Windows Logging for SOC | TryHackMe Walkthrough Guide 👨💻
Learn Windows Logging for SOC in this TryHackMe walkthrough. Understand key log types, Event Viewer, and boost your Blue Team skills with hands-on tasks. Enter our latest giveaway 👉 https://bit.ly/VietTube ✅
Room: https://tryhackme.com/room/windowslog...
00:00 Windows Logging for SOC - Use Logs to detect Threats
00:15 Task 1: Introduction
SOC analysts using the logs in SIEM. This room begins your long journey into Windows logging - a key skill for any SOC analyst or DFIR professional.
Objectives: Understand Windows event logs, monitoring log sources like Sysmon and PowerShell.
00:24 Task 2: What Is Logged
Logging Overview: Logs record user and system actions like logins or file creation. They're vital for SOC: enabling incident response, threat hunting, alerting, and detection.
Anatomy of a Log Entry: Windows logs are powerful but stored in unreadable EVTX binary files under C:\Windows\System32\winevt\Logs. Each EVTX file tracks specific events like app logs or security actions such as logins.
Looking at the last screenshot, which event ID describes a successful login?
00:56 Task 3: Security Log: Authentication
Security logs 4624 (Successful Logon) and 4625 (Failed Logon) are key for SOC. 4624 helps spot suspicious logins, while 4625 reveals brute-force attempts.
To detect RDP brute-force, filter Security logs for Event ID 4625. Focus on Logon Types 3 and 10.
To analyze RDP logins, filter Security logs for 4624 with Logon Type 10. If NLA is on, it’s preceded by Logon Type 3. Check for suspicious IPs or prior brute force. Note the Logon ID—it tracks session activity.
Which IP performed a brute force of the THM-PC?
Which user has been breached as a result of the attack?
What was the Logon ID of the malicious RDP login?
03:08 Task 4: Security Log: User Management
Event IDs:
4720/4722/4738: Account created/enabled/changed — may signal a backdoor.
4725/4726: Account disabled/deleted — attackers may target SOC users.
4723/4724: Password changed/reset — could allow access.
4732/4733: Group changes — focus on "Administrators".
Which user was created by the attacker soon after the RDP login?
Which two privileged groups was the backdoor user added to?
Does the Logon ID field match what you saw in the previous task (Yea/Nay)?
08:20 Task 5: Sysmon: Process Monitoring
Event 4688 logs process creation with command line and parent details but is disabled by default. Sysmon Event 1 offers richer data like hashes and signatures but needs manual installation. Once installed, view in: Applications & Services - Microsoft - Windows - Sysmon - Operational.
To analyze process launches, check Sysmon Event ID 1. Look for odd paths (e.g., C:\Temp), strange names (like aa.exe), or malware hashes. Review the parent process—unexpected ones (e.g., Notepad spawning CMD) are red flags. Trace events by Logon ID.
Which web browser does Sarah use to browse the web?
Which file did Sarah download from the browser?
Which URL was the file downloaded from?
14:05 Task 6: Sysmon: Files and Network
Sysmon logs more than process events—it tracks file/registry changes, network connections, and DNS queries. Unlike default logs, it's fully configurable. Key events:
11/13: Detect file or registry changes
3/22: Spot suspicious network or DNS activity
Which file was created by the downloaded malware to persist on the host?
What is the Command & Control server malware connected to?
Finally, which domain does the malicious IP correspond to?
17:17 Task 7: PowerShell: Logging Commands
PowerShell is powerful and often abused by attackers. Sysmon logs only show its launch (Event ID 1), not the commands run. To see those, check the history file:
C:\Users\USER\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt.
Which PowerShell command ... ?
When did the Administrator run ... ?
Can you find the flag ... ?
👉Keywords
windows logging for SOC
tryhackme walkthrough
windows log analysis
blue team tryhackme
SOC analyst training
windows event logs
event viewer tutorial
SIEM windows logs
tryhackme soc room
cybersecurity logging
windows monitoring guide
tryhackme write-up
👉What did you think of this video?
#WindowsLogging #TryHackMe #BlueTeam #CyberSecurity #SOCTraining
#EventViewer #LogAnalysis #TryHackMeWalkthrough #SIEM #WindowsLogs
Perplexity Pro Free
🎁https://pplx.ai/vietkim02768759
Get TubeBuddy Pro Free:
🎁https://www.tubebuddy.com/pricing?a=9...
👇For any Query message me on Facebook👇
Facebook Link :- https://FB.COM/vietkim8
-----------------
Disclaimer: This video is for educational purposes only. Under Section 107 of the Copyright Act 1976, its use is considered fair for criticism, comment, news reporting, teaching, scholarship, and research. No persuasion is intended.
-----------------
🔔📢 Subscribe for more TIPs from VietKim 👉 https://bit.ly/VietTube
☕Buy Me a Coffee ☕https://paypal.me/win10bamboo
🌐 Follow VietKim on https://FB.COM/vietkim8
🌐 Visit https://bloggeroffer.blogspot.com/ to learn more ...