4.2 Active Directory and Event Logs for Tracing Activity

Active Directory Objects an Analyst Must Name

Active Directory Domain Services (AD DS) is Microsoft's directory for Windows domains. Treat a domain as a security and administrative boundary: one set of accounts, policies, and Kerberos keys. A forest is one or more domains that trust each other and share a schema. You do not need to design forests for this topic. You do need to name the objects that appear in tickets and logs.

• Users — people and many service identities. Each has a security identifier (SID), a user principal name (UPN) such as jlee@corp.example, and a sAMAccountName such as CORP\jlee.
• Groups — collections used for authorization. Security groups appear in access tokens. Distribution groups are for email and should not grant file rights. Domain Admins is a security-enabled global group; adding a member there is a privileged-directory change, not a help-desk convenience.
• Computers — every domain-joined workstation and server has a computer account, usually named with a trailing $ in logs (ACCT-14$).
• Group Policy Objects (GPOs) — policy packages linked to sites, domains, or organizational units (OUs). GPOs push logon scripts, audit policy, restricted groups, and many hardening settings. Attackers who can edit a GPO can turn directory authority into fleet-wide persistence. Analysts usually see the effect (a new scheduled task, a new service, a changed audit policy) before they open the GPO editor.
• Domain controllers (DCs) — servers that host a writable or read-only copy of the directory, run the Kerberos KDC, and answer Lightweight Directory Access Protocol (LDAP) queries. Compromising a DC is a domain-wide incident. An unexpected interactive logon to a DC with a workstation admin account is already a story.

Kerberos at Analyst Level: TGT Then TGS

Learn the happy path so the logs make sense. This is not a ticket-forging lesson.

1. The user, through LSASS, sends an Authentication Service request (AS-REQ) to the KDC on a DC.
2. After the DC validates the user, it returns a TGT (AS-REP). The TGT says the KDC is willing to vouch for that user for a limited time. Many estates use a 10-hour TGT lifetime, but you must read the domain policy rather than treat 10 hours as a universal constant.
3. When the user needs a service—Server Message Block (SMB) file share, Hypertext Transfer Protocol (HTTP) app, LDAP—the client sends a TGS-REQ that presents the TGT and names the service principal name (SPN).
4. The KDC returns a service ticket (TGS-REP).
5. The client presents that ticket to the target (AP-REQ). The target does not need the user's password. It needs to validate the ticket with its own service key.

Analyst translation: a successful domain logon on a workstation is often Event 4624 with authentication package Kerberos or Negotiate. Stolen TGTs are valuable because they represent domain identity until they expire. Your job at L1 is to notice impossible travel, odd service names, and logon types that do not match the user's role. Clock skew matters: Kerberos uses timestamps, so a host far from DC time can fail in ways that look like a bad password until someone checks time sync.

Windows Event IDs SOC L1 Actually Uses

Microsoft publishes these titles. Do not invent extra IDs in a case note.

Logon Type on 4624 and 4625 is the field that turns a pile of successes into a story. Microsoft's documented types you will use daily:

• 2 Interactive — a user logged on to this computer (console).
• 3 Network — a user or computer logged on from the network (SMB shares, many remote admin APIs).
• 5 Service — the Service Control Manager started a service.
• 7 Unlock — this workstation was unlocked; often noisy.
• 10 RemoteInteractive — a user logged on remotely using Terminal Services or Remote Desktop.

Microsoft also documents types 4 (Batch), 8 (NetworkCleartext), 9 (NewCredentials), 11 (CachedInteractive), and related cached variants. Use the official table; do not guess a type that is not listed.

4625 is the failure twin. A handful of failures before a 4624 can be a bad password. Dozens of failures across many usernames from one source Internet Protocol (IP) address is a spray. Always read the failure status and sub-status rather than stopping at failed logon.

4634 completes logoff. Microsoft notes that Logon IDs are unique only between reboots on the same computer, so correlate 4624 to 4634 on one host, not across a fleet by hex value alone. High 4634 volume by itself is not an incident.

4648 fires when a process attempts logon by explicitly specifying another account's credentials. That is the audit trail for runas, some scheduled tasks, and a process that reaches out as a second identity. Pair it with 4624 using Logon ID or Logon GUID when those fields populate.

4672 lists sensitive privileges assigned to the new logon. A Domain Admin interactive logon commonly produces 4624 plus 4672 with privileges such as SeDebugPrivilege, SeBackupPrivilege, and SeRestorePrivilege. A standard user 4624 without 4672 is the usual workstation pattern. 4672 is not proof of malware; it is proof the session received powerful rights.

4688 is process creation. Command-line auditing must be enabled or you only get the image name. Correlate New Process ID with the Process ID on 4624, and Creator Process ID with a parent 4688. That is how you turn PowerShell ran into PowerShell ran from winword.exe three seconds after a Type 10 logon.

4720 is account creation. On a DC it is a directory object. On a workstation it may be a local SAM user. Either way, unexpected 4720 outside a joiners process is an incident lead.

4728 is not any group change. Microsoft's title is specific: a member was added to a security-enabled global group. Domain Admins fits. Built-in Administrators is a domain local group and Enterprise Admins is a universal group; those changes use other official IDs (4732 for a security-enabled local group, 4756 for a security-enabled universal group). If you treat every group add as 4728 you will miss events.

7045 is the System-log service-install event from Service Control Manager. Microsoft also documents Security event 4697 with the same English title when that audit subcategory is enabled. Read service name, image path, and service account. C:\Windows\Temp\update.exe as a new service is not Windows Update.

Linux: auth.log, journald, sudo, and sshd

Debian and Ubuntu traditionally write authentication to /var/log/auth.log. Red Hat family hosts often use /var/log/secure. Hosts running systemd-journald expose the same streams with journalctl (for example journalctl -u ssh or journalctl _COMM=sudo). Collect files and the journal when the distribution uses both; journald did not magically delete files on every estate.

sshd lines reconstruct remote access: Failed password or Invalid user, then Accepted publickey or Accepted password with source IP and port. A burst of failures followed by a success is the same story as 4625 then 4624.

sudo records who became whom and, with typical PAM plus sudo logging, the COMMAND=. sudo -u root /bin/bash is a shell escape, not a single package install. Pair sudo time with the preceding sshd accept so you know whether the root shell came from a remote session or a local console.

How Logs Reconstruct a Timeline

Pick a correlation key and walk time forward:

1. Identity: account name plus SID, or Linux UID plus username.
2. Session: Windows Logon ID (hex) on one host until reboot.
3. Process: process ID on 4688, parent PID, command line.
4. Network: source IP on 4624 or sshd, then later connections.
5. Change: 4720, 4728, 7045, or sudo / useradd / usermod.

Sort by timestamp, then ask: logon → privileges → process → credential or persistence → logoff. Gaps matter as much as events. A Type 10 4624 with no 4688 may mean process auditing is off, not that the user sat idle.

Worked example: 4624 plus 4688 chain

Host ACCT-14, domain CORP:

Narrative you can put in a ticket: Remote Desktop logon from an external documentation-range IP, administrative privileges on the session, PowerShell in the user desktop, LSASS dump, then a new service in a public folder. That is credential access plus persistence. Escalate. Do not close it as admin remote support without a change record that matches the IP and the binary path.

On a Linux jump box the parallel is sshd Accepted publickey for jlee from the same IP, then sudo COMMAND=/usr/bin/python3 writing a systemd unit under /etc/systemd/system/. Same story, different log grammar.

Analyst traps

• Do not treat 4634 volume as an incident; correlate it to 4624 by Logon ID on that host.
• Do not skip Logon Type. Type 2 at a kiosk versus Type 10 from the internet are different cases.
• Do not invent Event IDs. If the console shows an ID you were not taught, look up Microsoft's title before you write it in a case.
• Do not assume journald replaced files on every host; check which pipeline the distro actually uses.