Windows Event ID 4618 – Security: A Monitored Security Event Pattern Has Occurred

Start by examining the specific details of Event ID 4618 to understand what triggered the monitoring pattern detection.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4618 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4618 in the Event IDs field and click OK
5. Double-click on recent Event ID 4618 entries to examine the details
6. Review the General tab for basic information and the Details tab for XML data
7. Note the Subject section showing the account that triggered the event
8. Check the Process Information to identify which executable caused the pattern detection

PowerShell provides powerful filtering and analysis capabilities for investigating Event ID 4618 occurrences and related security events.

1. Open PowerShell as Administrator
2. Query recent Event ID 4618 entries with detailed information:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4618} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

3. Analyze events by specific time range to correlate with administrative activities:

$StartTime = (Get-Date).AddDays(-7)
$EndTime = Get-Date
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4618; StartTime=$StartTime; EndTime=$EndTime} | Group-Object {$_.TimeCreated.Date} | Select-Object Name, Count

4. Extract detailed XML data for forensic analysis:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4618} -MaxEvents 10 | ForEach-Object {
    [xml]$xml = $_.ToXml()
    $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName' -or $_.Name -eq 'ProcessName'}
}

5. Create a summary report of Event ID 4618 activity:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4618} -MaxEvents 100 | Group-Object {([xml]$_.ToXml()).Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'} | Select-Object Name, Count | Sort-Object Count -Descending

Verify the current audit policy settings to understand why Event ID 4618 is being generated and ensure proper security monitoring configuration.

1. Open Command Prompt as Administrator
2. Review current audit policy settings:

auditpol /get /category:*

3. Check specific audit subcategories that might trigger Event ID 4618:

auditpol /get /subcategory:"Audit Policy Change"

4. Review advanced audit policy configuration:

auditpol /get /subcategory:"Security System Extension"

5. Open Local Security Policy by running secpol.msc
6. Navigate to Security Settings → Advanced Audit Policy Configuration → Audit Policies
7. Expand Policy Change and review Audit Audit Policy Change settings
8. Check System category for Audit Security System Extension configuration
9. Document any recent changes to audit policies that might correlate with Event ID 4618 occurrences

Identify which processes or services are triggering Event ID 4618 to determine if the activity is legitimate or requires further investigation.

1. Use PowerShell to extract process information from Event ID 4618:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4618} -MaxEvents 20 | ForEach-Object {
    $xml = [xml]$_.ToXml()
    $processName = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'}).'#text'
    $subjectUser = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        ProcessName = $processName
        SubjectUser = $subjectUser
    }
} | Format-Table -AutoSize

2. Check running services that might be modifying audit configurations:

Get-Service | Where-Object {$_.Status -eq 'Running' -and ($_.Name -like '*audit*' -or $_.Name -like '*security*' -or $_.Name -like '*policy*')} | Select-Object Name, Status, StartType

3. Review recent process creation events around the time of Event ID 4618:

$Event4618Time = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4618} -MaxEvents 1).TimeCreated
$StartTime = $Event4618Time.AddMinutes(-5)
$EndTime = $Event4618Time.AddMinutes(5)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$StartTime; EndTime=$EndTime} | Select-Object TimeCreated, Message | Format-List

4. Check for Group Policy processing events that might correlate:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1502,1503} -MaxEvents 10 | Select-Object TimeCreated, Id, Message

5. Examine Windows Update or system maintenance activities:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=19,20,21,22} -MaxEvents 20 | Where-Object {$_.TimeCreated -gt (Get-Date).AddDays(-1)} | Select-Object TimeCreated, Id, LevelDisplayName, Message

Perform deep system analysis to identify root causes and ensure system integrity when Event ID 4618 appears unexpectedly or frequently.

1. Check audit policy registry settings:

Get-ItemProperty -Path "HKLM\SECURITY\Policy\PolAdtEv" -ErrorAction SilentlyContinue

2. Review security subsystem registry keys:

Get-ChildItem -Path "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" | Select-Object Name, Property

3. Examine audit configuration in the registry:

$AuditKeys = @(
    "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security",
    "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit"
)
foreach ($Key in $AuditKeys) {
    if (Test-Path $Key) {
        Write-Host "Registry Key: $Key"
        Get-ItemProperty -Path $Key | Format-List
        Write-Host "`n"
    }
}

4. Check for security-related scheduled tasks:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*audit*' -or $_.TaskName -like '*security*' -or $_.Description -like '*security*'} | Select-Object TaskName, State, LastRunTime, NextRunTime

5. Analyze system file integrity:

sfc /scannow

6. Run Windows Security baseline check:

Get-MpComputerStatus | Select-Object AntivirusEnabled, AMServiceEnabled, AntispywareEnabled, RealTimeProtectionEnabled

7. Create a comprehensive system report:

$Report = @{
    'Event4618Count' = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4618} -MaxEvents 1000 -ErrorAction SilentlyContinue | Measure-Object).Count
    'AuditPolicyChanges' = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4719} -MaxEvents 100 -ErrorAction SilentlyContinue | Measure-Object).Count
    'SystemStartTime' = (Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime
    'SecurityLogSize' = (Get-WinEvent -ListLog Security).FileSize
}
$Report | ConvertTo-Json