EVID 1074 & 1076: Restart/Shutdown Events (Part 1)

Vendor Documentation

https://windows-event-explorer.app.elstc.co/publisher/User32/event/1074/v0

https://kb.eventtracker.com/evtpass/evtpages/EventId_1074_User32_46330.asp#:~:text=Event%20ID%20%2D%201074&text=This%20event%20is%20written%20when,and%20then%20clicking%20Shut%20Down.&text=A%20system%20state%20data%20file,every%20unplanned%20restart%20or%20shutdown.

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Provider	N/A	<tag2>
EventID	<vmid>	<vmid>
Version	N/A	N/A
Level	<severity>	<severity>
Task	N/A	<vendorinfo>
Keywords	N/A	<result>
TimeCreated	N/A	N/A
EventRecordID	N/A	N/A
Execution ProcessID	<processid>	N/A
ThreadID	<session>	N/A
Channel	N/A	N/A
Computer	<dname>	<dname>
Security UserID	<domain>, <login>	N/A
param1	N/A	<process>
param2	N/A	N/A
param3	N/A	<subject>
param4	N/A	N/A
param5	N/A	<command>
param6	N/A	N/A
param7	N/A	<domainimpacted>, <account>
Data	<object>	N/A
Data	<sname>, <responsecode>	N/A
Data	<objectname>, <vendorinfo>	N/A
Data	N/A	N/A
Data	<command>	N/A
Data	<subject>	N/A
Binary	N/A	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1008259	EVID 1074 & 1076: Restart/Shutdown Events	Base Rule	Process/Service Startup Or Shutdown Activity	Startup and Shutdown
	EVID 1074: Restart Initiated	Sub Rule	System Restarting	Startup and Shutdown
	EVID 1074: Shutdown Initiated	Sub Rule	System Shutting Down	Startup and Shutdown
	EVID 1076: Dirty Shutdown	Sub Rule	Unclean Shutdown	Warning

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1012752	V 2.0 : EVID 1074: System Restart/Shutdown Event	Base Rule	General Information Log Message	Information