ATT&CK DS Event Mappings

Data Source

Component

Source

Relationship

Target

EventID

Event Name

Log Provider

Log Channel

Audit Category

Audit Sub-Category

Enable Commands

GPO Audit Policy

DNS

dns query execution

process

executed

dns query

22

DNSEvent (DNS query).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

DNSQuery

NA

<DNSQuery onmatch="exclude" />

NA

File

file context

driver

loaded

None

6

Driver loaded.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

DriverLoad

NA

<DriverLoad onmatch="exclude" />

NA

File

file creation

process

created

file

11

FileCreate.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

FileCreate

NA

<FileCreate onmatch="exclude" />

NA

File

file deletion

process

deleted

file

23

FileDelete (A file delete was detected).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

FileDelete

NA

<FileDelete onmatch="exclude" />

NA

File

file deletion

process

deleted

file

4660

An object was deleted.

Microsoft-Windows-Security-Auditing

Security

Object Access

File System

auditpol /set /subcategory:"File System" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit File System

File

file deletion

user

deleted

file

23

FileDelete (A file delete was detected).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

FileDelete

NA

<FileDelete onmatch="exclude" />

NA

File

file deletion

user

deleted

file

4660

An object was deleted.

Microsoft-Windows-Security-Auditing

Security

Object Access

File System

auditpol /set /subcategory:"File System" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit File System

File

file access

user

accessed

file

5145

A network share object was checked to see whether client can be granted desired access.

Microsoft-Windows-Security-Auditing

Security

Object Access

Detailed File Share

auditpol /set /subcategory:"Detailed File Share" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Detailed File Share

File

file access

user

accessed

file

4663

An attempt was made to access an object.

Microsoft-Windows-Security-Auditing

Security

Object Access

File System

auditpol /set /subcategory:"File System" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit File System

File

file access

process

accessed

file

4663

An attempt was made to access an object.

Microsoft-Windows-Security-Auditing

Security

Object Access

File System

auditpol /set /subcategory:"File System" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit File System

File

file access

user

requested access

file

4656

A handle to an object was requested.

Microsoft-Windows-Security-Auditing

Security

Object Access

File System

auditpol /set /subcategory:"File System" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit File System

File

file access

user

requested access

file

4661

A handle to an object was requested.

Microsoft-Windows-Security-Auditing

Security

DS Access

Directory Service Access

auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> Audit Directory Service Access

File

file access

user

requested access

file

4661

A handle to an object was requested.

Microsoft-Windows-Security-Auditing

Security

Object Access

SAM

auditpol /set /subcategory:"SAM" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit SAM

File

file access

user

requested access

file

4692

Backup of data protection master key was attempted.

Microsoft-Windows-Security-Auditing

Security

Detailed Tracking

DPAPI Activity

auditpol /set /subcategory:"DPAPI Activity" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Detailed Tracking -> Audit DPAPI Activity

File

file access

process

requested access

file

4656

A handle to an object was requested.

Microsoft-Windows-Security-Auditing

Security

Object Access

File System

auditpol /set /subcategory:"File System" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit File System

File

file access

process

requested access

file

4661

A handle to an object was requested.

Microsoft-Windows-Security-Auditing

Security

DS Access

Directory Service Access

auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> Audit Directory Service Access

File

file access

process

requested access

file

4661

A handle to an object was requested.

Microsoft-Windows-Security-Auditing

Security

Object Access

SAM

auditpol /set /subcategory:"SAM" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit SAM

File

file modification

process

modified

file

2

A process changed a file creation time.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

FileCreateTime

NA

<FileCreateTime onmatch="exclude" />

NA

File

file modification

process

modified

file

11

FileCreate.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

FileCreate

NA

<FileCreate onmatch="exclude" />

NA

File

file modification

process

modified

file

4670

Permissions on an object were changed.

Microsoft-Windows-Security-Auditing

Security

Object Access

File System

auditpol /set /subcategory:"File System" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit File System

File

file modification

user

modified

file

4670

Permissions on an object were changed.

Microsoft-Windows-Security-Auditing

Security

Object Access

File System

auditpol /set /subcategory:"File System" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit File System

File

file share creation

user

created

file share

5142

A network share object was added.

Microsoft-Windows-Security-Auditing

Security

Object Access

File Share

auditpol /set /subcategory:"File Share" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit File Share

File

file share deletion

user

deleted

file share

5144

A network share object was deleted.

Microsoft-Windows-Security-Auditing

Security

Object Access

File Share

auditpol /set /subcategory:"File Share" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit File Share

File

file share access

user

accessed

file share

5140

A network share object was accessed.

Microsoft-Windows-Security-Auditing

Security

Object Access

File Share

auditpol /set /subcategory:"File Share" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit File Share

File

file share modification

user

modified

file share

5143

A network share object was modified.

Microsoft-Windows-Security-Auditing

Security

Object Access

File Share

auditpol /set /subcategory:"File Share" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit File Share

Logon session

logon session context

logon session

modified

None

4672

Special privileges assigned to new logon.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Special Logon

auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Special Logon

Logon session

logon session creation

user

requested creation

logon session

4648

A logon was attempted using explicit credentials.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Logon

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Logon

Logon session

logon session creation

user

requested logon session creation from

ip

4648

A logon was attempted using explicit credentials.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Logon

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Logon

Logon session

logon session creation

user

requested logon session creation from

port

4648

A logon was attempted using explicit credentials.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Logon

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Logon

Logon session

logon session creation

user

created

logon session

4624

An account was successfully logged on.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Logon

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Logon

Logon session

logon session creation

user

created

logon session

4778

A session was reconnected to a Window Station.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Other Logon/Logoff Events

auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Other Logon/Logoff Events

Logon session

logon session creation

user

created

logon session

4964

Special groups have been assigned to a new logon.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Special Logon

auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Special Logon

Logon session

logon session creation

user

created logon session from

ip

4624

An account was successfully logged on.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Logon

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Logon

Logon session

logon session creation

user

created logon session from

ip

4778

A session was reconnected to a Window Station.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Other Logon/Logoff Events

auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Other Logon/Logoff Events

Logon session

logon session creation

user

created logon session from

port

4624

An account was successfully logged on.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Logon

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Logon

Logon session

logon session creation

user

failed creation

host

4625

An account failed to log on.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Logon

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Logon

Logon session

logon session creation

user

failed creation

host

4625

An account failed to log on.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Account Lockout

auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Account Lockout

Logon session

logon session creation

user

failed logon session creation from

ip

4625

An account failed to log on.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Logon

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Logon

Logon session

logon session creation

user

failed logon session creation from

ip

4625

An account failed to log on.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Account Lockout

auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Account Lockout

Logon session

logon session creation

user

failed logon session creation from

port

4625

An account failed to log on.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Logon

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Logon

Logon session

logon session creation

user

failed logon session creation from

port

4625

An account failed to log on.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Account Lockout

auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Account Lockout

Logon session

logon session termination

user

requested termination

logon session

4647

User initiated logoff.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Logoff

auditpol /set /subcategory:"Logoff" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Logoff

Logon session

logon session termination

user

terminated

logon session

4634

An account was logged off.

Microsoft-Windows-Security-Auditing

Security

Logon/Logoff

Logoff

auditpol /set /subcategory:"Logoff" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Logoff

Module

module load

process

loaded

dll

7

Image loaded.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

ImageLoad

NA

<ImageLoad onmatch="exclude" />

NA

Module

module load

process

loaded

executable

7

Image loaded.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

ImageLoad

NA

<ImageLoad onmatch="exclude" />

NA

Named pipe

named pipe creation

process

created

pipe

17

PipeEvent (Pipe Created).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

PipeEvent

NA

<PipeEvent onmatch="exclude" />

NA

Named pipe

named pipe connection

process

connected to

pipe

18

PipeEvent (Pipe Connected).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

PipeEvent

NA

<PipeEvent onmatch="exclude" />

NA

Powershell log

powershell context

application host

started

None

400

Engine state is changed from None to Available.

PowerShell

Windows PowerShell

Engine Lifecycle

NA

NA

NA

Powershell log

powershell context

application domain

started

None

53504

Windows PowerShell has started an IPC listening thread on a process in AppDomain.

Microsoft-Windows-PowerShell

Microsoft-Windows-PowerShell/Operational

PowerShell Named Pipe IPC

NA

NA

NA

Powershell log

powershell execution

user

started

application host

4103

Module logging.

Microsoft-Windows-PowerShell

Microsoft-Windows-PowerShell/Operational

Executing Pipeline

NA

NA

NA

Powershell log

powershell execution

process

executed

command

4103

Module logging.

Microsoft-Windows-PowerShell

Microsoft-Windows-PowerShell/Operational

Executing Pipeline

NA

NA

NA

Powershell log

powershell execution

process

executed

command

4104

Script Block Logging.

Microsoft-Windows-PowerShell

Microsoft-Windows-PowerShell/Operational

Execute a Remote Command

NA

NA

NA

Process

process context

process

terminated

None

5

Process terminated.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

ProcessTerminate

NA

<ProcessTerminate onmatch="exclude" />

NA

Process

process creation

user

created

process

4688

A new process has been created.

Microsoft-Windows-Security-Auditing

Security

Detailed Tracking

Process Creation

auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Detailed Tracking -> Audit Process Creation

Process

process creation

user

created

process

1

Process Creation.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

ProcessCreate

NA

<ProcessCreate onmatch="exclude" />

NA

Process

process creation

process

created

process

4688

A new process has been created.

Microsoft-Windows-Security-Auditing

Security

Detailed Tracking

Process Creation

auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Detailed Tracking -> Audit Process Creation

Process

process creation

process

created

process

1

Process Creation.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

ProcessCreate

NA

<ProcessCreate onmatch="exclude" />

NA

Process

process creation

process

created

thread

8

CreateRemoteThread.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

CreateRemoteThread

NA

<CreateRemoteThread onmatch="exclude" />

NA

Process

process termination

user

terminated

process

4689

A process has exited.

Microsoft-Windows-Security-Auditing

Security

Detailed Tracking

Process Termination

auditpol /set /subcategory:"Process Termination" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Detailed Tracking -> Audit Process Termination

Process

process access

process

accessed

process

4663

An attempt was made to access an object.

Microsoft-Windows-Security-Auditing

Security

Object Access

Kernel Object

auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Kernel Object

Process

process access

process

accessed

process

10

ProcessAccess.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

ProcessAccess

NA

<ProcessAccess onmatch="exclude" />

NA

Process

process access

process

requested access

process

4656

A handle to an object was requested.

Microsoft-Windows-Security-Auditing

Security

Object Access

Kernel Object

auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Kernel Object

Process

process network connection

process

connected to

port

5156

The Windows Filtering Platform has permitted a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

process

connected to

port

3

Network connection.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

NetworkConnect

NA

<NetworkConnect onmatch="exclude" />

NA

Process

process network connection

process

connected to

ip

5156

The Windows Filtering Platform has permitted a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

process

connected to

ip

3

Network connection.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

NetworkConnect

NA

<NetworkConnect onmatch="exclude" />

NA

Process

process network connection

process

connected to

host

3

Network connection.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

NetworkConnect

NA

<NetworkConnect onmatch="exclude" />

NA

Process

process network connection

process

connected from

port

5156

The Windows Filtering Platform has permitted a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

process

connected from

port

3

Network connection.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

NetworkConnect

NA

<NetworkConnect onmatch="exclude" />

NA

Process

process network connection

process

connected from

ip

5156

The Windows Filtering Platform has permitted a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

process

connected from

ip

3

Network connection.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

NetworkConnect

NA

<NetworkConnect onmatch="exclude" />

NA

Process

process network connection

process

connected from

host

3

Network connection.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

NetworkConnect

NA

<NetworkConnect onmatch="exclude" />

NA

Process

process network connection

user

connected to

port

3

Network connection.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

NetworkConnect

NA

<NetworkConnect onmatch="exclude" />

NA

Process

process network connection

user

connected to

ip

3

Network connection.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

NetworkConnect

NA

<NetworkConnect onmatch="exclude" />

NA

Process

process network connection

user

connected to

host

3

Network connection.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

NetworkConnect

NA

<NetworkConnect onmatch="exclude" />

NA

Process

process network connection

user

connected from

port

3

Network connection.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

NetworkConnect

NA

<NetworkConnect onmatch="exclude" />

NA

Process

process network connection

user

connected from

ip

3

Network connection.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

NetworkConnect

NA

<NetworkConnect onmatch="exclude" />

NA

Process

process network connection

user

connected from

host

3

Network connection.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

NetworkConnect

NA

<NetworkConnect onmatch="exclude" />

NA

Process

process network connection

host

blocked connection on

process

5031

The Windows Firewall Service blocked an application from accepting incoming connections on the network.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

blocked connection to

process

5157

The Windows Filtering Platform has blocked a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

blocked connection to

ip

5157

The Windows Filtering Platform has blocked a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

blocked connection to

port

5157

The Windows Filtering Platform has blocked a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

blocked connection from

process

5157

The Windows Filtering Platform has blocked a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

blocked connection from

ip

5157

The Windows Filtering Platform has blocked a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

blocked connection from

port

5157

The Windows Filtering Platform has blocked a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

process

attempted connection to

ip

5157

The Windows Filtering Platform has blocked a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

process

attempted connection to

port

5157

The Windows Filtering Platform has blocked a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

process

attempted connection from

ip

5157

The Windows Filtering Platform has blocked a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

process

attempted connection from

port

5157

The Windows Filtering Platform has blocked a connection.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

permitted listener on

process

5154

The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

permitted listener on

ip

5154

The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

permitted listener on

port

5154

The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

process

listened on

port

5154

The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

blocked listener on

process

5155

The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

blocked listener on

ip

5155

The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

blocked listener on

port

5155

The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

process

attempted to listen on

port

5155

The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

permitted local port bind on

process

5158

The Windows Filtering Platform has permitted a bind to a local port.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

permitted local port bind on

ip

5158

The Windows Filtering Platform has permitted a bind to a local port.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

permitted local port bind on

port

5158

The Windows Filtering Platform has permitted a bind to a local port.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

process

bound to

port

5158

The Windows Filtering Platform has permitted a bind to a local port.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

blocked local port bind on

process

5159

The Windows Filtering Platform has blocked a bind to a local port.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

blocked local port bind on

ip

5159

The Windows Filtering Platform has blocked a bind to a local port.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

host

blocked local port bind on

port

5159

The Windows Filtering Platform has blocked a bind to a local port.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Process

process network connection

process

attempted to bind on

port

5159

The Windows Filtering Platform has blocked a bind to a local port.

Microsoft-Windows-Security-Auditing

Security

Object Access

Filtering Platform Connection

auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Filtering Platform Connection

Schedule Task

schedule task creation

user

created

schedule task

4698

A scheduled task was created.

Microsoft-Windows-Security-Auditing

Security

Object Access

Other Object Access Events

auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Other Object Access Events

Schedule Task

schedule task deletion

user

deleted

schedule task

4699

A scheduled task was deleted.

Microsoft-Windows-Security-Auditing

Security

Object Access

Other Object Access Events

auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Other Object Access Events

Schedule Task

schedule task enable

user

enabled

schedule task

4700

A scheduled task was enabled.

Microsoft-Windows-Security-Auditing

Security

Object Access

Other Object Access Events

auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Other Object Access Events

Schedule Task

schedule task disable

user

disabled

schedule task

4701

A scheduled task was disabled.

Microsoft-Windows-Security-Auditing

Security

Object Access

Other Object Access Events

auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Other Object Access Events

Schedule Task

schedule task modification

user

modified

schedule task

4702

A scheduled task was updated.

Microsoft-Windows-Security-Auditing

Security

Object Access

Other Object Access Events

auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Other Object Access Events

Service

service context

service

started

None

4

Sysmon service state changed.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

ServiceStateChange

NA

<ServiceStateChange onmatch="exclude" />

NA

Service

service context

service

started

None

5024

The Windows Firewall Service has started successfully.

Microsoft-Windows-Security-Auditing

Security

System

Other System Events

auditpol /set /subcategory:"Other System Events" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> Audit Other System Events

Service

service context

service

stopped

None

4

Sysmon service state changed.

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

ServiceStateChange

NA

<ServiceStateChange onmatch="exclude" />

NA

Service

service context

service

stopped

None

5025

The Windows Firewall Service has been stopped.

Microsoft-Windows-Security-Auditing

Security

System

Other System Events

auditpol /set /subcategory:"Other System Events" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> Audit Other System Events

Service

service creation

user

created

service

4697

A service was installed in the system.

Microsoft-Windows-Security-Auditing

Security

System

Security System Extension

auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> Audit Security System Extension

Service

service creation

user

created

service

7045

A new service was installed in the system.

Service Control Manager

System

NA

NA

NA

NA

Service

service access

user

requested access

service

4656

A handle to an object was requested.

Microsoft-Windows-Security-Auditing

Security

Object Access

Other Object Access Events

auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Other Object Access Events

User Account

user account creation

user

created

user

4720

A user account was created.

Microsoft-Windows-Security-Auditing

Security

Account Management

User Account Management

auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> Audit User Account Management

User Account

user account deletion

user

deleted

user

4726

A user account was deleted.

Microsoft-Windows-Security-Auditing

Security

Account Management

User Account Management

auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> Audit User Account Management

User Account

user account enable

user

enabled

user

4722

A user account was enabled.

Microsoft-Windows-Security-Auditing

Security

Account Management

User Account Management

auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> Audit User Account Management

User Account

user account disable

user

disabled

user

4725

A user account was disabled.

Microsoft-Windows-Security-Auditing

Security

Account Management

User Account Management

auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> Audit User Account Management

User Account

user account lock

user

locked

user

4740

A user account was locked out.

Microsoft-Windows-Security-Auditing

Security

Account Management

User Account Management

auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> Audit User Account Management

User Account

user account unlock

user

unlocked

user

4767

A user account was unlocked.

Microsoft-Windows-Security-Auditing

Security

Account Management

User Account Management

auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> Audit User Account Management

User Account

user account modification

user

requested modification

user

4723

An attempt was made to change an account’s password.

Microsoft-Windows-Security-Auditing

Security

Account Management

User Account Management

auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> Audit User Account Management

User Account

user account modification

user

requested modification

user

4724

An attempt was made to reset an account’s password.

Microsoft-Windows-Security-Auditing

Security

Account Management

User Account Management

auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> Audit User Account Management

User Account

user account modification

user

modified

user

4738

A user account was changed.

Microsoft-Windows-Security-Auditing

Security

Account Management

User Account Management

auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> Audit User Account Management

User Account

user account modification

user

modified

user

4781

The name of an account was changed.

Microsoft-Windows-Security-Auditing

Security

Account Management

User Account Management

auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> Audit User Account Management

User Account

user account modification

user

granted access

user

4717

System security access was granted to an account.

Microsoft-Windows-Security-Auditing

Security

Policy Change

Authentication Policy Change

auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> Audit Authentication Policy Change

User Account

user account modification

user

removed access

user

4718

System security access was removed from an account.

Microsoft-Windows-Security-Auditing

Security

Policy Change

Authentication Policy Change

auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> Audit Authentication Policy Change

Windows active directory

active directory service creation

user

created

ad object

5137

A directory service object was created.

Microsoft-Windows-Security-Auditing

Security

DS Access

Directory Service Changes

auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> Audit Directory Service Changes

Windows active directory

active directory service deletion

user

deleted

ad object

5141

A directory service object was deleted.

Microsoft-Windows-Security-Auditing

Security

DS Access

Directory Service Changes

auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> Audit Directory Service Changes

Windows active directory

active directory service deletion

user

undeleted

ad object

5138

A directory service object was undeleted.

Microsoft-Windows-Security-Auditing

Security

DS Access

Directory Service Changes

auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> Audit Directory Service Changes

Windows active directory

active directory service access

process

requested access

ad object

4661

A handle to an object was requested.

Microsoft-Windows-Security-Auditing

Security

DS Access

Directory Service Access

auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> Audit Directory Service Access

Windows active directory

active directory service access

user

requested access

ad object

4661

A handle to an object was requested.

Microsoft-Windows-Security-Auditing

Security

DS Access

Directory Service Access

auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> Audit Directory Service Access

Windows active directory

active directory service access

user

accessed

ad object

4662

An operation was performed on an object.

Microsoft-Windows-Security-Auditing

Security

DS Access

Directory Service Access

auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> Audit Directory Service Access

Windows active directory

active directory service modification

user

modified

ad object

5136

A directory service object was modified.

Microsoft-Windows-Security-Auditing

Security

DS Access

Directory Service Changes

auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> Audit Directory Service Changes

Windows active directory

active directory service modification

user

modified

ad object

5139

A directory service object was moved.

Microsoft-Windows-Security-Auditing

Security

DS Access

Directory Service Changes

auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> Audit Directory Service Changes

Windows registry

windows registry key creation

process

created

windows registry key

12

RegistryEvent (Object create and delete).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

RegistryEvent

NA

<RegistryEvent onmatch="exclude" />

NA

Windows registry

windows registry key creation

process

created

windows registry key value

12

RegistryEvent (Object create and delete).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

RegistryEvent

NA

<RegistryEvent onmatch="exclude" />

NA

Windows registry

windows registry key deletion

user

deleted

windows registry key

4660

An object was deleted.

Microsoft-Windows-Security-Auditing

Security

Object Access

Registry

auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Registry

Windows registry

windows registry key deletion

process

deleted

windows registry key

12

RegistryEvent (Object create and delete).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

RegistryEvent

NA

<RegistryEvent onmatch="exclude" />

NA

Windows registry

windows registry key deletion

process

deleted

windows registry key

4660

An object was deleted.

Microsoft-Windows-Security-Auditing

Security

Object Access

Registry

auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Registry

Windows registry

windows registry key deletion

process

deleted

windows registry key value

12

RegistryEvent (Object create and delete).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

RegistryEvent

NA

<RegistryEvent onmatch="exclude" />

NA

Windows registry

windows registry key modification

process

modified

windows registry key

13

RegistryEvent (Value Set).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

RegistryEvent

NA

<RegistryEvent onmatch="exclude" />

NA

Windows registry

windows registry key modification

process

modified

windows registry key

14

RegistryEvent (Key and Value Rename).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

RegistryEvent

NA

<RegistryEvent onmatch="exclude" />

NA

Windows registry

windows registry key modification

process

modified

windows registry key

4670

Permissions on an object were changed.

Microsoft-Windows-Security-Auditing

Security

Object Access

Registry

auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Registry

Windows registry

windows registry key modification

process

modified

windows registry key value

13

RegistryEvent (Value Set).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

RegistryEvent

NA

<RegistryEvent onmatch="exclude" />

NA

Windows registry

windows registry key modification

process

modified

windows registry key value

14

RegistryEvent (Key and Value Rename).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

RegistryEvent

NA

<RegistryEvent onmatch="exclude" />

NA

Windows registry

windows registry key modification

process

modified

windows registry key value

4657

A registry value was modified.

Microsoft-Windows-Security-Auditing

Security

Object Access

Registry

auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Registry

Windows registry

windows registry key modification

user

modified

windows registry key

4670

Permissions on an object were changed.

Microsoft-Windows-Security-Auditing

Security

Object Access

Registry

auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Registry

Windows registry

windows registry key modification

user

modified

windows registry key value

4657

A registry value was modified.

Microsoft-Windows-Security-Auditing

Security

Object Access

Registry

auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Registry

Windows registry

Windows registry key access

process

accessed

windows registry key

4663

An attempt was made to access an object.

Microsoft-Windows-Security-Auditing

Security

Object Access

Registry

auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Registry

Windows registry

Windows registry key access

user

accessed

windows registry key

4663

An attempt was made to access an object.

Microsoft-Windows-Security-Auditing

Security

Object Access

Registry

auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Registry

Windows registry

Windows registry key access

process

requested access

windows registry key

4656

A handle to an object was requested.

Microsoft-Windows-Security-Auditing

Security

Object Access

Registry

auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Registry

Windows registry

Windows registry key access

user

requested access

windows registry key

4656

A handle to an object was requested.

Microsoft-Windows-Security-Auditing

Security

Object Access

Registry

auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> Audit Registry

WMI object

wmi object context

wmi subscription

created

None

5861

WMI permanent event created.

Microsoft-Windows-WMI-Activity

Microsoft-Windows-WMI-Activity/Operational

NA

NA

NA

NA

WMI object

wmi object creation

user

created

wmi filter

19

WmiEvent (WmiEventFilter activity detected).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

WmiEvent

NA

<WmiEvent onmatch="exclude" />

NA

WMI object

wmi object creation

user

created

wmi consumer

20

WmiEvent (WmiEventConsumer activity detected).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

WmiEvent

NA

<WmiEvent onmatch="exclude" />

NA

WMI object

wmi object creation

user

created

wmi subscription

21

WmiEvent (WmiEventConsumerToFilter activity detected).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

WmiEvent

NA

<WmiEvent onmatch="exclude" />

NA

WMI object

wmi object deletion

user

deleted

wmi filter

19

WmiEvent (WmiEventFilter activity detected).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

WmiEvent

NA

<WmiEvent onmatch="exclude" />

NA

WMI object

wmi object deletion

user

deleted

wmi consumer

20

WmiEvent (WmiEventConsumer activity detected).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

WmiEvent

NA

<WmiEvent onmatch="exclude" />

NA

WMI object

wmi object deletion

user

deleted

wmi subscription

21

WmiEvent (WmiEventConsumerToFilter activity detected).

Microsoft-Windows-Sysmon

Microsoft-Windows-Sysmon/Operational

WmiEvent

NA

<WmiEvent onmatch="exclude" />

NA