Windows Event Logging & WEF

Windows environments are the primary target for attackers — and by default, Windows does not log the granular details needed for modern threat hunting.

Collection architecture (WEF). Avoid deploying expensive, heavy SIEM agents on every single Windows workstation. Implement native Windows Event Forwarding using source-initiated subscriptions: endpoints pull configuration from a central Windows Event Collector (WEC) server via GPO and securely push logs over WinRM (HTTPS/TCP 5986).

Critical event IDs to enable via Advanced Audit Policy (GPO):

• 4624 (successful logon) & 4625 (failed logon) — tuning tip: filter out noisy logon types (like Type 5 service logons) and focus on Type 2 (interactive), Type 3 (network), and Type 10 (RDP).
• 4688 (process creation) — critical — you must enable "Include command line in process creation events" in GPO. Otherwise you only know powershell.exe ran — not that it ran powershell.exe -nop -enc <Base64_Payload>.
• 4104 (PowerShell script block logging) — captures de-obfuscated PowerShell commands executed in memory, bypassing traditional antivirus.

Augment with Sysmon. Deploy Microsoft Sysmon for deep visibility: Event ID 1 (process creation with SHA256 hashes), Event ID 3 (network connections tied to processes), and Event ID 8 (CreateRemoteThread, for process injection).