Study guide
4.2 Active Directory and Event Logs for Tracing Activity
TryHackMe Security Analyst Level 1 SAL1
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current SAL1 Exam Facts 1.2 24-Hour Window, Check-In, and Delivery 1.3 Scoring, Retakes, Validity, and Access 1.4 MCQ Section Strategy
2 SOC Simulator Exam Skills
2.1 Analyst VM, Splunk, and Dynamic Alerts 2.2 Classification and Escalation Scoring 2.3 Case Reports and Investigation Notes
3 Network Essentials
3.1 OSI, TCP/IP, Devices, and the Three-Way Handshake 3.2 HTTP, TLS, VPN, Web Browsing, and Email Transmission
4 Operating System Basics
4.1 Windows and Linux Architecture, Auth, Filesystems, Processes 4.2 Active Directory and Event Logs for Tracing Activity
5 Cryptography, Cloud, Web and Scripting Basics
5.1 Encoding, Encryption, Hashing, and Decoding Tools 5.2 VMs vs Hosts, Cloud vs Virtual Hosting, SaaS and IaaS 5.3 Web Apps, APIs, JSON/XML, Scripts vs Compiled Programs
6 Cybersecurity Fundamentals and MITRE ATT&CK
6.1 CIA, Least Privilege, Human Factors, Log4Shell, EternalBlue 6.2 Navigating MITRE ATT&CK: Tactics, Techniques, Sub-techniques 6.3 Mapping Real Attacks onto ATT&CK Techniques
7 Kill Chain, NIST CSF, and Attack Indicators
7.1 Cyber Kill Chain Stages vs MITRE ATT&CK 7.2 NIST CSF: Identify, Protect, Detect, Respond, Recover 7.3 IoC vs IoA and the Pyramid of Pain
8 Social Engineering and Network Attacks
8.1 Phishing: Impersonation, Typosquatting, Spoofing, Header Analysis 8.2 SPF, DKIM, DMARC, and Email Authentication Results 8.3 Port Scanning, DDoS, and Man-in-the-Middle 8.4 DNS Poisoning, ARP Spoofing, Exfiltration, and C2 Traffic Patterns
9 Web Exploitation and Endpoint Attacks
9.1 Client vs Server Vulnerabilities, XSS, and SQL Injection 9.2 Code Injection, Path Traversal, Input Validation, Patching, WAF 9.3 Initial Access (RDP/SSH), Persistence, Privilege Escalation 9.4 Credential Theft, Mimikatz, Sysmon, and Auditd
10 Command and Control, Malware, and LOLBAS
10.1 Forward vs Reverse Shells, Beaconing, Metasploit, Cobalt Strike 10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS
11 EDR, Firewalls, and WAF
11.1 EDR vs AV, Telemetry, Containment, Remote Shell 11.2 Firewall Deployments, Limits, and Log Analysis 11.3 WAF Capabilities, Limits, and Rule Creation
12 SIEM and SOAR
12.1 SIEM Deployments, Parsing, and Raw Logs to Alerts 12.2 Alert Management, Threat Hunting, Triage, Reporting 12.3 SOAR Playbooks, Enrichment, and TI Integration
13 Threat Intelligence and Vulnerability Scanning
13.1 Feeds, Indicators, Classifying IPs, Domains, and Hashes 13.2 YARA and TI Integration with SIEM/SOAR 13.3 External vs Internal, Web vs Network Scanning
14 SOC Team, Activities, and Alert Triage
14.1 Blue/Red Teams, Hierarchy, and SOC Roles 14.2 Proactive vs Reactive: FP Remediation, Detection Engineering, Tabletop, DFIR, Threat Hunting 14.3 Workbooks; Ticket vs Alert vs Detection Rule 14.4 Triage Workflow, Severity, Status, and Verdicts
15 SOC Metrics, Escalation, and Communication
15.1 MTTA, MTTD, MTTR, SLA, and Lookups 15.2 Escalation Matrix, Urgent Remediation, and Cross-Team Communication
4.2 Active Directory and Event Logs for Tracing Activity
Key Takeaways Explain This Topic AI
Active Directory stores users, groups, computers, and GPOs; domain controllers host the directory copy and the Kerberos KDC.
Kerberos issues a TGT first, then a TGS service ticket for a named SPN; analysts usually see the member-host result as Event 4624.
Microsoft 4624 and 4625 record successful and failed logons; 4688 records process creation; correlate them with Logon ID and process IDs on the same host.
4720 means a user account was created; 4728 means a member was added to a security-enabled global group; 7045 means a service was installed in the System log.
Linux auth.log or journald, plus sshd and sudo lines, rebuild the same logon-then-command timeline that 4624 plus 4688 provide on Windows.
Last updated: September 2026
Active Directory Objects an Analyst Must Name
Active Directory Domain Services (AD DS) is Microsoft's directory for Windows domains. Treat a domain as a security and administrative boundary: one set of accounts, policies, and Kerberos keys. A forest is one or more domains that trust each other and share a schema. You do not need to design forests for this topic. You do need to name the objects that appear in tickets and logs.
Users — people and many service identities. Each has a security identifier (SID) , a user principal name (UPN) such as jlee@corp.example , and a sAMAccountName such as CORP\jlee .
Groups — collections used for authorization. Security groups appear in access tokens. Distribution groups are for email and should not grant file rights. Domain Admins is a security-enabled global group; adding a member there is a privileged-directory change, not a help-desk convenience.
Computers — every domain-joined workstation and server has a computer account, usually named with a trailing $ in logs ( ACCT-14$ ).
Group Policy Objects (GPOs) — policy packages linked to sites, domains, or organizational units (OUs) . GPOs push logon scripts, audit policy, restricted groups, and many hardening settings. Attackers who can edit a GPO can turn directory authority into fleet-wide persistence. Analysts usually see the effect (a new scheduled task, a new service, a changed audit policy) before they open the GPO editor.
Domain controllers (DCs) — servers that host a writable or read-only copy of the directory, run the Kerberos KDC, and answer Lightweight Directory Access Protocol (LDAP) queries. Compromising a DC is a domain-wide incident. An unexpected interactive logon to a DC with a workstation admin account is already a story.
Kerberos at Analyst Level: TGT Then TGS
Learn the happy path so the logs make sense. This is not a ticket-forging lesson.
The user, through LSASS, sends an Authentication Service request (AS-REQ) to the KDC on a DC.
After the DC validates the user, it returns a TGT (AS-REP). The TGT says the KDC is willing to vouch for that user for a limited time. Many estates use a 10-hour TGT lifetime, but you must read the domain policy rather than treat 10 hours as a universal constant.
When the user needs a service—Server Message Block (SMB) file share, Hypertext Transfer Protocol (HTTP) app, LDAP—the client sends a TGS-REQ that presents the TGT and names the service principal name (SPN) .
The KDC returns a service ticket (TGS-REP).
The client presents that ticket to the target ( AP-REQ ). The target does not need the user's password. It needs to validate the ticket with its own service key.
Analyst translation: a successful domain logon on a workstation is often Event 4624 with authentication package Kerberos or Negotiate. Stolen TGTs are valuable because they represent domain identity until they expire. Your job at L1 is to notice impossible travel, odd service names, and logon types that do not match the user's role. Clock skew matters: Kerberos uses timestamps, so a host far from DC time can fail in ways that look like a bad password until someone checks time sync.
Windows Event IDs SOC L1 Actually Uses
Microsoft publishes these titles. Do not invent extra IDs in a case note.
- Event ID Official meaning (Microsoft) Typical log Why L1 cares
- 4624 An account was successfully logged on Security Who signed in, from where, and how (Logon Type)
- 4625 An account failed to log on Security Spray, typo, or stale service password
- 4634 An account was logged off Security Closes the session; correlate by Logon ID
4648 A logon was attempted using explicit credentials Security runas, mapped drive, or a process that named another account
4672 Special privileges assigned to new logon Security Sensitive privileges such as SeDebugPrivilege on an admin logon
- 4688 A new process has been created Security What ran after the logon
- 4720 A user account was created Security New local or domain user
4728 A member was added to a security-enabled global group Security Domain Admins and other global security groups
7045 A service was installed in the system System (Service Control Manager) Persistence via a new service
Logon Type on 4624 and 4625 is the field that turns a pile of successes into a story. Microsoft's documented types you will use daily:
2 Interactive — a user logged on to this computer (console).
3 Network — a user or computer logged on from the network (SMB shares, many remote admin APIs).
5 Service — the Service Control Manager started a service.
7 Unlock — this workstation was unlocked; often noisy.
10 RemoteInteractive — a user logged on remotely using Terminal Services or Remote Desktop.
Microsoft also documents types 4 (Batch), 8 (NetworkCleartext), 9 (NewCredentials), 11 (CachedInteractive), and related cached variants. Use the official table; do not guess a type that is not listed.
4625 is the failure twin. A handful of failures before a 4624 can be a bad password. Dozens of failures across many usernames from one source Internet Protocol (IP) address is a spray. Always read the failure status and sub-status rather than stopping at failed logon.
4634 completes logoff. Microsoft notes that Logon IDs are unique only between reboots on the same computer, so correlate 4624 to 4634 on one host, not across a fleet by hex value alone. High 4634 volume by itself is not an incident.
4648 fires when a process attempts logon by explicitly specifying another account's credentials. That is the audit trail for runas , some scheduled tasks, and a process that reaches out as a second identity. Pair it with 4624 using Logon ID or Logon GUID when those fields populate.
4672 lists sensitive privileges assigned to the new logon. A Domain Admin interactive logon commonly produces 4624 plus 4672 with privileges such as SeDebugPrivilege , SeBackupPrivilege , and SeRestorePrivilege . A standard user 4624 without 4672 is the usual workstation pattern. 4672 is not proof of malware; it is proof the session received powerful rights.
4688 is process creation. Command-line auditing must be enabled or you only get the image name. Correlate New Process ID with the Process ID on 4624, and Creator Process ID with a parent 4688. That is how you turn PowerShell ran into PowerShell ran from winword.exe three seconds after a Type 10 logon.
4720 is account creation. On a DC it is a directory object. On a workstation it may be a local SAM user. Either way, unexpected 4720 outside a joiners process is an incident lead.
4728 is not any group change. Microsoft's title is specific: a member was added to a security-enabled global group . Domain Admins fits. Built-in Administrators is a domain local group and Enterprise Admins is a universal group; those changes use other official IDs (4732 for a security-enabled local group, 4756 for a security-enabled universal group). If you treat every group add as 4728 you will miss events.
7045 is the System-log service-install event from Service Control Manager. Microsoft also documents Security event 4697 with the same English title when that audit subcategory is enabled. Read service name, image path, and service account. C:\Windows\Temp\update.exe as a new service is not Windows Update.
Linux: auth.log, journald, sudo, and sshd
Debian and Ubuntu traditionally write authentication to /var/log/auth.log . Red Hat family hosts often use /var/log/secure . Hosts running systemd-journald expose the same streams with journalctl (for example journalctl -u ssh or journalctl _COMM=sudo ). Collect files and the journal when the distribution uses both; journald did not magically delete files on every estate.
sshd lines reconstruct remote access: Failed password or Invalid user , then Accepted publickey or Accepted password with source IP and port. A burst of failures followed by a success is the same story as 4625 then 4624.
sudo records who became whom and, with typical PAM plus sudo logging, the COMMAND= . sudo -u root /bin/bash is a shell escape, not a single package install. Pair sudo time with the preceding sshd accept so you know whether the root shell came from a remote session or a local console.
How Logs Reconstruct a Timeline
Pick a correlation key and walk time forward:
Identity: account name plus SID, or Linux UID plus username.
Session: Windows Logon ID (hex) on one host until reboot.
Process: process ID on 4688, parent PID, command line.
Network: source IP on 4624 or sshd, then later connections.
Change: 4720, 4728, 7045, or sudo / useradd / usermod .
Sort by timestamp, then ask: logon → privileges → process → credential or persistence → logoff. Gaps matter as much as events. A Type 10 4624 with no 4688 may mean process auditing is off, not that the user sat idle.
Worked example: 4624 plus 4688 chain
Host ACCT-14 , domain CORP :
- Time (UTC) Event Fields that matter
- 14:02:11 4624 jlee , Logon Type 10 , source 203.0.113.44 , Logon ID 0x55A21 , Authentication Package Kerberos
- 14:02:11 4672 Same Logon ID; SeDebugPrivilege present
- 14:02:18 4688 powershell.exe , parent explorer.exe , same Logon ID
- 14:03:02 4688 rundll32.exe with MiniDump against lsass.exe
- 14:04:40 7045 Service WinUpdateSvc , image C:\Users\Public\svc.exe
Narrative you can put in a ticket: Remote Desktop logon from an external documentation-range IP, administrative privileges on the session, PowerShell in the user desktop, LSASS dump, then a new service in a public folder. That is credential access plus persistence. Escalate. Do not close it as admin remote support without a change record that matches the IP and the binary path.
On a Linux jump box the parallel is sshd Accepted publickey for jlee from the same IP, then sudo COMMAND=/usr/bin/python3 writing a systemd unit under /etc/systemd/system/ . Same story, different log grammar.
Analyst traps
Do not treat 4634 volume as an incident; correlate it to 4624 by Logon ID on that host.
Do not skip Logon Type. Type 2 at a kiosk versus Type 10 from the internet are different cases.
Do not invent Event IDs. If the console shows an ID you were not taught, look up Microsoft's title before you write it in a case.
Do not assume journald replaced files on every host; check which pipeline the distro actually uses.