Cybersecurity Tip: Best Windows Event ID To Find Malware

[@kientrinhuc4214]

shiiiii, bro you save my life. I have been looking for a detailed video tutorial like this for few months and now I found it

[@MyDFIR]

Happy to help! Welcome to the channel :)

[@Bits4you]

We just covered this last night in my Cybersecurity course. Thank you for the additional explanation regarding event ID

[@MyDFIR]

Awesome! Hopefully you are learning lots from the course 😃
Do you mind sharing the course that you are taking?

[@c0ri]

This is such a good Event ID. One more thing I monitor for this is Elevation Token Type '%%1936' or '%%1937' where the account name doesn't contain an $ symbol (ie a real account) which means the UAC is disabled or the account ran the process with Administrator privileges.

[@MyDFIR]

Awesome! Thanks for the input

[@cajunphilippine]

thank you, my friend. Good to know this.

[@MyDFIR]

Anytime! Event IDs is something easy to get overwhelmed. But fear not, Google is your friend when you need more info on Event IDs😜

[@ibrahimYODA-qk1ng]

Always on point

[@RubenMuñozAragon-e9n]

Great information, thanks.

[@MyDFIR]

Glad it was helpful!

[@danielantoniassi7646]

Love this :)

[@Bb-307]

Excellent 😁

[@mylosovich24]

I appreciate your channel so much, Thank you

[@MyDFIR]

You are so welcome!

[@johnvardy9559]

You have mentioned in the future you show us a tool which is better for These logs.which will be that tool?

[@MyDFIR]

This Thursday ill be showing you one tool we can use to view these event logs. But another tool i like to use is called Event Log Explorer.

[@johnvardy9559]

@@MyDFIR thanks 🙏 great News

[@olumideajose2162]

very informative👍

[@MyDFIR]

Thanks! Hopefully learned something new 😀

[@ismayilmammadov8469]

Thank you 👍

[@MyDFIR]

You are welcome

[@nagulapallibhaskar]

Perfection level🎉🎉🎉

[@MyDFIR]

Thanks for watching ❤️

[@calvinnguyen1699]

how to filter log eventid:4625 with logon type=3

[@MyDFIR]

You can filter using powershell or push the logs over to Splunk

[@b3rn4rd01]

Kool👍

[@MyDFIR]

Thanks for watching!

[@johnvardy9559]

Great Job

[@kash212]

i use windows home

[@Chironex_Fleckeri]

5061 pls no

[@Chironex_Fleckeri]

Whew. It was just some system integrity audit failure oh well

[@MyDFIR]

LOL 4624 type 10 service account pls no

[@alicelik7956]

event id 4798 chrome.exe im using ungoogled chromium pls what is that mean my browser crash status acces violation after this event.

[@midoahmed2725]

Great information, thank you very much

[@MyDFIR]

Glad it was helpful!