πŸ”
Windows Forensic Handbook
CtrlK
  • πŸ‘‹Welcome
  • Artifacts by Type
    • πŸ—„οΈRegistry Artifacts
    • πŸ“‚Filesystem Artifacts
    • πŸ“…Event Log Artifacts
  • Artifacts by Activity
    • πŸƒβ€β™‚οΈExecution
    • πŸ—’οΈFile Activity
    • πŸ‘¨β€πŸ”§Account Activity
      • Account Creation Time
      • Group Membership
      • Last Login
      • Login History
      • Logon ID
      • Relative Identifier
      • Security Identifier
        • Background Activity Montitor
        • System Resource Usage Monitor (SRUM)
        • Recycle Bin $I/$R Files
        • EventID 4688: A new process has been created
        • EventID 4624: An account was successfully logged on
        • Event ID 7045: Service Installed
        • EventID 1024: RDP ClientActiveX is trying to connect to the server
        • EventID 2004: Firewall Rule Added
        • EventID 2005: Firewall Rule Modified
        • EventID 2006: Firewall Rule Deleted
        • EventID 2071: Firewall Rule Added
        • EventID 2073: Firewall Rule Modified
        • EventID 2052: Firewall Rule Deleted
        • EventID 9707: Command Execution Started
      • Username
    • 🌎Network Activity
    • πŸ”Browser Activity
    • πŸ–₯️System Enumeration
Powered by GitBook
On this page
  1. Artifacts by Activity
  2. πŸ‘¨β€πŸ”§Account Activity

Security Identifier

Background Activity MontitorSystem Resource Usage Monitor (SRUM)Recycle Bin $I/$R FilesEventID 4688: A new process has been createdEventID 4624: An account was successfully logged onEvent ID 7045: Service InstalledEventID 1024: RDP ClientActiveX is trying to connect to the serverEventID 2004: Firewall Rule AddedEventID 2005: Firewall Rule ModifiedEventID 2006: Firewall Rule DeletedEventID 2071: Firewall Rule AddedEventID 2073: Firewall Rule ModifiedEventID 2052: Firewall Rule DeletedEventID 9707: Command Execution Started

Last updated 1 year ago