DFIRHub

Windows event log ยท Security4608 Windows is starting up

This event is logged when LSASS.EXE process starts and the auditing subsystem is initialized. It typically generates during operating system startup process.

  • Security
  • 1 field
  • Security.evtx
  • Microsoft-Windows-Security-Auditing

Notes

  • This event is logged when LSASS.EXE process starts and the auditing subsystem is initialized. It typically generates during operating system startup process.
  • Example Et Data:

Fields EvtxECmd extracts

1 column in the EvtxECmd CSV

  • PayloadData1%EventData%
    • %EventData% = /Event/EventData

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="54867925-5478-4994-a5ba-3e3b0328c30d"/>
    <EventID>4608</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12679</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020009000000000</Keywords>
    <TimeCreated SystemTime="2020-10-09 18:09:40.2437686"/>
    <EventRecordID>266790034</EventRecordID>
    <Correlation/>
    <Execution ProcessID="679" ThreadID="123"/>
    <Channel>Security</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security/>
  </System>
  <EventData></EventData>
</Event>

References

3 links

Source: evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4608.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)