meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
soc:forensics:windows:start [2026/06/09 17:16] – titannetsoc:forensics:windows:start [2026/06/09 17:17] (current) – titannet
Line 113: Line 113:
 | 4648 || Logon with explicit credentials, connected to other events via Account Name, Account Domain, Logon GUID | | 4648 || Logon with explicit credentials, connected to other events via Account Name, Account Domain, Logon GUID |
  
 +==== Service? ====
 +
 +|  ||  |
 +|  ||  |
 +|  ||  |
  
 6005 / 6006 — Event Log Service Started/Stopped: 6005 / 6006 — Event Log Service Started/Stopped: