My first Windows Security Investigation: What Event Logs revealed about my System

A beginner-friendly walkthrough of exploring Windows Event Viewer, PowerShell, and built-in security tools as part of my cybersecurity journey.

INTRODUCTION

When most people use Windows, they open applications, browse the web, or check their email. Behind the scenes, however, Windows is quietly recording almost everything that happens, from user logins and service activity to security events and system changes.

As I continue my journey into cybersecurity, I wanted to understand what information Windows records and how security analysts use it during investigations.

This lab wasn’t about finding malware or responding to a real incident. It was about learning where evidence lives and how to begin asking the right questions.

WHY THIS MATTERS

Imagine someone tells you they logged into a computer yesterday.

How would you verify it?

Or suppose an employee claims they never attempted to log in after hours.

Can Windows confirm or disprove that?

The answer is yes.

Windows continuously records authentication events, service activity, process execution, and many other system events. These logs become invaluable when investigating suspicious behavior or responding to security incidents.

Before this exercise, Event Viewer was just another application I had never opened.

Now I see it as one of the most valuable sources of evidence on a Windows machine.

SETTING UP THE LAB

For this investigation, I used:

• Host Machine: Apple MacBook M1
• Virtualization: UTM
• Operating System: Windows 11 ARM
• Invextigation Tools: Event Viewer, PowerShell, Task Manager, Services, Windows Defender

Rather than relying on third-party tools, I focused entirely on built-in Windows utilities, the same tools that many administrators and analysts use every day.

FOLLOWING THE EVIDENCE

I started by opening Event Viewer and navigating to the Security log.

Immediately, I was looking at hundreds of recorded events.

At first, the list felt overwhelming.

Then I learned something important.

Every event has an Event ID, and each ID represents a specific type of activity.

Instead of reading everything, investigators search for the events that matter.

One of the first IDs I explored was 4624, which represents a successful user logon.

Seeing my own login recorded in the log made everything feel much more real.

I wasn’t reading documentation anymore.

I was looking at evidence generated by my own activity.

4624 filter

POWERSHELL BECAME MY BESTFRIEND

Instead of navigating through multiple Windows menus, I began using PowerShell to gather information.

A few simple commands revealed:

• Running processes
• Active services
• Security events

What surprised me most wasn’t how complicated the commands were.

It was how much information Windows could provide with just a few lines of text.

For someone interested in Security Operations, learning PowerShell feels less like learning another command line and more like learning how to ask Windows better questions.

Get processes

Get Services

LOOKING FOR SIGNS OF TROUBLE

Part of the investigation involved checking for failed logon attempts and unexpected account activity.

Fortunately, I didn’t discover anything suspicious.

That might sound boring, but it’s actually valuable.

One lesson I’m beginning to appreciate is that good security investigations don’t always end with discovering an attack.

Sometimes the goal is confirming that everything is operating normally.

Understanding what “normal” looks like is essential because it’s the baseline against which suspicious behavior stands out.

MY BIGGEST TAKEAWAYS

This lab changed the way I think about Windows.

Before, I saw it as an operating system.

Now, I see it as a system constantly documenting its own activity.

Every login leaves evidence.

Every service has a purpose.

Every process tells part of the story.

As a future SOC Analyst, learning how to read that story is just as important as learning how to detect an attack.

WHAT’S NEXT?

This investigation is only the beginning.

Next, I plan to:

• Explore additional Windows Event IDs.
• Install Sysmon to collect richer endpoint telemetry.
• Forward Windows logs into a SIEM.
• Practice investigating simulated security incidents.

Every lab brings me one step closer to understanding how defenders investigate real-world attacks.

READ THE TECHNICAL WALKTHROUGH

If you’d like to see the full investigation, including commands, screenshots, and technical findings, you can view the complete documentation on GitHub.

GitHub Repository: Windows Investigation