πŸ”
Windows Forensic Handbook
search
⌘Ctrlk
πŸ”
Windows Forensic Handbook
  • πŸ‘‹Welcome
  • Artifacts by Type
    • πŸ—„οΈRegistry Artifacts
    • πŸ“‚Filesystem Artifacts
    • πŸ“…Event Log Artifacts
  • Artifacts by Activity
    • πŸƒβ€β™‚οΈExecution
    • πŸ—’οΈFile Activity
    • πŸ‘¨β€πŸ”§Account Activity
      • Account Creation Time
      • Group Membership
      • Last Login
      • Login History
      • Logon ID
        • EventID 4624: An account was successfully logged on
        • EventID 4688: A new process has been created
      • Relative Identifier
      • Security Identifier
      • Username
    • 🌎Network Activity
    • πŸ”Browser Activity
    • πŸ–₯️System Enumeration
gitbookPowered by GitBook
block-quoteOn this pagechevron-down
  1. Artifacts by Activitychevron-right
  2. πŸ‘¨β€πŸ”§Account Activity

Logon ID

EventID 4624: An account was successfully logged onchevron-rightEventID 4688: A new process has been createdchevron-right

Last updated 2 years ago