The Event IDs That Actually Matter for Identity Threat Detection

Most identity threat detection strategies I see are built around the wrong events. Teams collect every security event, build elaborate dashboards showing "Total Logons" and "Failed Password Attempts," and wonder why they're not finding attackers.

Here's the truth: You don't need all the events. You need the right events — the ones that actually indicate identity compromise, privilege escalation, or lateral movement. I'm going to give you the 15 event IDs that matter most for identity security, what they mean in real terms, and how to detect the attacks they reveal.

The Attack Categories

Let me structure this by attack type, not event ID. This is how attackers think — not in terms of Microsoft's event numbering scheme, but in terms of objectives. Your detection should match that.

1. Credential Harvesting Events

This category covers attackers getting your credentials — through phishing, password spraying, brute force, or credential dumping.

Event ID 4625 — Logon Failure

This is your first line of defense. Every failed logon attempt generates this event. But here's what matters:

Event ID 4776 — NTLM Authentication Attempt

NTLM is the gift that keeps on giving for attackers. It doesn't require Kerberos pre-authentication, it's susceptible to pass-the-hash attacks, and it's often the only authentication method that works when others are blocked.

You should be blocking NTLM by default and only allowing it where absolutely necessary. Event 4776 tells you when NTLM is being used.

Event ID 4670 — Security Token Request

This event shows when Kerberos service tickets are requested. Look for unusual patterns:

• Tickets to high-value services (LDAP, DRSUAPI) from non-standard sources
• Tickets requested for accounts that shouldn't need them
• Unusual service names (DRSUAPI* is a red flag)

2. Kerberoasting Events

Kerberoasting is when an attacker requests a service ticket for a service account with a servicePrincipalName (SPN) and cracks it offline. The attack doesn't require privileged access — just the ability to query AD for SPNs.

Event ID 4768 — Kerberos Ticket Granting Ticket (TGT) Request

This is the TGT request event. Look for:

• Multiple TGT requests in quick succession
• TGT requests for accounts with SPNs (these are your targets)
• TGT requests from unusual locations or times

Event ID 4769 — Kerberos Service Ticket Request

This is the actual service ticket request. When combined with 4768, it tells you the full Kerberoasting attack pattern:

1. User requests TGT (4768)
2. User requests service ticket for SPN-enabled account (4769)

Event 4769 includes the ticket encryption type. RC4_HMAC_MD5 is suspicious — AES would be normal for modern systems.

3. AS-REP Roasting Events

AS-REP roasting targets accounts with "Do not require Kerberos pre-authentication" enabled. These accounts can have their initial authentication response (AS-REP) captured and cracked offline.

Event ID 4768 — With Preauth Disabled Flag

When a user requests a TGT without pre-authentication, the event shows SpecialServices = 4 (this means no pre-auth required). This is your AS-REP roasting target.

Event ID 4624 — Successful Logon with TicketType = 0

Event ID 4624 shows successful logons. When TicketType = 0, it means no pre-authentication was required — that's your AS-REP roasting victim.

4. Lateral Movement Events

This category covers attackers moving from one system to another using stolen credentials.

Event ID 4624 — Successful Logon Type 3 (Network)

Type 3 logons are network connections — SMB, RDP, WinRM, etc. Look for:

• Logons from servers to other servers (lateral movement pattern)
• Logons to multiple systems in quick succession
• Logons to high-value targets (DCs, file servers with sensitive data)

Event ID 4672 — Special Privileges Assigned

This event shows when special privileges like SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege are assigned. These are the privileges needed for token impersonation attacks.

5. DCSync Events

DCSync is when an attacker simulates a domain controller replication to extract password hashes. This doesn't require direct DC access — just the right permissions (Replicate Directory Changes).

Event ID 4662 — Operation on an Object

This is the key event for detecting DCSync. Look for replication operations:

Event ID 5136 — Directory Service Object Change

This event shows when AD objects are modified. Look for:

• Modifications to account attributes (userAccountControl, pwdLastSet)
• Additions to privileged groups
• Modifications to Group Policy Objects

My Detection Stack

Here's my actual detection configuration from real engagements:

Final Thought

You don't need to collect every security event. You need the right events, monitored for the right patterns. Start with these 15 event IDs and build your detection around actual attack patterns, not Microsoft's internal numbering scheme.

The attackers aren't looking at Event IDs — they're thinking about what they want to achieve (credentials, access, persistence). Your detection should mirror that thinking. Identify the attack objectives first, then find the events that reveal those objectives.

Once you have these 15 events monitored correctly, you'll be surprised how many attacks you catch — and how few false positives you get. It's not about quantity; it's about relevance.