configuring-windows-event-logging-for-detection
Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigation. Use when enabling audit policies for logon events, process creation, privilege use, and object access to feed SIEM detection rules. Activates for requests involving Windows audit policy, event log configuration, security logging, or detection-oriented logging.
Best use case
configuring-windows-event-logging-for-detection is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigation. Use when enabling audit policies for logon events, process creation, privilege use, and object access to feed SIEM detection rules. Activates for requests involving Windows audit policy, event log configuration, security logging, or detection-oriented logging.
Teams using configuring-windows-event-logging-for-detection should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/configuring-windows-event-logging-for-detection/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How configuring-windows-event-logging-for-detection Compares
| Feature / Agent | configuring-windows-event-logging-for-detection | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigation. Use when enabling audit policies for logon events, process creation, privilege use, and object access to feed SIEM detection rules. Activates for requests involving Windows audit policy, event log configuration, security logging, or detection-oriented logging.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Configuring Windows Event Logging for Detection ## When to Use Use this skill when: - Configuring Windows Advanced Audit Policy for security monitoring - Enabling process creation auditing with command line logging (Event 4688) - Setting up logon/logoff auditing for authentication monitoring - Sizing event log storage and forwarding to SIEM platforms **Do not use** for Sysmon configuration (separate skill) or Linux audit logging. ## Prerequisites - Windows Server or Windows 10/11 systems with Group Policy management access - Active Directory environment with Group Policy Object (GPO) creation privileges - SIEM platform configured to receive Windows Event Log forwarding - Understanding of Windows security event IDs and audit categories ## Workflow ### Step 1: Configure Advanced Audit Policy via GPO ``` Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies Recommended settings: Account Logon: - Audit Credential Validation: Success, Failure - Audit Kerberos Authentication: Success, Failure Account Management: - Audit Security Group Management: Success - Audit User Account Management: Success, Failure Logon/Logoff: - Audit Logon: Success, Failure - Audit Logoff: Success - Audit Special Logon: Success - Audit Other Logon/Logoff Events: Success, Failure Object Access: - Audit File Share: Success, Failure - Audit Removable Storage: Success, Failure - Audit SAM: Success Policy Change: - Audit Audit Policy Change: Success, Failure - Audit Authentication Policy Change: Success Privilege Use: - Audit Sensitive Privilege Use: Success, Failure Detailed Tracking: - Audit Process Creation: Success - Audit DPAPI Activity: Success, Failure ``` ### Step 2: Enable Command Line in Process Creation Events ```powershell # Registry: Enable command line logging in Event 4688 New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" ` -Name ProcessCreationIncludeCmdLine_Enabled -Value 1 -PropertyType DWORD -Force # GPO: Computer Configuration → Administrative Templates → System → Audit Process Creation # "Include command line in process creation events" → Enabled ``` ### Step 3: Configure Event Log Sizes ```powershell # Increase Security log to 1 GB (default 20 MB is insufficient) wevtutil sl Security /ms:1073741824 # Increase PowerShell Operational log wevtutil sl "Microsoft-Windows-PowerShell/Operational" /ms:536870912 # Set log retention to overwrite as needed wevtutil sl Security /rt:false # Configure via GPO: # Computer Configuration → Administrative Templates → Windows Components # → Event Log Service → Security # Maximum log file size (KB): 1048576 ``` ### Step 4: Configure Windows Event Forwarding (WEF) ```powershell # On collector server: wecutil qc /q # Create subscription for high-value events: # Event IDs: 4624 (logon), 4625 (failed logon), 4688 (process create), # 4672 (special privilege), 4720 (user created), 4728 (group membership), # 7045 (service installed), 1102 (log cleared) # On source endpoints (GPO): # Configure WinRM: winrm quickconfig # Configure event forwarding: Computer Configuration → Admin Templates # → Windows Components → Event Forwarding # Configure target Subscription Manager: Server=http://collector:5985/wsman/SubscriptionManager/WEC ``` ### Step 5: Key Event IDs for Detection ``` Authentication Events: 4624 - Successful logon (Type 2=Interactive, 3=Network, 10=RemoteInteractive) 4625 - Failed logon attempt 4648 - Logon using explicit credentials (RunAs, pass-the-hash indicator) 4672 - Special privileges assigned (admin logon) 4776 - NTLM credential validation Process Events: 4688 - Process creation (with command line if enabled) 4689 - Process termination Account Events: 4720 - User account created 4722 - User account enabled 4724 - Password reset attempted 4728 - Member added to security group 4732 - Member added to local group 4756 - Member added to universal group Service/System Events: 7045 - New service installed (persistence indicator) 1102 - Audit log cleared (evidence tampering) 4697 - Service installed in the system Lateral Movement Indicators: 4648 + 4624(Type 3) - Credential-based lateral movement 5140 - Network share accessed 5145 - Network share access check (detailed file share) ``` ## Key Concepts | Term | Definition | |------|-----------| | **Advanced Audit Policy** | Granular audit subcategories (58 subcategories vs. 9 basic categories) | | **Event ID 4688** | Process creation event; essential for tracking execution on endpoints | | **WEF** | Windows Event Forwarding; centralized log collection without third-party agents | | **Logon Type** | Numeric code indicating authentication method (2=interactive, 3=network, 10=RDP) | ## Tools & Systems - **Windows Event Forwarding (WEF)**: Built-in centralized log collection - **NXLog**: Open-source log forwarding agent for Windows events - **Winlogbeat**: Elastic Agent for shipping Windows event logs to Elasticsearch - **Palantir WEF Configuration**: Open-source WEF subscription templates ## Common Pitfalls - **Using basic audit policy instead of advanced**: Basic and advanced audit policies conflict. Always use advanced audit policy exclusively. - **Default log size too small**: 20 MB Security log fills in minutes on busy servers. Set minimum 1 GB. - **Missing command line logging**: Event 4688 without command line content has minimal detection value. Always enable ProcessCreationIncludeCmdLine_Enabled. - **Not forwarding logs**: Local event logs are lost when endpoints are wiped by ransomware. Forward to centralized SIEM immediately.
Related Skills
performing-yara-rule-development-for-detection
Develop precise YARA rules for malware detection by identifying unique byte patterns, strings, and behavioral indicators in executable files while minimizing false positives.
performing-windows-artifact-analysis-with-eric-zimmerman-tools
Perform comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite including KAPE, MFTECmd, PECmd, LECmd, JLECmd, and Timeline Explorer for parsing registry hives, prefetch files, event logs, and file system metadata.
performing-steganography-detection
Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.
performing-lateral-movement-detection
Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.
performing-dns-tunneling-detection
Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality. Uses scapy for packet capture analysis and statistical methods to distinguish legitimate DNS from covert channels. Use when hunting for data exfiltration.
performing-container-escape-detection
Detects container escape attempts by analyzing namespace configurations, privileged container checks, dangerous capability assignments, and host path mounts using the kubernetes Python client. Identifies CVE-2022-0492 style escapes via cgroup abuse. Use when auditing container security posture or investigating escape attempts.
performing-adversary-in-the-middle-phishing-detection
Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.
implementing-web-application-logging-with-modsecurity
Configure ModSecurity WAF with OWASP Core Rule Set (CRS) for web application logging, tune rules to reduce false positives, analyze audit logs for attack detection, and implement custom SecRules for application-specific threats. The analyst configures SecRuleEngine, SecAuditEngine, and CRS paranoia levels to balance security coverage with operational stability. Activates for requests involving WAF configuration, ModSecurity rule tuning, web application audit logging, or CRS deployment.
implementing-siem-use-cases-for-detection
Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across Splunk, Elastic, and Sentinel. Use when SOC teams need to expand detection coverage, formalize use case lifecycle management, or build a detection library aligned to organizational threat profile.
implementing-ransomware-kill-switch-detection
Detects and exploits ransomware kill switch mechanisms including mutex-based execution guards, domain-based kill switches, and registry-based termination checks. Implements proactive mutex vaccination and kill switch domain monitoring to prevent ransomware from executing. Activates for requests involving ransomware kill switch analysis, mutex vaccination, WannaCry-style domain kill switches, or malware execution guard detection.
implementing-network-intrusion-prevention-with-suricata
Deploy and configure Suricata as a network intrusion prevention system with custom rules, Emerging Threats rulesets, and inline traffic inspection for real-time threat blocking.
implementing-honeytokens-for-breach-detection
Deploys canary tokens and honeytokens (fake AWS credentials, DNS canaries, document beacons, database records) that trigger alerts when accessed by attackers. Uses the Canarytokens API and custom webhook integrations for breach detection. Use when building deception-based early warning systems for intrusion detection.