are one of the most common ways attackers keep access to a machine. A 4698 records the task that was created, the command it runs, and the account that created it. Watch for tasks that run PowerShell with encoded commands and tasks created by non-admin users. A 4698 followed by a 4699 (task deleted) within a few minutes is also worth a look, since creating a task, running it once and removing it is a common living-off-the-land pattern.
1102
Security Log Cleared
When the Security log is cleared, Windows writes a 1102 as part of the clear, so it's the one event you'll still find afterward. There is almost never a legitimate reason to clear the Security log on a production machine, so treat a 1102 as a strong sign that someone is covering their tracks. Check for Event ID 104 in the System log as well, which records the System log being cleared.
These five events won’t show you everything, but between them they cover brute force, lateral movement, persistence, privilege escalation and log clearing. The Picus Security Red Report 2026, which analyzed over one million malware samples, found that 80% of the top 10 attack techniques are about staying hidden and keeping long-term access. Several of the events above are where that kind of activity tends to show up. You can check for them by hand in Event Viewer, or have Arden watch for them and alert you when its detection rules match. Arden detects many common attacks but not all of them, so a quiet day in the dashboard isn’t proof that nothing happened.
Two of these stages get their own articles: spotting lateral movement and detecting credential dumps. If you’re weighing this against an enterprise SIEM, see why small IT teams are choosing lightweight alternatives.
Have Arden watch these event IDs for you
Arden collects these events, along with many others, from the machines you add and alerts you when one of its detection rules matches.
Request a Beta Invite