🔍 Project 6: Windows Log Analysis with Event Viewer

This project demonstrates how to inspect and analyze Windows system and security logs using the built-in Event Viewer tool. The goal is to identify login events, failed logins, suspicious activity, and simulate events for hands-on experience with blue-team forensics.

---

✅ What I Did

• Opened Event Viewer and explored key logs under "Security" and "System"
• Simulated a successful login and identified Event ID 4624
• Simulated failed logins and found Event ID 4625
• Created a fake admin user and triggered Event IDs 4720 and 4728
• Cleared logs to simulate forensic log tampering

---

📸 Key Screenshots

Step	Description	Screenshot
1	Opened Event Viewer
2	Successful login (4624)
3	Failed login attempt (4625)
4	Cleared Security logs
5	Created suspicious admin account

---

🧠 Key Takeaways

• Event Viewer provides detailed visibility into Windows activity
• Specific Event IDs help track logins, failures, and privilege escalation
• Clearing logs is itself a red flag and detectable behavior
• Blue teamers use logs to detect and respond to incidents

---

🛠️ Tools Used

• Windows 10 / 11
• Event Viewer
• PowerShell (for simulating suspicious behavior)