Sysmon, Windows Security Log, KQL queries and attack detection through logs. Key Event IDs for SOC.
Why this matters right now
Windows Logs — the key evidence in investigations
After the course you will be able to
Not abstract knowledge — concrete skills for detection and investigations
Real attacks in the course
Every lesson is built on real incidents — not made-up examples
APT29 Cozy Bear — detected through Event Logs
Attacks on the DNC were detected through anomalies in Windows Event Logs — atypical authentication patterns and unusual processes in Sysmon Event 1.
WannaCry — Event 7045 as a precursor
Installation of the malicious WannaCry service generated Event ID 7045. Organizations with proper alerts on this Event ID managed to stop the spread.
Brute force uncovered in 2 minutes
A SOC analyst noticed a spike in Event 4625 (failed logins) through a Sentinel alert. The attack with 847 attempts was blocked within 2 minutes of starting.
Course Program
3 topics · 12 lessons: Sysmon, Event IDs and Threat Hunting with KQL
Where this course leads
Windows Event Log Analysis — the foundation for Threat Hunters and DFIR specialists
SOC Analyst L2/L3
Analyze complex incidents through Windows Event Logs, investigate APT activity, conduct retrospective analysis.
Threat Hunter
Proactively hunt threats in Windows logs using MITRE ATT&CK hypotheses. Find what automated systems missed.
DFIR Specialist
Investigate incidents, reconstruct attack timelines from Windows artifacts, prepare evidence for legal cases.
Who this course is for
SOC Analysts L1/L2
Want to level up — from simple alerts to deep analysis of Windows artifacts.
Threat Hunters
Need Event Log skills for building hypotheses and proactive threat hunting in infrastructure.
DFIR Specialists
Investigating incidents and want to systematize your work with Windows Event Logs.
Read Windows logs
like a professional
today
12 lessons, Sysmon, KQL and real Threat Hunting. Detect attacks before they cause damage.
Windows Event Log Analysis
Level: intermediate