meta data for this page
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| soc:forensics:windows:start [2026/06/09 17:13] – titannet | soc:forensics:windows:start [2026/06/09 17:17] (current) – titannet | ||
|---|---|---|---|
| Line 111: | Line 111: | ||
| | 4672 || Special Privileges Assigned | | | 4672 || Special Privileges Assigned | | ||
| | 4720/4726 || User account creation/ | | 4720/4726 || User account creation/ | ||
| - | | 4648 Logon with explicit credentials | | + | | 4648 || Logon with explicit credentials, connected to other events via Account Name, Account Domain, Logon GUID | |
| + | ==== Service? ==== | ||
| + | |||
| + | | || | | ||
| + | | || | | ||
| + | | || | | ||
| 6005 / 6006 — Event Log Service Started/ | 6005 / 6006 — Event Log Service Started/ | ||