{ "version": "2.1.0", "updated": "2026-10-21", "description": "WinSecHunter event catalog: Windows event IDs relevant to IP-based incident investigation, with MITRE ATT&CK mapping, categories, importance and the data fields that carry IP addresses.", "logs": { "Security": "Security", "System": "System", "RCM": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational", "LSM": "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational", "FWL": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall", "Sysmon": "Microsoft-Windows-Sysmon/Operational" }, "logAliases": { "RDP": ["Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational", "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"], "TerminalServices": ["Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational", "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"], "Firewall": ["Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"], "WFP": ["Security"], "Sysmon": ["Microsoft-Windows-Sysmon/Operational"] }, "profiles": { "IncidentResponse": { "description": "DEFAULT. Balanced IP-incident sweep: authentication, Kerberos, remote access, account lifecycle, credential access, persistence and anti-forensics. Excludes high-noise object/firewall/connection logs.", "categories": ["Authentication", "Kerberos", "RemoteAccess", "AccountLockout", "AccountManagement", "LogonLogoff", "SpecialPrivilege", "LateralMovement", "CredentialAccess", "DefenseEvasion", "Persistence", "ServiceActivity", "ScheduledTask", "SystemIntegrity", "PolicyChange", "ShareAccess"] }, "FailedAuth": { "description": "Only failed authentication events (classic brute-force sweep, superset of the legacy script behavior).", "eventIds": [4625, 4771, 4776, 4770, 4649, 5168, 5632, 5633, 1148] }, "BruteForce": { "description": "Failures + successes + lockouts needed for brute-force/spray correlation and success-after-failure detection.", "eventIds": [4624, 4625, 4768, 4769, 4770, 4771, 4776, 4740, 4767, 4648, 5632, 5633, 1148, 1149, 21, 25] }, "Rdp": { "description": "RDP/remote interactive access chain: RCM + LSM operational logs plus Security logon events.", "eventIds": [4624, 4625, 4778, 4779, 4800, 4801, 4802, 4803, 1147, 1148, 1149, 21, 22, 23, 24, 25] }, "Lateral": { "description": "Lateral movement indicators: network logons, explicit-credential logons, share access, remote service/task installation.", "eventIds": [4624, 4648, 4778, 4779, 5140, 5142, 5143, 5144, 5145, 4697, 4698, 7045, 3, 8], "categories": ["LateralMovement"] }, "AccountManagement": { "description": "User/group lifecycle and lockouts — attacker post-exploitation actions.", "eventIds": [4720, 4722, 4723, 4724, 4725, 4726, 4728, 4729, 4732, 4733, 4735, 4737, 4738, 4740, 4741, 4742, 4743, 4754, 4756, 4764, 4765, 4766, 4767, 4794] }, "Kerberos": { "description": "Kerberos authentication chain (AS/TGS/pre-auth failures, replay, SPN issues).", "eventIds": [4649, 4768, 4769, 4770, 4771, 5168] }, "Firewall": { "description": "Windows Firewall/WFP: rule lifecycle, service health and connection permit/block (5152-level noise excluded by default).", "eventIds": [2004, 2005, 2006, 4946, 4947, 4948, 4950, 4951, 4952, 4953, 4954, 4956, 4957, 4958, 5024, 5025, 5027, 5028, 5029, 5030, 5031, 5032, 5033, 5034, 5035, 5037, 5154, 5155, 5156, 5157, 5158, 5159] }, "DefenseEvasion": { "description": "Anti-forensics and security-control tampering: log clearing, audit policy changes, firewall/service shutdown, Sysmon config changes.", "eventIds": [104, 1100, 1102, 1104, 1108, 4699, 4710, 4715, 4719, 4817, 4907, 5025, 5027, 5028, 5029, 5030, 5034, 5035, 5037, 5038, 5712, 16, 23], "categories": ["DefenseEvasion"] }, "Persistence": { "description": "Persistence installation: services, scheduled tasks, autostart artifacts.", "categories": ["Persistence", "ServiceActivity", "ScheduledTask"] }, "Sysmon": { "description": "Sysmon coverage for IP hunting: network connections (EID 3), process creation, remote threads, credential access, config changes.", "eventIds": [1, 3, 8, 9, 10, 11, 13, 15, 16, 22, 23, 25] }, "ObjectAccess": { "description": "File/share/registry/DS object access (high noise — enable when you have object SACLs).", "categories": ["ObjectAccess", "ShareAccess", "DirectoryAccess"] }, "Critical": { "description": "Only events the catalog marks Critical.", "importance": "Critical" }, "All": { "description": "Every cataloged event across all supported logs.", "categories": ["Authentication", "Kerberos", "RemoteAccess", "LogonLogoff", "AccountLockout", "AccountManagement", "SpecialPrivilege", "LateralMovement", "ShareAccess", "ObjectAccess", "DirectoryAccess", "Firewall", "PolicyChange", "DefenseEvasion", "Persistence", "ServiceActivity", "ScheduledTask", "ProcessExecution", "NetworkActivity", "CredentialAccess", "SystemIntegrity"] } }, "events": [ {"Id": 4608, "Log": "Security", "Name": "Windows is starting up", "Category": "SystemIntegrity", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 4609, "Log": "Security", "Name": "Windows is shutting down", "Category": "SystemIntegrity", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4611, "Log": "Security", "Name": "A trusted logon process has been registered with the LSA", "Category": "LogonLogoff", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4612, "Log": "Security", "Name": "Internal resources allocated for the queuing of audit messages have been exhausted (events dropped)", "Category": "SystemIntegrity", "Importance": "High", "Attack": ["T1562.002"], "IpFields": []}, {"Id": 4616, "Log": "Security", "Name": "The system time was changed", "Category": "SystemIntegrity", "Importance": "High", "Attack": ["T1070.006"], "IpFields": [], "Notes": "Time changes break timeline correlation — flag in reports."}, {"Id": 4624, "Log": "Security", "Name": "An account was successfully logged on", "Category": "Authentication", "Importance": "Critical", "Attack": ["T1078", "T1078.002", "T1078.003", "T1021"], "IpFields": ["IpAddress"], "Notes": "Check LogonType: 2/10 interactive, 3 network (SMB), 9 runas /netonly. Success after failures = compromise indicator."}, {"Id": 4625, "Log": "Security", "Name": "An account failed to log on", "Category": "Authentication", "Importance": "Critical", "Attack": ["T1110.001", "T1110.003", "T1078"], "IpFields": ["IpAddress"], "Notes": "Primary brute-force indicator. Decode SubStatus: 0xC000006A bad password, 0xC0000064 unknown user, 0xC0000234 locked out."}, {"Id": 4634, "Log": "Security", "Name": "An account was logged off", "Category": "LogonLogoff", "Importance": "Low", "Attack": [], "IpFields": [], "Notes": "Closes sessions started by 4624 (same LogonId)."}, {"Id": 4647, "Log": "Security", "Name": "User initiated logoff", "Category": "LogonLogoff", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4648, "Log": "Security", "Name": "A logon was attempted using explicit credentials", "Category": "LateralMovement", "Importance": "High", "Attack": ["T1078", "T1550.002"], "IpFields": ["IpAddress"], "Notes": "runas /creds, RDP delegation. AuthPackage NTLM here can indicate pass-the-hash. TargetServerName shows the pivot destination."}, {"Id": 4649, "Log": "Security", "Name": "A replay attack was detected", "Category": "Kerberos", "Importance": "High", "Attack": ["T1558"], "IpFields": []}, {"Id": 4656, "Log": "Security", "Name": "A handle to an object was requested", "Category": "ObjectAccess", "Importance": "Low", "Attack": ["T1005"], "IpFields": [], "Notes": "Requires object SACLs. ObjectName may embed a UNC path with the attacker IP."}, {"Id": 4662, "Log": "Security", "Name": "An operation was performed on an object (directory service)", "Category": "DirectoryAccess", "Importance": "Low", "Attack": ["T1003.003"], "IpFields": []}, {"Id": 4663, "Log": "Security", "Name": "An attempt was made to access an object", "Category": "ObjectAccess", "Importance": "Medium", "Attack": ["T1005"], "IpFields": []}, {"Id": 4672, "Log": "Security", "Name": "Special privileges assigned to new logon", "Category": "SpecialPrivilege", "Importance": "Medium", "Attack": ["T1078.002"], "IpFields": [], "Notes": "Administrative logon marker — pair with 4624 by LogonId."}, {"Id": 4673, "Log": "Security", "Name": "A privileged service was called", "Category": "SpecialPrivilege", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4674, "Log": "Security", "Name": "An operation was attempted on a privileged object", "Category": "SpecialPrivilege", "Importance": "Medium", "Attack": ["T1078.002"], "IpFields": []}, {"Id": 4688, "Log": "Security", "Name": "A new process has been created", "Category": "ProcessExecution", "Importance": "High", "Attack": ["T1059", "T1204"], "IpFields": [], "Notes": "Needs 'Audit Process Creation' + command-line auditing. CommandLine may contain attacker IPs (net use, PsExec, WinRM)."}, {"Id": 4697, "Log": "Security", "Name": "A service was installed in the system", "Category": "Persistence", "Importance": "High", "Attack": ["T1543.003"], "IpFields": [], "Notes": "Service binary path may point at \\\\attacker-ip\\share."}, {"Id": 4698, "Log": "Security", "Name": "A scheduled task was created", "Category": "Persistence", "Importance": "High", "Attack": ["T1053.005"], "IpFields": [], "Notes": "TaskContent XML often embeds remote paths/IPs."}, {"Id": 4699, "Log": "Security", "Name": "A scheduled task was deleted", "Category": "DefenseEvasion", "Importance": "Medium", "Attack": ["T1053.005"], "IpFields": []}, {"Id": 4700, "Log": "Security", "Name": "A scheduled task was enabled", "Category": "ScheduledTask", "Importance": "Medium", "Attack": ["T1053.005"], "IpFields": []}, {"Id": 4701, "Log": "Security", "Name": "A scheduled task was disabled", "Category": "ScheduledTask", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 4702, "Log": "Security", "Name": "A scheduled task was updated", "Category": "ScheduledTask", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4704, "Log": "Security", "Name": "A user right was assigned", "Category": "PolicyChange", "Importance": "Medium", "Attack": ["T1098"], "IpFields": []}, {"Id": 4705, "Log": "Security", "Name": "A user right was removed", "Category": "PolicyChange", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 4710, "Log": "Security", "Name": "The Windows Event Log service was shut down", "Category": "DefenseEvasion", "Importance": "High", "Attack": ["T1562.002"], "IpFields": []}, {"Id": 4713, "Log": "Security", "Name": "Kerberos policy was changed", "Category": "PolicyChange", "Importance": "Medium", "Attack": ["T1558"], "IpFields": []}, {"Id": 4715, "Log": "Security", "Name": "The audit policy (SACL) on an object was changed", "Category": "DefenseEvasion", "Importance": "High", "Attack": ["T1562.002"], "IpFields": []}, {"Id": 4719, "Log": "Security", "Name": "System audit policy was changed", "Category": "DefenseEvasion", "Importance": "Critical", "Attack": ["T1562.002"], "IpFields": [], "Notes": "Attacker disabling auditing mid-incident — always investigate."}, {"Id": 4720, "Log": "Security", "Name": "A user account was created", "Category": "AccountManagement", "Importance": "Critical", "Attack": ["T1136", "T1136.001", "T1136.002"], "IpFields": []}, {"Id": 4722, "Log": "Security", "Name": "A user account was enabled", "Category": "AccountManagement", "Importance": "Medium", "Attack": ["T1098"], "IpFields": []}, {"Id": 4723, "Log": "Security", "Name": "An attempt was made to change an account's password", "Category": "AccountManagement", "Importance": "Medium", "Attack": ["T1098"], "IpFields": []}, {"Id": 4724, "Log": "Security", "Name": "An attempt was made to reset an account's password", "Category": "AccountManagement", "Importance": "High", "Attack": ["T1098"], "IpFields": []}, {"Id": 4725, "Log": "Security", "Name": "A user account was disabled", "Category": "AccountManagement", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 4726, "Log": "Security", "Name": "A user account was deleted", "Category": "AccountManagement", "Importance": "High", "Attack": ["T1531"], "IpFields": []}, {"Id": 4728, "Log": "Security", "Name": "A member was added to a security-enabled global group", "Category": "AccountManagement", "Importance": "High", "Attack": ["T1098", "T1078.002"], "IpFields": []}, {"Id": 4729, "Log": "Security", "Name": "A member was removed from a security-enabled global group", "Category": "AccountManagement", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4732, "Log": "Security", "Name": "A member was added to a security-enabled local group", "Category": "AccountManagement", "Importance": "High", "Attack": ["T1098", "T1078.003"], "IpFields": [], "Notes": "Watch for additions to local Administrators / Remote Desktop Users."}, {"Id": 4733, "Log": "Security", "Name": "A member was removed from a security-enabled local group", "Category": "AccountManagement", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4735, "Log": "Security", "Name": "A security-enabled local group was changed", "Category": "AccountManagement", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4737, "Log": "Security", "Name": "A security-enabled global group was changed", "Category": "AccountManagement", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4738, "Log": "Security", "Name": "A user account was changed", "Category": "AccountManagement", "Importance": "High", "Attack": ["T1098"], "IpFields": [], "Notes": "PasswordNotRequired/UfTrustedForDelegation flag changes are attacker tradecraft."}, {"Id": 4739, "Log": "Security", "Name": "Domain policy was changed", "Category": "PolicyChange", "Importance": "Medium", "Attack": ["T1484.001"], "IpFields": []}, {"Id": 4740, "Log": "Security", "Name": "A user account was locked out", "Category": "AccountLockout", "Importance": "High", "Attack": ["T1110"], "IpFields": [], "Notes": "SubjectComputerName shows WHERE the lockout was triggered — pivot there."}, {"Id": 4741, "Log": "Security", "Name": "A computer account was created", "Category": "AccountManagement", "Importance": "Low", "Attack": ["T1136.002"], "IpFields": []}, {"Id": 4742, "Log": "Security", "Name": "A computer account was changed", "Category": "AccountManagement", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4743, "Log": "Security", "Name": "A computer account was deleted", "Category": "AccountManagement", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 4754, "Log": "Security", "Name": "A security-enabled universal group was created", "Category": "AccountManagement", "Importance": "Medium", "Attack": ["T1098"], "IpFields": []}, {"Id": 4756, "Log": "Security", "Name": "A member was added to a security-enabled universal group", "Category": "AccountManagement", "Importance": "High", "Attack": ["T1098"], "IpFields": []}, {"Id": 4764, "Log": "Security", "Name": "A group's type was changed", "Category": "AccountManagement", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4765, "Log": "Security", "Name": "SID history was added to an account", "Category": "AccountManagement", "Importance": "Low", "Attack": ["T1134.005"], "IpFields": []}, {"Id": 4766, "Log": "Security", "Name": "An attempt to add SID history to an account failed", "Category": "AccountManagement", "Importance": "Medium", "Attack": ["T1134.005"], "IpFields": []}, {"Id": 4767, "Log": "Security", "Name": "A user account was unlocked", "Category": "AccountLockout", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 4768, "Log": "Security", "Name": "A Kerberos authentication service (TGT) request was made", "Category": "Kerberos", "Importance": "Critical", "Attack": ["T1558"], "IpFields": ["IpAddress"], "Notes": "DC only. TicketEncryptionType 0x17 (RC4) on modern networks = downgrade indicator."}, {"Id": 4769, "Log": "Security", "Name": "A Kerberos service ticket was requested", "Category": "Kerberos", "Importance": "High", "Attack": ["T1558.003"], "IpFields": ["IpAddress"], "Notes": "RC4 encryption (0x17) for service tickets may indicate kerberoasting."}, {"Id": 4770, "Log": "Security", "Name": "A Kerberos service ticket was renewed", "Category": "Kerberos", "Importance": "Medium", "Attack": ["T1558"], "IpFields": ["IpAddress"]}, {"Id": 4771, "Log": "Security", "Name": "Kerberos pre-authentication failed", "Category": "Kerberos", "Importance": "Critical", "Attack": ["T1110", "T1558"], "IpFields": ["IpAddress"], "Notes": "Kerberos-level brute force. FailureCode 0x18 = wrong password, 0x17 = password expired, 0x12 = client revoked (disabled/locked)."}, {"Id": 4776, "Log": "Security", "Name": "The computer attempted to validate the credentials for an account (NTLM)", "Category": "Authentication", "Importance": "Critical", "Attack": ["T1110", "T1078"], "IpFields": [], "Notes": "No IP field — Workstation holds the client NAME. NTSTATUS in 'Error Code'."}, {"Id": 4778, "Log": "Security", "Name": "A session was reconnected to a Window Station", "Category": "RemoteAccess", "Importance": "High", "Attack": ["T1021.001"], "IpFields": ["IpAddress"]}, {"Id": 4779, "Log": "Security", "Name": "A session was disconnected from a Window Station", "Category": "RemoteAccess", "Importance": "Medium", "Attack": ["T1021.001"], "IpFields": ["IpAddress"]}, {"Id": 4794, "Log": "Security", "Name": "An attempt was made to set the Directory Services Restore Mode administrator password", "Category": "AccountManagement", "Importance": "High", "Attack": ["T1098"], "IpFields": []}, {"Id": 4800, "Log": "Security", "Name": "The workstation was locked", "Category": "LogonLogoff", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4801, "Log": "Security", "Name": "The workstation was unlocked", "Category": "LogonLogoff", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4802, "Log": "Security", "Name": "The screen saver was invoked", "Category": "LogonLogoff", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4803, "Log": "Security", "Name": "The screen saver was dismissed or an administrator console was started", "Category": "LogonLogoff", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4816, "Log": "Security", "Name": "RPC detected an integrity violation while decrypting an incoming message", "Category": "SystemIntegrity", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 4817, "Log": "Security", "Name": "Auditing settings on object were changed", "Category": "DefenseEvasion", "Importance": "Medium", "Attack": ["T1562.002"], "IpFields": []}, {"Id": 4902, "Log": "Security", "Name": "The Per-user audit policy table was created", "Category": "PolicyChange", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 4907, "Log": "Security", "Name": "Auditing settings on object were changed", "Category": "DefenseEvasion", "Importance": "Medium", "Attack": ["T1562.002"], "IpFields": []}, {"Id": 4946, "Log": "Security", "Name": "Windows Firewall exception list: a rule was added", "Category": "Firewall", "Importance": "High", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 4947, "Log": "Security", "Name": "Windows Firewall exception list: a rule was modified", "Category": "Firewall", "Importance": "Medium", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 4948, "Log": "Security", "Name": "Windows Firewall exception list: a rule was deleted", "Category": "Firewall", "Importance": "Medium", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 4950, "Log": "Security", "Name": "A Windows Firewall setting has changed", "Category": "PolicyChange", "Importance": "High", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 4951, "Log": "Security", "Name": "A rule has been ignored because its major version number was not recognized", "Category": "Firewall", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 4952, "Log": "Security", "Name": "Parts of a rule have been ignored because its minor version number was not recognized", "Category": "Firewall", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 4953, "Log": "Security", "Name": "A rule has been ignored by Windows Firewall because it failed to parse the rule", "Category": "Firewall", "Importance": "Medium", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 4954, "Log": "Security", "Name": "Windows Firewall Group Policy settings have changed", "Category": "PolicyChange", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 4956, "Log": "Security", "Name": "Windows Firewall has changed the active profile", "Category": "Firewall", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 4957, "Log": "Security", "Name": "Windows Firewall did not apply a rule", "Category": "Firewall", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 4958, "Log": "Security", "Name": "Windows Firewall did not apply a rule because it refers to items not configured on this computer", "Category": "Firewall", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 5024, "Log": "Security", "Name": "The Windows Firewall service has started successfully", "Category": "Firewall", "Importance": "Medium", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 5025, "Log": "Security", "Name": "The Windows Firewall service has been stopped", "Category": "Firewall", "Importance": "High", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 5027, "Log": "Security", "Name": "The Windows Firewall service was unable to retrieve the security policy from the local storage", "Category": "Firewall", "Importance": "High", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 5028, "Log": "Security", "Name": "The Windows Firewall service was unable to parse the new security policy", "Category": "Firewall", "Importance": "High", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 5029, "Log": "Security", "Name": "The Windows Firewall service failed to initialize the driver", "Category": "Firewall", "Importance": "High", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 5030, "Log": "Security", "Name": "The Windows Firewall service failed to start", "Category": "Firewall", "Importance": "High", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 5031, "Log": "Security", "Name": "The Windows Firewall service blocked an application from accepting incoming connections", "Category": "Firewall", "Importance": "Medium", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 5032, "Log": "Security", "Name": "Windows Firewall was unable to notify the user that it blocked an application", "Category": "Firewall", "Importance": "High", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 5033, "Log": "Security", "Name": "The Windows Firewall Driver has started successfully", "Category": "Firewall", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 5034, "Log": "Security", "Name": "The Windows Firewall Driver has been stopped", "Category": "Firewall", "Importance": "High", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 5035, "Log": "Security", "Name": "The Windows Firewall Driver failed to start", "Category": "Firewall", "Importance": "High", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 5037, "Log": "Security", "Name": "The Windows Firewall Driver detected an unexpected runtime error and has terminated", "Category": "Firewall", "Importance": "Critical", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 5038, "Log": "Security", "Name": "Code integrity determined that the image hash of a file is not valid", "Category": "DefenseEvasion", "Importance": "Critical", "Attack": ["T1562.001"], "IpFields": []}, {"Id": 5058, "Log": "Security", "Name": "Key cryptographic operation", "Category": "CredentialAccess", "Importance": "High", "Attack": ["T1003"], "IpFields": []}, {"Id": 5061, "Log": "Security", "Name": "Cryptographic operation", "Category": "CredentialAccess", "Importance": "Medium", "Attack": ["T1003"], "IpFields": []}, {"Id": 5136, "Log": "Security", "Name": "A directory service object was modified", "Category": "DirectoryAccess", "Importance": "Low", "Attack": ["T1098"], "IpFields": []}, {"Id": 5137, "Log": "Security", "Name": "A directory service object was created", "Category": "DirectoryAccess", "Importance": "Low", "Attack": ["T1136"], "IpFields": []}, {"Id": 5138, "Log": "Security", "Name": "A directory service object was undeleted", "Category": "DirectoryAccess", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 5139, "Log": "Security", "Name": "A directory service object was moved", "Category": "DirectoryAccess", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 5140, "Log": "Security", "Name": "A network share object was accessed", "Category": "ShareAccess", "Importance": "Medium", "Attack": ["T1021.002"], "IpFields": ["IpAddress"], "Notes": "SMB lateral movement with source IP."}, {"Id": 5141, "Log": "Security", "Name": "A directory service object was deleted", "Category": "DirectoryAccess", "Importance": "Low", "Attack": ["T1485"], "IpFields": []}, {"Id": 5142, "Log": "Security", "Name": "A network share object was added", "Category": "ShareAccess", "Importance": "High", "Attack": ["T1021.002"], "IpFields": []}, {"Id": 5143, "Log": "Security", "Name": "A network share object was modified", "Category": "ShareAccess", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 5144, "Log": "Security", "Name": "A network share object was deleted", "Category": "ShareAccess", "Importance": "Medium", "Attack": ["T1021.002"], "IpFields": []}, {"Id": 5145, "Log": "Security", "Name": "A network share object was checked for client access rights", "Category": "ShareAccess", "Importance": "Medium", "Attack": ["T1021.002"], "IpFields": ["IpAddress"], "Notes": "Detailed file-level share access; noisy but shows ShareName + relative paths."}, {"Id": 5152, "Log": "Security", "Name": "The Windows Filtering Platform blocked a packet", "Category": "Firewall", "Importance": "Low", "Attack": [], "IpFields": ["SourceAddress"], "Notes": "Very high volume — excluded from all default profiles."}, {"Id": 5154, "Log": "Security", "Name": "The Windows Filtering Platform has permitted an application to listen for inbound connections", "Category": "NetworkActivity", "Importance": "Low", "Attack": [], "IpFields": ["SourceAddress"]}, {"Id": 5155, "Log": "Security", "Name": "The Windows Filtering Platform has blocked an application from listening for inbound connections", "Category": "Firewall", "Importance": "Medium", "Attack": [], "IpFields": ["SourceAddress"]}, {"Id": 5156, "Log": "Security", "Name": "The Windows Filtering Platform has permitted a connection", "Category": "NetworkActivity", "Importance": "Medium", "Attack": ["T1021"], "IpFields": ["SourceAddress", "DestAddress"], "Notes": "Requires WFP audit policy. High volume; Direction field gives Inbound/Outbound."}, {"Id": 5157, "Log": "Security", "Name": "The Windows Filtering Platform has blocked a connection", "Category": "Firewall", "Importance": "Medium", "Attack": [], "IpFields": ["SourceAddress", "DestAddress"], "Notes": "Blocked connection attempts from/to the attacker IP."}, {"Id": 5158, "Log": "Security", "Name": "The Windows Filtering Platform has permitted a bind of a local port", "Category": "NetworkActivity", "Importance": "Low", "Attack": [], "IpFields": ["SourceAddress"]}, {"Id": 5159, "Log": "Security", "Name": "The Windows Filtering Platform has blocked a bind of a local port", "Category": "Firewall", "Importance": "Low", "Attack": [], "IpFields": ["SourceAddress"]}, {"Id": 5168, "Log": "Security", "Name": "SPN check for SMB/SMB2 failed", "Category": "Kerberos", "Importance": "Medium", "Attack": ["T1558"], "IpFields": []}, {"Id": 5376, "Log": "Security", "Name": "Credential Manager credentials were backed up", "Category": "CredentialAccess", "Importance": "High", "Attack": ["T1003"], "IpFields": []}, {"Id": 5377, "Log": "Security", "Name": "Credential Manager credentials were restored", "Category": "CredentialAccess", "Importance": "High", "Attack": ["T1003"], "IpFields": []}, {"Id": 5632, "Log": "Security", "Name": "A request was made to authenticate to a wireless network", "Category": "RemoteAccess", "Importance": "Medium", "Attack": ["T1110"], "IpFields": []}, {"Id": 5633, "Log": "Security", "Name": "A request was made to authenticate to a wired network", "Category": "RemoteAccess", "Importance": "Medium", "Attack": ["T1110"], "IpFields": []}, {"Id": 5712, "Log": "Security", "Name": "A Remote Procedure Call (RPC) was attempted to run against the LSASS process", "Category": "DefenseEvasion", "Importance": "High", "Attack": ["T1210"], "IpFields": [], "Notes": "Associated with remote exploitation attempts against LSASS (e.g., Zerologon-class)."}, {"Id": 1100, "Log": "Security", "Name": "The event logging service has shut down", "Category": "SystemIntegrity", "Importance": "Medium", "Attack": ["T1562.002"], "IpFields": []}, {"Id": 1102, "Log": "Security", "Name": "The audit log was cleared", "Category": "SystemIntegrity", "Importance": "Critical", "Attack": ["T1070.001"], "IpFields": [], "Notes": "Anti-forensics. The SubjectAccount + ClientDomainName of the clearer matter."}, {"Id": 1104, "Log": "Security", "Name": "The security log is now full", "Category": "SystemIntegrity", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 1105, "Log": "Security", "Name": "Event log automatic backup", "Category": "SystemIntegrity", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 1108, "Log": "Security", "Name": "The event logging service encountered an error while processing an incoming event", "Category": "SystemIntegrity", "Importance": "High", "Attack": ["T1562"], "IpFields": []}, {"Id": 104, "Log": "System", "Provider": "Microsoft-Windows-Eventlog", "Name": "The log file was cleared", "Category": "SystemIntegrity", "Importance": "Critical", "Attack": ["T1070.001"], "IpFields": [], "Notes": "Logged in System when ANY log is cleared — cross-checks Security 1102."}, {"Id": 6005, "Log": "System", "Provider": "Microsoft-Windows-Eventlog", "Name": "The Event log service was started", "Category": "SystemIntegrity", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 6006, "Log": "System", "Provider": "Microsoft-Windows-Eventlog", "Name": "The Event log service was stopped", "Category": "SystemIntegrity", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 6008, "Log": "System", "Provider": "Microsoft-Windows-Eventlog", "Name": "The previous system shutdown was unexpected", "Category": "SystemIntegrity", "Importance": "High", "Attack": [], "IpFields": []}, {"Id": 6013, "Log": "System", "Provider": "Microsoft-Windows-Eventlog", "Name": "The system uptime", "Category": "SystemIntegrity", "Importance": "Low", "Attack": [], "IpFields": []}, {"Id": 7031, "Log": "System", "Provider": "Microsoft-Windows-ServiceControlManager", "Name": "The service terminated unexpectedly and corrective action was configured", "Category": "ServiceActivity", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 7034, "Log": "System", "Provider": "Microsoft-Windows-ServiceControlManager", "Name": "The service terminated unexpectedly", "Category": "ServiceActivity", "Importance": "Medium", "Attack": [], "IpFields": []}, {"Id": 7040, "Log": "System", "Provider": "Microsoft-Windows-ServiceControlManager", "Name": "The service start type was changed", "Category": "ServiceActivity", "Importance": "Low", "Attack": ["T1543.003"], "IpFields": []}, {"Id": 7045, "Log": "System", "Provider": "Microsoft-Windows-ServiceControlManager", "Name": "A service was installed in the system", "Category": "ServiceActivity", "Importance": "High", "Attack": ["T1543.003", "T1021"], "IpFields": [], "Notes": "PsExec-style remote service installs land here (ImagePath may contain \\\\attacker-ip\\)."}, {"Id": 1147, "Log": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational", "Provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager", "Name": "Connection failure (transport-level error)", "Category": "RemoteAccess", "Importance": "Medium", "Attack": ["T1021.001"], "IpFields": ["Address"], "Notes": "IP lives in UserData/EventXML."}, {"Id": 1148, "Log": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational", "Provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager", "Name": "RDP user authentication failed", "Category": "RemoteAccess", "Importance": "High", "Attack": ["T1110", "T1021.001"], "IpFields": ["Address"], "Notes": "IP lives in UserData/EventXML/Address. Pre-NLA failures."}, {"Id": 1149, "Log": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational", "Provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager", "Name": "RDP user authentication succeeded (network level)", "Category": "RemoteAccess", "Importance": "Critical", "Attack": ["T1021.001", "T1078"], "IpFields": ["Address"], "Notes": "IP lives in UserData/EventXML/Address; fires BEFORE 4624 type 10."}, {"Id": 21, "Log": "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational", "Provider": "Microsoft-Windows-TerminalServices-LocalSessionManager", "Name": "Remote Desktop Services: session logon succeeded", "Category": "RemoteAccess", "Importance": "High", "Attack": ["T1021.001"], "IpFields": ["Address"], "Notes": "UserData/EventXML/Address contains source IP."}, {"Id": 22, "Log": "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational", "Provider": "Microsoft-Windows-TerminalServices-LocalSessionManager", "Name": "Remote Desktop Services: shell start notification received", "Category": "RemoteAccess", "Importance": "Medium", "Attack": ["T1021.001"], "IpFields": ["Address"]}, {"Id": 23, "Log": "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational", "Provider": "Microsoft-Windows-TerminalServices-LocalSessionManager", "Name": "Remote Desktop Services: session logoff succeeded", "Category": "RemoteAccess", "Importance": "Medium", "Attack": [], "IpFields": ["Address"]}, {"Id": 24, "Log": "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational", "Provider": "Microsoft-Windows-TerminalServices-LocalSessionManager", "Name": "Remote Desktop Services: session has been disconnected", "Category": "RemoteAccess", "Importance": "Medium", "Attack": [], "IpFields": ["Address"]}, {"Id": 25, "Log": "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational", "Provider": "Microsoft-Windows-TerminalServices-LocalSessionManager", "Name": "Remote Desktop Services: session reconnection succeeded", "Category": "RemoteAccess", "Importance": "High", "Attack": ["T1021.001"], "IpFields": ["Address"]}, {"Id": 2004, "Log": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall", "Provider": "Microsoft-Windows-Windows Firewall With Advanced Security", "Name": "A rule has been added to the Windows Defender Firewall exception list", "Category": "Firewall", "Importance": "High", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 2005, "Log": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall", "Provider": "Microsoft-Windows-Windows Firewall With Advanced Security", "Name": "A rule has been modified in the Windows Defender Firewall exception list", "Category": "Firewall", "Importance": "Medium", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 2006, "Log": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall", "Provider": "Microsoft-Windows-Windows Firewall With Advanced Security", "Name": "A rule has been deleted from the Windows Defender Firewall exception list", "Category": "Firewall", "Importance": "Medium", "Attack": ["T1562.004"], "IpFields": []}, {"Id": 1, "Log": "Microsoft-Windows-Sysmon/Operational", "Provider": "Microsoft-Windows-Sysmon", "Name": "Sysmon: process creation", "Category": "ProcessExecution", "Importance": "High", "Attack": ["T1059", "T1204"], "IpFields": [], "Notes": "CommandLine often contains attacker IPs during lateral movement."}, {"Id": 3, "Log": "Microsoft-Windows-Sysmon/Operational", "Provider": "Microsoft-Windows-Sysmon", "Name": "Sysmon: network connection detected", "Category": "NetworkActivity", "Importance": "Critical", "Attack": ["T1021", "T1071", "T1571"], "IpFields": ["SourceIp", "DestinationIp"], "Notes": "The richest IP-hunting source when Sysmon is deployed: process ↔ IP with direction."}, {"Id": 8, "Log": "Microsoft-Windows-Sysmon/Operational", "Provider": "Microsoft-Windows-Sysmon", "Name": "Sysmon: CreateRemoteThread detected", "Category": "LateralMovement", "Importance": "High", "Attack": ["T1055"], "IpFields": []}, {"Id": 9, "Log": "Microsoft-Windows-Sysmon/Operational", "Provider": "Microsoft-Windows-Sysmon", "Name": "Sysmon: RawAccessRead detected", "Category": "CredentialAccess", "Importance": "Medium", "Attack": ["T1006"], "IpFields": []}, {"Id": 10, "Log": "Microsoft-Windows-Sysmon/Operational", "Provider": "Microsoft-Windows-Sysmon", "Name": "Sysmon: ProcessAccess detected", "Category": "CredentialAccess", "Importance": "Medium", "Attack": ["T1003.001"], "IpFields": []}, {"Id": 11, "Log": "Microsoft-Windows-Sysmon/Operational", "Provider": "Microsoft-Windows-Sysmon", "Name": "Sysmon: FileCreate detected", "Category": "Persistence", "Importance": "Medium", "Attack": ["T1105"], "IpFields": []}, {"Id": 13, "Log": "Microsoft-Windows-Sysmon/Operational", "Provider": "Microsoft-Windows-Sysmon", "Name": "Sysmon: RegistryValueSet detected", "Category": "DefenseEvasion", "Importance": "Medium", "Attack": ["T1112", "T1547.001"], "IpFields": []}, {"Id": 15, "Log": "Microsoft-Windows-Sysmon/Operational", "Provider": "Microsoft-Windows-Sysmon", "Name": "Sysmon: FileCreateStreamHash detected", "Category": "DefenseEvasion", "Importance": "Medium", "Attack": ["T1105", "T1564.004"], "IpFields": []}, {"Id": 16, "Log": "Microsoft-Windows-Sysmon/Operational", "Provider": "Microsoft-Windows-Sysmon", "Name": "Sysmon: configuration state changed", "Category": "DefenseEvasion", "Importance": "Critical", "Attack": ["T1562.001"], "IpFields": [], "Notes": "Attackers reconfigure/disable Sysmon to blind EDR-adjacent telemetry."}, {"Id": 22, "Log": "Microsoft-Windows-Sysmon/Operational", "Provider": "Microsoft-Windows-Sysmon", "Name": "Sysmon: DNS query detected", "Category": "NetworkActivity", "Importance": "Low", "Attack": ["T1071.004"], "IpFields": [], "Notes": "QueryName rarely equals an IP; useful for C2 domain resolution context."}, {"Id": 23, "Log": "Microsoft-Windows-Sysmon/Operational", "Provider": "Microsoft-Windows-Sysmon", "Name": "Sysmon: FileDelete archived", "Category": "DefenseEvasion", "Importance": "Medium", "Attack": ["T1070.004"], "IpFields": []}, {"Id": 25, "Log": "Microsoft-Windows-Sysmon/Operational", "Provider": "Microsoft-Windows-Sysmon", "Name": "Sysmon: ProcessTampering detected", "Category": "DefenseEvasion", "Importance": "High", "Attack": ["T1055.013"], "IpFields": []} ] }