Common Windows PIDs

• 4624: Successful Login

• 4625: Failed Login

• 4688: Process Creation

• 4673: Sensitive Privilege Use

• 4104: Script Block Text

• 4698: Scheduled Task Creation

• 4699: Scheduled Task Deletion