From Sus:
Question: IN Event Viewer, security section, when I spotted 13 anonymous user log in's does that indicate the specific time/date of keylogger intrusion?