Mozella L. McCoy-Flowers Cybersecurity & Digital Forensics | SOC Analyst Path
This project simulates a Security Operations Center (SOC) investigation using Windows Event Viewer to analyze audited security events. The focus is on identifying privileged logon activity, correlating authentication events, and determining whether activity is legitimate or suspicious.
A Windows endpoint generated a privileged logon event (Event ID 4672).
As a SOC analyst, the objective is to:
- Identify the event
- Analyze account activity
- Correlate authentication logs
- Determine if the behavior is suspicious
- Windows Virtual Machine
- Event Viewer
- Windows Security Logs
- 🔍 Log Analysis & Event Investigation
- 🔐 Privileged Access Monitoring
- 🔗 Event Correlation & Timeline Analysis
- 🛡️ Host-Based Threat Detection
- 📊 SOC Triage Methodology
| Technique | Description |
|---|---|
| T1078 | Valid Accounts |
| T1068 | Privilege Escalation |
The Event Viewer interface, which provides access to system and security logs on a Windows endpoint.
Event Viewer is the primary tool used by analysts to investigate host-based activity and identify potential security events.
A SOC analyst begins investigations by accessing Event Viewer to establish visibility into system activity. This step confirms access to the endpoint’s logging infrastructure and ensures logs are available for analysis.
If logging is disabled or inaccessible, it may indicate:
- Log tampering
- Defense evasion techniques
- Misconfigured audit policies
Navigation to Windows Logs → Security, where audited events are stored.
The Security log contains critical data related to:
- Authentication attempts
- Privilege usage
- Account activity
An analyst targets the Security log to begin reviewing authentication and access-related events. This is the primary data source for identifying suspicious user behavior.
A lack of expected events or unusual gaps in logging may indicate:
- Audit policy misconfiguration
- Log deletion
- Potential attacker activity
A list of security events with key attributes such as Event ID, timestamps, and sources.
This dataset represents all recorded security-relevant activity on the system.
Analysts scan logs for high-value Event IDs and anomalies. They prioritize:
- Authentication events
- Privilege-related activity
- Unusual patterns or spikes
Large volumes of failed logins or irregular patterns may indicate:
- Brute-force attacks
- Credential stuffing
- Unauthorized access attempts
Event ID 4672, indicating that special privileges were assigned during a successful logon.
Privileged logons grant elevated access and are high-value targets for attackers.
A SOC analyst correlates Event ID 4672 with Event ID 4624 to validate the session.
Key steps:
- Match account name
- Match Logon ID
- Review logon type
- Analyze timestamp sequence
Unexpected privileged logons may indicate:
- Credential compromise
- Privilege escalation
- Lateral movement
The General tab confirming that elevated privileges were assigned during logon.
This verifies the nature of the event and confirms it is security-relevant.
Analysts validate:
- Whether the account should have elevated privileges
- Whether the event aligns with expected activity
Unexpected privilege assignments may indicate:
- Misuse of admin accounts
- Unauthorized access
Detailed event metadata including account name, SID, and Logon ID.
This information enables correlation and forensic analysis.
Analysts use:
- Logon ID to track sessions across events
- SID to uniquely identify accounts
- Metadata to validate activity
Unknown or suspicious account identifiers may indicate:
- Rogue accounts
- Persistence mechanisms
- Unauthorized access
The use of filtering to isolate specific Event IDs.
Security logs are large; filtering improves efficiency and accuracy.
Analysts filter for:
- 4672 → Privileged logon
- 4624 → Successful logon
- 4625 → Failed logon
This allows targeted investigation.
Failure to filter effectively may result in:
- Missed threats
- Slower response times
A refined list of relevant security events after filtering.
Reduces noise and highlights actionable data.
Analysts review filtered results to:
- Identify patterns
- Detect anomalies
- Prioritize investigation
Clusters of suspicious events may indicate:
- Ongoing attacks
- Automated intrusion attempts
This view displays multiple authentication-related events within the Windows Security log, including:
- 4625 → Failed logon attempts (Audit Failure)
- 4624 → Successful logon
- 4672 → Privileged logon
The screenshot highlights Event ID 4625, indicating unsuccessful login attempts.
Authentication event correlation is critical for identifying attack patterns.
By analyzing sequences of events, analysts can detect:
- Brute-force attacks
- Credential stuffing
- Unauthorized access attempts
A SOC analyst would correlate these events to reconstruct a timeline:
- Multiple 4625 events → Repeated failed login attempts
- 4624 event → Successful login after failures
- 4672 event → Privileged access assigned
Key analysis steps:
- Compare timestamps to identify rapid login attempts
- Match account names across events
- Use Logon ID to link sessions
- Determine logon type (remote, local, service)
This pattern is a strong indicator of:
- Brute-force attack success
- Credential compromise
- Unauthorized privilege escalation
In a real SOC environment, this pattern would trigger:
-
SIEM alerts (Splunk, Sentinel, etc.)
-
Automated detection rules such as:
- “Multiple failed logins followed by success”
- “Privileged logon after authentication anomalies”
This type of behavior is commonly mapped to:
- MITRE ATT&CK T1110 (Brute Force)
- MITRE ATT&CK T1078 (Valid Accounts)
“I identified multiple failed authentication attempts (Event ID 4625) followed by a successful login (4624) and a privileged logon (4672). This pattern is consistent with a potential brute-force attack leading to credential compromise and elevated access.”
A complete view of the investigation within Event Viewer.
Represents the full SOC workflow from detection to analysis.
Analysts combine:
- Log review
- Filtering
- Correlation to reach a conclusion.
Failure to correlate events may result in:
- Misinterpretation
- Missed indicators of compromise
- Identified Event ID 4672 indicating privileged logon
- Verified privilege assignment through event details
- Used filtering to isolate relevant logs
- Correlated authentication events for context
- Applied SOC investigation methodology
This lab demonstrates how analysts:
- Monitor endpoint logs
- Detect privilege escalation
- Investigate authentication anomalies
- Use logs as forensic evidence
- Security logs are the primary source of audited events
- Event ID 4672 indicates privileged access
- Event correlation is essential
- Filtering improves efficiency
- Logs provide evidence, not conclusions
This project demonstrates skills used by:
- SOC Analysts
- Incident Responders
- Threat Analysts
Used to detect:
- Credential compromise
- Privilege escalation
- Unauthorized access
windows-audited-events-lab/
│
├── README.md
├── incident-report.md
├── cysaplus-takeaways.md
└── /screenshots
This project demonstrates the ability to analyze Windows security logs, identify privileged activity, and apply structured SOC investigation techniques.
Understanding audited events is a foundational cybersecurity skill and essential for detecting real-world threats.