# Windows Event Log Analysis (lab)

> Hunt through an overnight Windows Security log from a finance file server with no alert to guide you, and reconstruct how a backup service account was abused to plant a persistent admin backdoor.

Canonical: https://codelivly.com/labs/windows-event-logs

| | |
|---|---|
| Type | Investigation |
| Difficulty | Beginner |
| Points | 200 |
| Session length | 30 min |
| Completions | 6 |

Hunt through an overnight Windows Security log from a finance file server with no alert to guide you, and reconstruct how a backup service account was abused to plant a persistent admin backdoor.

## Objective

Learn to read the Windows Security log the way an analyst does: recognise the core event IDs, interpret Logon Types, stitch scattered events into one session with the Logon ID, and spot account creation plus privileged group changes as persistence. You also learn why how an account logged on matters more than where it logged on from.

## Tasks

1. Reduce the volume with a time filter
2. Find the account that logged on in a way it never should
3. Confirm against the account's own baseline
4. Correlate the session by Logon ID
5. Read what was done during the session and map it to MITRE ATT&CK

## Related

- [All labs](https://codelivly.com/practice?type=lab)