Incident Detection and Triage · Topic 3 of 6
Incident Detection with SIEM
Learn how a SIEM detects incidents with rule, anomaly and threat intel correlation, and the Windows event IDs behind common detection rules for CSA 312-39.
- 5 min
- 4624 success, 4625 failure, 4688 process, 4720 account created, 4728/4732 added to group, 1102 log cleared.
- Logon type 2 interactive, 3 network, 10 Remote Desktop.
- Rule based detection finds known patterns; anomaly and behavioral detection find the unknown but need tuning.
What it is
Incident detection with a SIEM means turning collected events into alerts that point to real attacks. The SIEM does this with correlation: rules and analytics that look at many events together and decide when a pattern is suspicious.
An analyst needs to know the main correlation methods and recognize the events behind the most common detections.
How it works
Correlation methods
| Method | How it detects | Example |
|---|---|---|
| Rule based | Matches a defined condition or sequence | Five failed logons then a success for one account in 10 minutes |
| Statistical or anomaly based | Compares activity to a baseline and flags deviation | A user downloads 50 times their normal daily volume |
| Threat intelligence based | Matches events against known bad indicators | A DNS query for a domain on a malicious feed |
| Vulnerability or asset based | Weighs an event by what it targets | An exploit attempt against a server known to be unpatched is raised to high |
| Time based (sequence) | Requires events in a set order within a window | Account created, added to an admin group, then used to log on remotely |
| Behavioral (UEBA) | Profiles users and entities and flags unusual behavior | A finance user logs on at 03:00 from a new country |
Rule based detection is precise for known patterns but misses new ones. Anomaly and behavioral detection can find new attacks but produce more false positives until tuned.
Windows events behind common rules
| Event ID | Meaning | Typical use in a rule |
|---|---|---|
| 4624 | Successful logon | Success after many failures; logon from an unusual host |
| 4625 | Failed logon | Brute force and password spraying |
| 4648 | Logon with explicit credentials | Possible lateral movement with stolen credentials |
| 4672 | Special privileges assigned to new logon | Administrator logon to sensitive systems |
| 4688 | New process created | Suspicious processes such as encoded PowerShell |
| 4698 | Scheduled task created | Persistence |
| 4720 | User account created | Unexpected new accounts |
| 4728 / 4732 | Member added to a security enabled global / local group | Privilege escalation |
| 4740 | Account locked out | Brute force side effect |
| 1102 | Security audit log cleared | Covering tracks; nearly always high priority |
| 7045 | New service installed (System log) | Persistence or remote execution tools |
Logon type in 4624 and 4625 adds meaning: type 2 is interactive at the console, type 3 is network (for example a file share), type 10 is RemoteInteractive (Remote Desktop).
Common detection patterns
- Brute force: many 4625 events for one account from one source.
- Password spraying: a few failed logons for many accounts from one source, staying under the lockout limit.
- Privilege escalation: 4720 followed by 4728 or 4732 for the new account.
- Port scanning: one source contacting many ports or hosts in a short time, often with many firewall denies.
- Malware beaconing: regular outbound connections at fixed intervals to the same destination.
- Data exfiltration: unusually large outbound transfers, or transfers to new destinations outside business hours.
- Web attacks: many HTTP 404 responses from one client (scanning), or requests containing SQL keywords or script tags.
- Log tampering: event 1102, or a source that suddenly stops sending logs.
A rule as a concept
A correlation rule usually has a condition, a grouping field, a threshold, a time window and an action. Described in words: "If more than 10 events with ID 4625 occur for the same target account from the same source address within 5 minutes, followed by a 4624 for that account from that address, raise a high severity alert."
A worked example
The SIEM raises an alert at 02:14: event 4720 created the account "svc_backup2" on a domain controller, and four minutes later event 4728 added it to Domain Admins. Two minutes after that, a 4624 logon type 10 used the account from a workstation.
The sequence rule matched three steps that are each harmless alone. Together they suggest an attacker creating a privileged backdoor account, so the alert goes straight to Tier II.
How the exam asks about this
- "Which Windows event ID shows that the Security log was cleared?" → 1102.
- "A SIEM sees a few failed logons against hundreds of accounts from one address. Which attack is this?" → Password spraying.
- "Which correlation method flags a user whose activity departs from their normal baseline?" → Anomaly based or behavioral (UEBA) correlation.
What to remember for the exam
- 4624 success, 4625 failure, 4688 process, 4720 account created, 4728/4732 added to group, 1102 log cleared.
- Logon type 2 interactive, 3 network, 10 Remote Desktop.
- Rule based detection finds known patterns; anomaly and behavioral detection find the unknown but need tuning.
- Brute force targets one account many times; spraying tries one or two passwords on many accounts.
- Regular, fixed interval outbound connections suggest beaconing to command and control.
A single event rarely proves an incident. Correlation across time, sources and context is what separates an attack from normal administration.
Common mistakes
Mixing up brute force and spraying. Spraying is designed to avoid lockouts, so it shows few failures per account but many accounts.
Ignoring logon type. A 4624 type 3 to a file server is routine. A 4624 type 10 to a domain controller from a user workstation deserves a closer look.
Forgetting silence as a signal. A critical source that stops sending logs may mean an attacker disabled logging. Treat missing data as an alert.
Check yourself
Which event sequence suggests an attacker created a privileged account?
Event 4720 for a new account followed by 4728 or 4732 adding it to an administrative group.
What does logon type 10 indicate?
A RemoteInteractive logon, which is a Remote Desktop session.
Why does a SIEM use time windows in correlation rules?
The window links related events that happen close together, so a sequence such as many failures then a success is seen as one pattern.
Topic 3 of 6 in Incident Detection and Triage
Test yourself on Incident Detection and Triage
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.