Notable Event IDs to record to build up risk with. Exlcudes those already included in existing Sigma rules.
Table of Contents
| EventID | Description | Filter |
|---|---|---|
| 1002 | Application Hang | |
| 1003 | Application Error | |
| 11707 | Product: [1] – Installation operation completed successfully. | |
| 11724 | Product: [1] – Removal completed successfully. |
| EventID | Description | Filter |
|---|---|---|
| 8003 | … would have been prevented from running. |
| EventID | Description | Filter |
|---|---|---|
| EventID | Description | |
| 8006 | … would have been prevented from running. | |
| 8007 | … was prevented from running. |
| EventID | Description |
|---|---|
| 8022 | … was prevented from running. |
| EventID | Description |
|---|---|
| 8025 | … was prevented from running. |
| EventID | Description | Filter |
|---|---|---|
| 1100 | The event logging service has shut down. | |
| 4618 | A monitored security event pattern has occurred. | |
| 4664 | An attempt was made to create a hard link | |
| 4693 | Recovery of data protection master key was attempted. | |
| 4695 | Unprotection of auditable protected data was attempted. | |
| 4717 | System security access was granted to an account. | |
| 4718 | System security access was removed from an account. | |
| 4722 | A user account was enabled. | |
| 4723 | An attempt was made to change an account’s password. | |
| 4724 | An attempt was made to reset an account’s password. | |
| 4725 | A user account was disabled. | |
| 4726 | A user account was deleted. | |
| 4731 | A security-enabled local group was created. | |
| 4733 | A member was removed from a security-enabled local group. | |
| 4734 | A security-enabled local group was deleted. | |
| 4735 | A security-enabled local group was changed. | |
| 4738 | A user account was changed. | |
| 4739 | Domain Policy was changed. | |
| 4740 | A user account was locked out. | |
| 4767 | A user account was unlocked. | |
| 4782 | The password hash an account was accessed. | |
| 4798 | A user’s local group membership was enumerated. | |
| 4816 | RPC detected an integrity violation while decrypting an incoming message. | |
| 4882 | The security permissions for Certificate Services changed. | |
| 4946 | A change has been made to Windows Firewall exception list. A rule was added. | |
| 4947 | A change has been made to Windows Firewall exception list. A rule was modified. | |
| 4948 | A change has been made to Windows Firewall exception list. A rule was deleted. | |
| 4950 | A Windows Firewall setting has changed (local only) | |
| 5025 | Windows Firewall Service has been stopped | |
| 5030 | Windows Firewall Service failed to start | |
| 5031 | The Windows Firewall Service blocked an application from accepting incoming connections on the network. | |
| 5034 | The Windows Firewall Driver was stopped | |
| 5035 | Windows Firewall Driver failed to start | |
| 5037 | Windows Firewall Driver detected critical runtime error Terminating | |
| 5142 | Network share object added | |
| 5143 | Network share object changed | |
| 5144 | Network share object deleted | |
| 5376 | Credential Manager credentials were backed up | |
| 5377 | Credential Manager credentials were restored from a backup. | |
| 5378 | The requested credentials delegation was disallowed by policy. | |
| 6273 | Network Policy Server denied access to a user | |
| 6276 | Network Policy Server quarantined a user | |
| 6277 | Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy | |
| 6278 | Network Policy Server granted full access to a user because the host met the defined health policy | |
| 6279 | Network Policy Server locked the user account due to repeated failed authentication attempts | |
| 6280 | Network Policy Server unlocked the user account | |
| 6281 | Code Integrity determined that the page hashes of an image file are not valid. | Level 0 or 4 |
| 6410 | Code integrity determined that a file does not meet the security requirements to load into a process. | Level 0 or 4 |
| 6419 | A request was made to disable a device. | |
| 6420 | A device was disabled. | |
| 6421 | A request was made to enable a device. | |
| 6422 | A device was enabled. | |
| 6424 | The installation of this device was allowed after having previously been forbidden by policy. |
| EventID | Description | Filter |
|---|---|---|
| 4707 | A trust to a domain was removed. | |
| 4713 | Kerberos policy was changed. | |
| 4714 | Encrypted data recovery policy was changed | |
| 4716 | Trusted domain information was modified. | |
| 4729 | A member was removed from a security-enabled global group. | |
| 4731 | A security-enabled local group was created. | |
| 4733 | A member was removed to a security-enabled local group. | |
| 4735 | A security-enabled local group was changed. | |
| 4734 | A security-enabled local group was deleted. | |
| 4737 | A security-enabled global group was changed. | |
| 4743 | A computer account was deleted. | |
| 4744 | A security-disabled local group was created | |
| 4745 | A security-disabled local group was changed | |
| 4746 | A member was added to a security-disabled local group | |
| 4747 | A member was removed from a security-disabled local group | |
| 4748 | A security-disabled local group was deleted | |
| 4749 | A security-disabled global group was created | |
| 4750 | A security-disabled global group was changed | |
| 4751 | A member was added to a security-disabled global group | |
| 4752 | A member was removed from a security-disabled global group | |
| 4753 | A security-disabled global group was deleted | |
| 4754 | A security-enabled universal group was created. | |
| 4755 | A security-enabled universal group was changed. | |
| 4756 | A member was added to a security-enabled universal group. | |
| 4757 | A member was removed from a security-enabled universal group. | |
| 4758 | A security-enabled universal group was deleted. | |
| 4759 | A security-disabled universal group was created | |
| 4760 | A security-disabled universal group was changed | |
| 4761 | A member was added to a security-disabled universal group | |
| 4762 | A member was removed from a security-disabled universal group | |
| 4763 | A security-disabled universal group was deleted | |
| 4764 | A group’s type was changed. | |
| 4766 | An attempt to add SID History to an account failed. | |
| 4767 | A user account was unlocked. | |
| 4865 | A trusted forest information entry was added. | |
| 4866 | A trusted forest information entry was removed. | |
| 4867 | A trusted forest information entry was added. | |
| 5137 | A directory service object was created. | |
| 5138 | A directory service object was undeleted | |
| 5139 | A directory service object was moved. | |
| 5141 | A directory service object was deleted |
| EventID | Description | Filter |
|---|---|---|
| 41 | The system has rebooted without cleanly shutting down first | |
| 219 | Failed Kernel Driver Loading | Level 3 |
| 7022 | Service hung on starting | Level 0, 1, 2, 3, or 4 |
| 7024 | Service terminated with the following service-specific error | Level 0, 1, 2, 3, or 4 |
| 7026 | The boot-start or system-start driver(s) [did not/failed to] load | Level 0, 1, 2, 3, or 4 |
| 7030 | Service Creation Errors | |
| 7031 | Service terminated unexpectedly | Level 0, 1, 2, 3, or 4 |
| 7032 | Service tried to take a corrective action (1) after the unexpected termination of the % service | Level 0, 1, 2, 3, or 4 |
| 7035 | The [Service Name] service was successfully sent a [start/stop] control | |
| 7040 | The service state has changed | Level 0, 1, 2, 3, or 4 |
| EventID | Description |
|---|---|
| 105 | Kerberos authentication from a particular device was not permitted. |
| 106 | The user or device was not allowed to authenticate to the server. |
| 305 | Kerberos TGT request did not meet access control restrictions. |
| 306 | User, device or both do not meet the access control restrictions. |
| EventID | Description |
|---|---|
| 100 | An NTLM sign-in failure occurs for an account that is in the Protected Users security group. |
| 102 | An account tried to authenticate using DES or RC4. Protected Users are restricted to AES encryption. |
| 104 | The security package on the client does not contain the credentials. |
| 303 | A Kerberos ticket-granting-ticket (TGT) was successfully issued for a member of the Protected User group. |
| EventID | Description | Filter |
|---|---|---|
| 3002 | Code Integrity is unable to verify the image integrity of the file %2 because the set of per-page image hashes could not be found on the system. | Level 2 or 3 |
| 3003 | Code Integrity is unable to verify the image integrity of the file %2 because the set of per-page image hashes could not be found on the system. The image is allowed to load because kernel mode debugger is attached. | Level 2 or 3 |
| 3004 | Windows is unable to verify the image integrity of the file %2 because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. | Level 2 or 3 |
| 3010 | Code Integrity was unable to load the %2 catalog. | Level 2 or 3 |
| EventID | Description | Filter |
|---|---|---|
| 1085 | Windows failed to apply the … settings | Level 2 |
| 1125 | The processing of Group Policy failed because of an internal system error. | Level 2 |
| 1127 | The processing of Group Policy failed due to an internal error. | Level 2 |
| 1129 | The processing of Group Policy failed because of lack of network connectivity to a domain controller. | Level 2 |
| EventID | Description | Filter |
|---|---|---|
| 8003 | NTLM server blocked in the domain audit: Audit NTLM authentication in this domain. |
| EventID | Description |
|---|---|
| 32850 | Creating a server remote session |
| EventID | Description |
|---|---|
| 131 | Accepted new TCP connection |
| 140 | Connection failed; bad username or password |
| EventID | Description |
|---|---|
| * | This event log contains log about the “Exploit Protection” feature. |
| EventID | Description |
|---|---|
| 2 | A process changed a file creation time |
| EventID | Description |
|---|---|
| 140 | Task Updated |
| EventID | Description |
|---|---|
| 1024 | RDP connection attempt |
| 1025 | RDP connection made |
| 1102 | multi-transport connection attempt |
| 1103 | multi-transport connection made |
| EventID | Description | Filter |
|---|---|---|
| 1002 | An antimalware scan was stopped before it finished. | Level 2 |
| 1003 | malware scan paused | |
| 1005 | An antimalware scan failed. | |
| 1007 | The antimalware platform performed an action to protect your system from malware or other potentially unwanted software. | |
| 1008 | The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed. | |
| 1012 | unable to delete item in quarantine | |
| 1014 | The antimalware platform could not delete history of malware and other potentially unwanted software. | |
| 1015 | The antimalware platform detected suspicious behavior. | |
| 1117 | The antimalware platform performed an action to protect your system from malware or other potentially unwanted software. | |
| 1118 | The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed. | |
| 1119 | The antimalware platform encountered a critical error when trying to take action on malware or other potentially unwanted software. There are more details in the event message. | |
| 2001 | The antimalware definition update failed. | |
| 2003 | The antimalware engine update failed. | |
| 2006 | The platform update failed. | |
| 2042 | The antimalware engine no longer supports this operating system, and is no longer protecting your system from malware. | |
| 5008 | The antimalware engine encountered an error and failed. |
| EventID | Description |
|---|---|
| 5600 | Indicates change in the proxy configuration. For example if i change my proxy configuration from the “Internet Option” menu. The event will get generated. |
| EventID | Description |
|---|---|
| 5860 | Registration of Temporary Event Consumer |