Windows Security event log

Also written: event 4624, event 4625, event 4688, event 4732, Security event 4688, process creation event

Windows' numbered log of security events: 4624 is a successful logon, 4625 a failed logon, 4688 a new process with its command line (where hidden encoded PowerShell shows up), and 4732 a user added to a privileged group.

Where the book teaches it

Chapter 3: Malware II: hidden and silent malware
Chapter 10: Reading the evidence