Multiple EVIDs : Catch All : Level 3 (Security)

Multiple

Catch all rule to handle other Windows Security Events.

Multiple

Provider

<subject>

N/A

EventID

<vmid>

N/A

Version

N/A

N/A

Level

<severity>

N/A

Task

<vendorinfo>

N/A

Opcode

N/A

N/A

Keywords

<tag1>

N/A

TimeCreated

N/A

N/A

EventRecordID

N/A

N/A

Correlation

N/A

N/A

Execution

N/A

N/A

Processid

N/A

N/A

Channel

N/A

N/A

Computer

<dname>

N/A

EventData

N/A

N/A

Security Id

<login>, <domain>

N/A

Logon Id

<session>

N/A

Object

N/A

N/A

Objectname

<objectname>

N/A

Objecttype

<objecttype>

N/A

FileName

<object>

N/A

Creator Process Id

<parentprocessid>

N/A

Group Name

<group>

N/A

Task Name

<object>

N/A

1000291

EVID 4608 : System Started

Sub Rule

System Started

Startup and Shutdown

EVID 4903 : Per User Audit Policy Set

Sub Rule

Policy Enabled : Auditing

Policy

EVID 4902 : Per User Audit Policy Refreshed

Sub Rule

Policy Modified : Auditing

Policy

EVID 4663 : General Access Attempt

Sub Rule

Object Accessed

Access Success

EVID 4616 : System Time Changed

Sub Rule

Configuration Modified : System

Configuration

EVID 4933 : Directory Services Access

Sub Rule

Object Accessed

Access Success

EVID 4932 : Directory Services Access

Sub Rule

Object Accessed

Access Success

EVID 4931 : Directory Services Access

Sub Rule

Object Accessed

Access Success

General : Audit Failure

Sub Rule

General Audit Failure

Error

General : Audit Success

Sub Rule

General Audit

Other Audit Success

EVID 4710 : IPSec Policy Agent Stopped

Sub Rule

Process/Service Stopped

Startup and Shutdown

EVID 4709 : IPSec Policy Agent Started

Sub Rule

Process/Service Started

Startup and Shutdown

EVID 4690 : Handle Duplicated

Sub Rule

Handle Duplicated

Information

EVID 4660 : Object Deleted

Sub Rule

Object Deleted/Removed

Access Success

EVID 4658 : Handle Closed

Sub Rule

Handle Closed

Information

EVID 4657 : Handle Allocated

Sub Rule

Handle Allocated

Information

EVID 4643 : General Audit Failure

Sub Rule

General Audit Failure

Error

EVID 4642 : General Audit Failure

Sub Rule

General Audit Failure

Error

EVID 4641 : General Audit Failure

Sub Rule

General Audit Failure

Error

EVID 4640 : General Audit Failure

Sub Rule

General Audit Failure

Error

EVID 4639 : General Audit

Sub Rule

General Audit

Other Audit Success

EVID 4638 : General Audit

Sub Rule

General Audit

Other Audit Success

EVID 4637 : General Audit

Sub Rule

General Audit

Other Audit Success

EVID 4614 : Auth Package Loaded By SAM

Sub Rule

Auth Package Loaded By SAM

Other Audit Success

EVID 4611 : Trusted Logon Process Started

Sub Rule

Process/Service Started

Startup and Shutdown

EVID 4610 : Authentication Package Loaded

Sub Rule

Object Initialized

Access Success

EVID 4609 : System Shutdown

Sub Rule

System Shutdown

Startup and Shutdown

Catch All : Level 3

Base Rule

General Audit

Other Audit Success

EVID 5480 : IPSEC Network Interface List Failed

Sub Rule

IPSEC Network Interface List Failed

Warning

EVID 5032 : Firewall Notification Failed

Sub Rule

Firewall Notification Failed

Warning

EVID 5028 : Firewall Service Policy Load Failed

Sub Rule

Firewall Service Failed To Load Local Policy

Warning

EVID 5027 : Firewall Service Policy Load Failed

Sub Rule

Firewall Service Failed To Load Local Policy

Warning

EVID 4958 : Firewall Rule Not Applied

Sub Rule

Firewall Rule Not Applied

Warning

EVID 4957 : Firewall Rule Not Applied

Sub Rule

Firewall Rule Not Applied

Warning

EVID 4953 : Firewall Rule Ignored

Sub Rule

Firewall Rule Ignored Due To Bad Parsing

Warning

EVID 4952 : Firewall Rule Ignored

Sub Rule

Firewall Rule Ignored Due To Version

Warning

EVID 4951 : Firewall Rule Ignored

Sub Rule

Firewall Rule Ignored Due To Version

Warning

EVID 4612 : Audit Queuing Resources Exh

Sub Rule

Audit Queuing Resources Exhausted

Warning

EVID 4978 : IPSEC Received Invalid Negot Packet

Sub Rule

Protocol Anomaly

Attack

EVID 4977 : IPSEC Received Invalid Negot Packet

Sub Rule

Protocol Anomaly

Attack

EVID 4976 : IPSEC Received Invalid Negot Packet

Sub Rule

Protocol Anomaly

Attack

EVID 4618 : Monitored Sec Event

Sub Rule

Suspicious Activity

Suspicious

EVID 5479 : IPSEC Service Stopped

Sub Rule

Process/Service Stopped

Startup and Shutdown

EVID 5478 : IPSEC Service Started

Sub Rule

Process/Service Started

Startup and Shutdown

EVID 5121 : OCSP Responder Service Stopped

Sub Rule

Process/Service Stopped

Startup and Shutdown

EVID 5120 : OCSP Responder Service Started

Sub Rule

Process/Service Started

Startup and Shutdown

EVID 5034 : Firewall Driver Stopped

Sub Rule

Process/Service Stopped

Startup and Shutdown

EVID 5033 : Firewall Driver Started

Sub Rule

Process/Service Started

Startup and Shutdown

EVID 5025 : Firewall Service Stopped

Sub Rule

Process/Service Stopped

Startup and Shutdown

EVID 5024 : Firewall Service Started

Sub Rule

Process/Service Started

Startup and Shutdown

EVID 4881 : Certificate Services Stopped

Sub Rule

Process/Service Stopped

Startup and Shutdown

EVID 4880 : Certificate Services Started

Sub Rule

Process/Service Started

Startup and Shutdown

EVID 4875 : Cert Svcs Shutdown Request

Sub Rule

Process/Service Stopping

Startup and Shutdown

EVID 4689 : Process Exited

Sub Rule

Process/Service Stopped

Startup and Shutdown

EVID 4688 : New Process Created

Sub Rule

Process/Service Started

Startup and Shutdown

EVID 6144 : GPO Security Policy Applied

Sub Rule

Policy Enabled : Domain

Policy

EVID 5473 : IPSEC Policy Applied

Sub Rule

Policy Enabled : Network

Policy

EVID 5471 : IPSEC Policy Applied

Sub Rule

Policy Enabled : Network

Policy

EVID 5468 : IPSEC Policy Changes Applied

Sub Rule

Policy Modified : Network

Policy

EVID 5467 : Polled For IPSEC Policy Changes

Sub Rule

Polled For IPSEC Policy Changes

Information

EVID 5466 : IPSEC Policy Changes Applied

Sub Rule

Policy Modified : Network

Policy

EVID 5465 : IPSEC Policy Reloaded

Sub Rule

Authentication Activity

Authentication Success

EVID 5464 : IPSEC Policy Changes Applied

Sub Rule

Policy Modified : Network

Policy

EVID 5463 : Polled For IPSEC Policy Changes

Sub Rule

Polled For IPSEC Policy Changes

Information

EVID 5460 : IPSEC Policy Applied

Sub Rule

Policy Enabled : Network

Policy

EVID 5459 : IPSEC Policy Applied

Sub Rule

Policy Enabled : Network

Policy

EVID 5457 : IPSEC Policy Applied

Sub Rule

Policy Enabled : Network

Policy

EVID 5456 : IPSEC Policy Applied

Sub Rule

Policy Enabled : Network

Policy

EVID 4954 : Firewall Group Policy Settings Changed

Sub Rule

Policy Modified : Domain

Policy

EVID 4912 : Per-User Audit Policy Changed

Sub Rule

Policy Modified : Auditing

Policy

EVID 4910 : TBS Group Policy Settings Changed

Sub Rule

Policy Modified : Domain

Policy

EVID 4909 : TBS Local Policy Settings Changed

Sub Rule

Policy Modified : System

Policy

EVID 4907 : Audit Settings On Object Changed

Sub Rule

Policy Modified : Auditing

Policy

EVID 4906 : CrashOnAuditFail Value Changed

Sub Rule

Policy Modified : Auditing

Policy

EVID 4897 : Role Separation Enabled

Sub Rule

Policy Modified : System

Policy

EVID 4885 : Cert Svcs Audit Filter Changed

Sub Rule

Policy Modified : Auditing

Policy

EVID 4882 : Cert Svcs Sec Permissions Changed

Sub Rule

Policy Modified : System

Policy

EVID 4867 : Trusted Forest Entry Modified

Sub Rule

Trust Relationship Established

Access Granted

EVID 4866 : Trusted Forest Entry Removed

Sub Rule

Trust Relationship Revoked

Access Revoked

EVID 4865 : Trusted Forest Entry Added

Sub Rule

Trust Relationship Established

Access Granted

EVID 4780 : Admins Account ACL Set

Sub Rule

Policy Enabled : User/Password

Policy

EVID 4739 : Domain Policy Changed

Sub Rule

Policy Modified : Domain

Policy

EVID 4719 : Sys Audit Policy Changed

Sub Rule

Policy Modified : Auditing

Policy

EVID 4716 : Trusted Domain Info Modified

Sub Rule

Policy Modified : Domain

Policy

EVID 4715 : Object Audit Policy Changed

Sub Rule

Policy Modified : Object

Policy

EVID 4714 : Encrypted Data Recovery Policy Changed

Sub Rule

Policy Modified : Encryption

Policy

EVID 4713 : Kerberos Policy Changed

Sub Rule

Policy Modified : System

Policy

EVID 4707 : Trusted Domain Removed

Sub Rule

Trust Relationship Revoked

Access Revoked

EVID 4706 : Trusted Domain Added

Sub Rule

Trust Relationship Established

Access Granted

EVID 4670 : Object Permissions Changed

Sub Rule

Policy Modified : Object

Policy

EVID 4964 : Special Groups Assigned To New Logon

Sub Rule

Special Groups Assigned To New Logon

Other Audit Success

EVID 4886 : Cert Svcs Certificate Request

Sub Rule

Certificate Services Received Certificate Request

Other Audit Success

EVID 4779 : Win Session Disconnect

Sub Rule

Session Disconnected

Other Audit Success

EVID 4778 : Win Session Reconnect

Sub Rule

User Logon

Authentication Success

EVID 4776 : Credentials Validation

Sub Rule

Authentication Activity

Authentication Success

EVID 4774 : Account Mapped For Logon

Sub Rule

Account Mapped For Logon

Other Audit Success

EVID 4770 : Kerberos Svc Ticket Renewed

Sub Rule

Authentication Activity

Authentication Success

EVID 4769 : Kerberos Svc Ticket Requested

Sub Rule

Authentication Activity

Authentication Success

EVID 4768 : Kerberos Auth Ticket Requested

Sub Rule

Authentication Activity

Authentication Success

EVID 4765 : Add SID History

Sub Rule

Configuration Modified : System

Configuration

EVID 4672 : Special Privs Assigned To New Logon

Sub Rule

Privilege Granted

Access Granted

EVID 4661 : Object Handle Requested

Sub Rule

Object Handle Requested

Other Audit Success

EVID 4655 : IPSEC Security Assoc Ended

Sub Rule

Authentication Activity

Authentication Success

EVID 4651 : IPSEC Sec Assoc Established

Sub Rule

Trust Relationship Established

Access Granted

EVID 4650 : IPSEC Sec Assoc Established

Sub Rule

Trust Relationship Established

Access Granted

EVID 5474 : IPSEC Policy Application Failed

Sub Rule

IPSEC Policy Application Failed

Other Audit Failure

EVID 5472 : IPSEC Policy Application Failed

Sub Rule

IPSEC Policy Application Failed

Other Audit Failure

EVID 5462 : IPSEC Policy Application Failed

Sub Rule

IPSEC Policy Application Failed

Other Audit Failure

EVID 5461 : IPSEC Policy Application Failed

Sub Rule

IPSEC Policy Application Failed

Other Audit Failure

EVID 5458 : IPSEC Policy Application Failed

Sub Rule

IPSEC Policy Application Failed

Other Audit Failure

EVID 5378 : Credential Delegation Disallowed

Sub Rule

Credential Delegation Disallowed

Other Audit Failure

EVID 4888 : Cert Svcs Denied Certificate Request

Sub Rule

Certificate Services Denied Certificate Request

Warning

EVID 4868 : Cert Man Denied Pending Request

Sub Rule

Certificate Manager Denied Pending Cert Request

Warning

EVID 4777 : Credentials Validation Failed

Sub Rule

User Logon Failure : Bad Password

Authentication Failure

EVID 4775 : Account Map For Logon Failed

Sub Rule

Account Logon Mapping Failed

Other Audit Failure

EVID 4766 : Add SID History Failed

Sub Rule

General Audit Failure

Error

EVID 4654 : IPSEC Negotiation Failed

Sub Rule

IPSEC Negotiation Failed

Error

EVID 4653 : IPSEC Negotiation Failed

Sub Rule

IPSEC Negotiation Failed

Error

EVID 4652 : IPSEC Negotiation Failed

Sub Rule

IPSEC Negotiation Failed

Error

EVID 6276 : Network Policy Server Quarantined User

Sub Rule

Network Policy Server Quarantined User

Other Audit

EVID 6275 : Network Policy Svr Discarded Request

Sub Rule

Network Policy Server Discarded Request

Other Audit

EVID 6274 : Network Policy Svr Discarded Request

Sub Rule

Network Policy Server Discarded Request

Other Audit

EVID 5633 : Wired Network Authentication Request

Sub Rule

Authentication Activity

Authentication Success

EVID 5632 : WLAN Authentication Request

Sub Rule

Authentication Activity

Authentication Success

EVID 5069 : Cryptographic Func Prop Op Attempt

Sub Rule

Cryptographic Function Property Operation Attempt

Other Audit

EVID 5068 : Cryptographic Funct Provider Op Atmt

Sub Rule

Cryptographic Function Provider Operation Attempt

Other Audit

EVID 5066 : Cryptographic Function Op Attempted

Sub Rule

Cryptographic Function Operation Attempted

Other Audit

EVID 5064 : Cryptographic Context Op Attempted

Sub Rule

Cryptographic Context Operation Attempted

Other Audit

EVID 5063 : Cryptographic Provider Op Attempted

Sub Rule

Cryptographic Provider Operation Attempted

Other Audit

EVID 4869 : Cert Svcs Rcvd Resubmitted Cert Req

Sub Rule

Certificate Services Rcvd Resubmitted Cert Request

Other Audit

EVID 4801 : Workstation Unlocked

Sub Rule

Workstation Unlocked

Other Audit Success

EVID 4800 : Workstation Locked

Sub Rule

Workstation Locked

Other Audit Success

EVID 4711 : General Audit Message

Sub Rule

General Audit Message

Other Audit

EVID 4696 : Primary Token Assigned

Sub Rule

Primary Token Assigned

Information

EVID 4675 : SIDs Filtered

Sub Rule

SIDs Filtered

Other Audit

EVID 5712 : RPC Attempted

Sub Rule

Remote Procedure Call Attempt

Network Traffic

EVID 5452 : IPSEC Security Association Ended

Sub Rule

IPSEC Security Association Ended

Network Traffic

EVID 5451 : IPSEC Security Association Established

Sub Rule

IPSEC Security Association Established

Network Traffic

EVID 5125 : Request Submitted To OCSP Responder

Sub Rule

Request Submitted To OCSP Responder

Network Traffic

EVID 4985 : Transaction State Change

Sub Rule

Transaction State Change

Network Traffic

EVID 5453 : IPSEC Negotiation Failed

Sub Rule

Traffic Denied by Host Firewall

Network Deny

EVID 5159 : Filtering Denied Port Bind

Sub Rule

Traffic Denied by Host Firewall

Network Deny

EVID 5157 : Filtering Blocked Connection

Sub Rule

Traffic Denied by Host Firewall

Network Deny

EVID 5155 : Filtering Blocked App From Listening

Sub Rule

Application Blocked From Listening For Connections

Warning

EVID 5153 : Filtering Blocked Packet

Sub Rule

Traffic Denied by Host Firewall

Network Deny

EVID 5152 : Filtering Blocked Packet

Sub Rule

Traffic Denied by Host Firewall

Network Deny

EVID 5031 : Firewall Blocked Connection To App

Sub Rule

Traffic Denied by Host Firewall

Network Deny

EVID 4984 : IPSEC Negotiation Failed

Sub Rule

Traffic Denied by Host Firewall

Network Deny

EVID 4983 : IPSEC Negotiation Failed

Sub Rule

Traffic Denied by Host Firewall

Network Deny

EVID 4963 : IPSEC Dropped Inbound Packet

Sub Rule

Traffic Denied by Host Firewall

Network Deny

EVID 4962 : IPSEC Dropped Inbound Packet

Sub Rule

Traffic Denied by Host Firewall

Network Deny

EVID 4961 : IPSEC Dropped Inbound Packet

Sub Rule

Traffic Denied by Host Firewall

Network Deny

EVID 4960 : IPSEC Dropped Inbound Packet

Sub Rule

Traffic Denied by Host Firewall

Network Deny

EVID 5158 : Filtering Permitted Port Bind

Sub Rule

Permitted Bind To Local Port

Information

EVID 5156 : Filtering Allowed Connection

Sub Rule

Traffic Allowed by Host Firewall

Network Allow

EVID 5154 : Filtering Allowed App To Listen

Sub Rule

Application Allowed To Listen For Connections

Information

EVID 4615 : Invalid Use Of LPC Port

Sub Rule

Unauthorized Activity

Misuse

EVID 5444 : Filtering Platform Startup State

Sub Rule

Filtering Platform Startup State

Information

EVID 5443 : Filtering Platform Startup State

Sub Rule

Filtering Platform Startup State

Information

EVID 5442 : Filtering Platform Startup State

Sub Rule

Filtering Platform Startup State

Information

EVID 5441 : Filtering Platform Startup State

Sub Rule

Filtering Platform Startup State

Information

EVID 5440 : Filtering Platform Startup State

Sub Rule

Filtering Platform Startup State

Information

EVID 5377 : Credentials Restored From Backup

Sub Rule

Credentials Restored From Backup

Information

EVID 5376 : Credentials Backed Up

Sub Rule

Credentials Backed Up

Information

EVID 5062 : Cryptographic Self Test Performed

Sub Rule

Cryptographic Self Test Performed

Information

EVID 5056 : Cryptographic Self Test Performed

Sub Rule

Cryptographic Self Test Performed

Information

EVID 4945 : Rule Listed On Firewall Start

Sub Rule

Rule Listed On Firewall Start

Information

EVID 4944 : Active Firewall Policy On Start

Sub Rule

Active Firewall Policy On Start

Information

EVID 4900 : Cert Svcs Template Sec Updated

Sub Rule

Certificate Services Template Security Updated

Information

EVID 4899 : Cert Svcs Template Updated

Sub Rule

Certificate Services Updated Template

Information

EVID 4898 : Cert Svcs Template Loaded

Sub Rule

Certificate Services Loaded Template

Information

EVID 4896 : Cert Svcs DB Rows Deleted

Sub Rule

Certificate Services Database Rows Deleted

Information

EVID 4895 : Cert Svcs Published CA Cert

Sub Rule

Certificate Services Published CA Certificate

Information

EVID 4894 : Cert Svcs Imported & Archived Key

Sub Rule

Certificate Services Imported And Archived Key

Information

EVID 4893 : Cert Svcs Archived A Key

Sub Rule

Certificate Services Archived A Key

Information

EVID 4889 : Cert Svcs Cert Status To Pending

Sub Rule

Certificate Services Set Cert Status To Pending

Information

EVID 4884 : Cert Svcs Imported Certificate

Sub Rule

Certificate Services Imported Certificate

Information

EVID 4883 : Cert Svcs Retrieved Archived Key

Sub Rule

Certificate Services Retrieved Archived Key

Information

EVID 4879 : Cert Svcs Restore Completed

Sub Rule

Certificate Services Restore Completed

Information

EVID 4878 : Cert Svcs Restore Started

Sub Rule

Process/Service Started

Startup and Shutdown

EVID 4877 : Cert Svcs Backup Complete

Sub Rule

Certificate Services Backup Completed

Information

EVID 4876 : Cert Svcs Backup Started

Sub Rule

Certificate Services Backup Started

Information

EVID 4874 : Certificate Request Attributes Changed

Sub Rule

Certificate Request Attributes Changed

Information

EVID 4873 : Certificate Request Extension Changed

Sub Rule

Certificate Request Extension Changed

Information

EVID 4872 : Cert Svcs Published CRL

Sub Rule

Certificate Services Published CRL

Information

EVID 4871 : Cert Svcs Request CRL

Sub Rule

Certificate Svcs Received Request To Publish CRL

Information

EVID 4803 : Screen Saver Dismissed

Sub Rule

Screen Saver Dismissed

Information

EVID 4802 : Screen Saver Invoked

Sub Rule

Screen Saver Invoked

Information

EVID 4793 : Password Policy Checker API Called

Sub Rule

Policy Modified : Object

Policy

EVID 4621 : Recovered From Crash On Audit Fail

Sub Rule

Crash On Audit Fail Recovered

Information

EVID 6145 : GPO Security Policy Application Error

Sub Rule

GPO Security Policy Application Error

Error

EVID 5485 : IPSEC Filter Processing Failed

Sub Rule

IPSEC Filter Processing Failed

Error

EVID 5483 : IPSEC Service Failed To Start

Sub Rule

IPSEC Service Failed To Start

Error

EVID 5477 : Failed To Load Quick Mode Filter

Sub Rule

Failed To Load Quick Mode Filter

Error

EVID 5057 : Cryptographic Self Test Failed

Sub Rule

Cryptographic Self Test Failed

Error

EVID 5050 : Programmatic Firewall Disable Attempt

Sub Rule

Programmatic Firewall Disable Attempted

Error

EVID 4965 : IPSEC Received Bad Packet

Sub Rule

IPSEC Received Bad Packet

Error

EVID 4936 : AD Replication Failure Ends

Sub Rule

AD Replication Failure Ends

Error

EVID 4935 : AD Replication Failure Begins

Sub Rule

AD Replication Failure Begins

Error

EVID 4864 : Namespace Collision

Sub Rule

Namespace Collision

Error

EVID 4816 : RPC Integrity Violation

Sub Rule

RPC Integrity Violation

Error

EVID 4712 : IPSEC Service Failure

Sub Rule

IPSEC Service Serious Failure

Error

EVID 5484 : IPSEC Service Error Caused Shutdown

Sub Rule

IPSEC Service Error Caused Shutdown

Critical

EVID 5038 : Possible Disk Error

Sub Rule

Computed Hash Match Failure

Error

EVID 5037 : Firewall Driver Critical Condition

Sub Rule

Firewall Driver Critical Condition

Critical

EVID 5035 : Firewall Driver Startup Failed

Sub Rule

Firewall Driver Startup Failed

Critical

EVID 5030 : Firewall Service Failed To Start

Sub Rule

Firewall Service Failed To Start

Critical

EVID 5029 : Firewall Driver Init Failed

Sub Rule

Firewall Driver Init Failed

Critical

EVID 5450 : Filtering Platform Sub-Layer Changed

Sub Rule

Configuration Modified : Application

Configuration

EVID 5449 : Filtering Platform Prov Context Chng

Sub Rule

Configuration Modified : Security

Configuration

EVID 5448 : Filtering Platform Provider Changed

Sub Rule

Configuration Modified : Application

Configuration

EVID 5447 : Filtering Platform Filter Changed

Sub Rule

Configuration Modified : Application

Configuration

EVID 5446 : Filtering Platform Callout Changed

Sub Rule

Configuration Modified : Application

Configuration

EVID 5127 : OCSP Revoc Provider Updated Revoc Info

Sub Rule

OCSP Revocation Provider Updated Revocation Info

Information

EVID 5126 : OCSP Updated Signing Certificate

Sub Rule

Configuration Modified : Security

Configuration

EVID 5124 : OCSP Responder Sec Setting Updated

Sub Rule

Configuration Modified : Security

Configuration

EVID 5123 : OCSP Responder Configuration Changed

Sub Rule

Configuration Modified : Application

Configuration

EVID 5122 : OCSP Responder Configuration Changed

Sub Rule

Configuration Modified : Application

Configuration

EVID 5070 : Cryptographic Funct Prop Mod Attempted

Sub Rule

Cryptographic Function Property Mod Attempt

Warning

EVID 5067 : Cryptographic Function Mod Attempted

Sub Rule

Cryptographic Function Modification Attempted

Warning

EVID 5065 : Cryptographic Context Mod Attempted

Sub Rule

Cryptographic Context Modification Attempted

Warning

EVID 5049 : IPSEC Security Association Deleted

Sub Rule

Configuration Deleted : Security

Configuration

EVID 5048 : IPSEC Crypto Set Deleted

Sub Rule

Configuration Deleted : Security

Configuration

EVID 5047 : IPSEC Crypto Set Modified

Sub Rule

Configuration Modified : Security

Configuration

EVID 5046 : IPSEC Crypto Set Added

Sub Rule

Configuration Loaded : Security

Configuration

EVID 5045 : IPSEC Connection Security Rule Deleted

Sub Rule

Configuration Deleted : Security

Configuration

EVID 5044 : IPSEC Conn Security Rule Modified

Sub Rule

Configuration Modified : Security

Configuration

EVID 5043 : IPSEC Connection Security Rule Added

Sub Rule

Configuration Loaded : Security

Configuration

EVID 5042 : IPSEC Authentication Set Deleted

Sub Rule

Configuration Deleted : Security

Configuration

EVID 5041 : IPSEC Authentication Set Modified

Sub Rule

Configuration Modified : Security

Configuration

EVID 5040 : IPSEC Authentication Set Added

Sub Rule

Configuration Loaded : Security

Configuration

EVID 4982 : IPSEC Security Mode Assoc Established

Sub Rule

Trust Relationship Established

Access Granted

EVID 4981 : IPSEC Security Mode Assoc Established

Sub Rule

Trust Relationship Established

Access Granted

EVID 4980 : IPSEC Security Mode Assoc Established

Sub Rule

Trust Relationship Established

Access Granted

EVID 4979 : IPSEC Security Mode Assoc Established

Sub Rule

Trust Relationship Established

Access Granted

EVID 4956 : Firewall Changed Active Profile

Sub Rule

Configuration Modified : Security

Configuration

EVID 4950 : Firewall Settings Changed

Sub Rule

Configuration Modified : Security

Configuration

EVID 4949 : Firewall Settings Restored To Default

Sub Rule

Configuration Modified : Security

Configuration

EVID 4948 : Firewall Exception Rule Deleted

Sub Rule

Configuration Deleted : Security

Configuration

EVID 4947 : Firewall Exception Rule Modified

Sub Rule

Configuration Modified : Security

Configuration

EVID 4946 : Firewall Exception Rule Added

Sub Rule

Configuration Loaded : Network Access

Configuration

EVID 4937 : Lingering Object Removed From Replica

Sub Rule

Configuration Deleted : System

Configuration

EVID 4934 : AD Object Attributes Replicated

Sub Rule

AD Object Attributes Replicated

Information

EVID 4930 : AD Replica Src Naming Context Modified

Sub Rule

Configuration Modified : Directory Services

Configuration

EVID 4929 : AD Replica Src Naming Context Removed

Sub Rule

Configuration Deleted : Directory Services

Configuration

EVID 4928 : AD Replica Src Naming Context Estab

Sub Rule

Configuration Loaded : Directory Services

Configuration

EVID 4908 : Special Groups Logon Table Modified

Sub Rule

Configuration Modified : Security

Configuration

EVID 4905 : Sec Event Source Un-Registered

Sub Rule

Configuration Disabled : Security

Configuration

EVID 4904 : Sec Event Source Registered

Sub Rule

Configuration Enabled : Security

Configuration

EVID 4892 : Cert Svcs Property Changed

Sub Rule

Configuration Modified : Application

Configuration

EVID 4891 : Cert Svcs Config Entry Changed

Sub Rule

Configuration Modified : Application

Configuration

EVID 4890 : Cert Svcs Settings Changed

Sub Rule

Configuration Modified : Application

Configuration

EVID 4794 : DS Restore Mode Admin Password Set

Sub Rule

Configuration Modified : Security

Configuration

EVID 4702 : Scheduled Task Updated

Sub Rule

Configuration Enabled : System

Configuration

EVID 4701 : Scheduled Task Disabled

Sub Rule

Configuration Disabled : System

Configuration

EVID 4700 : Scheduled Task Enabled

Sub Rule

Configuration Enabled : System

Configuration

EVID 4699 : Scheduled Task Deleted

Sub Rule

Configuration Deleted : System

Configuration

EVID 4698 : Scheduled Task Created

Sub Rule

Configuration Enabled : System

Configuration

EVID 4697 : Service Installed

Sub Rule

Software Installed

Configuration

EVID 4667 : Application - Client Context Deleted

Sub Rule

Configuration Deleted : Application

Configuration

EVID 4665 : Application - Client Context Created

Sub Rule

Configuration Enabled : Application

Configuration

EVID 4622 : Security Package Loaded By SAM

Sub Rule

Configuration Loaded : Security

Configuration

EVID 4648 : Logon Using Explicit Credentials

Sub Rule

User Logon

Authentication Success

EVID 4647 : Logoff

Sub Rule

User Logoff

Authentication Success

EVID 4634 : Logoff

Sub Rule

Authentication Activity

Authentication Success

EVID 4624 : Authentication

Sub Rule

User Logon

Authentication Success

EVID 4773 : Kerberos Service Ticket Request Failed

Sub Rule

Authentication Failure Activity

Authentication Failure

EVID 4772 : Kerberos Ticket Request Failed

Sub Rule

Authentication Failure Activity

Authentication Failure

EVID 4771 : Failed Pre-Authentication

Sub Rule

Authentication Failure Activity

Authentication Failure

EVID 4625 : Authentication Failure

Sub Rule

Authentication Failure Activity

Authentication Failure

EVID 4649 : Replay Attack

Sub Rule

General Attack Activity

Attack

EVID 6280 : User Account Unlocked

Sub Rule

Account Unlocked

Access Granted

EVID 6279 : User Account Locked Out

Sub Rule

Account Locked

Access Revoked

EVID 4791 : Basic App Group Changed

Sub Rule

Group Attribute Modified

Account Modified

EVID 4784 : Basic App Group Changed

Sub Rule

Group Attribute Modified

Account Modified

EVID 4781 : Account Name Change

Sub Rule

User Account Name Modified

Account Modified

EVID 4767 : User Account Unlocked

Sub Rule

Account Unlocked

Access Granted

EVID 4764 : Group Type Changed

Sub Rule

Group Attribute Modified

Account Modified

EVID 4760 : Universal Dstr Grp Changed

Sub Rule

Group Attribute Modified

Account Modified

EVID 4755 : Universal Sec Grp Changed

Sub Rule

Group Attribute Modified

Account Modified

EVID 4750 : Global Dstr Grp Changed

Sub Rule

Group Attribute Modified

Account Modified

EVID 4745 : Local Dstr Grp Changed

Sub Rule

Group Attribute Modified

Account Modified

EVID 4742 : Computer Account Changed

Sub Rule

Computer Account Attribute Modified

Account Modified

EVID 4740 : User Account Locked Out

Sub Rule

Account Locked

Access Revoked

EVID 4738 : User Account Changed

Sub Rule

User Account Attribute Modified

Account Modified

EVID 4737 : Global Security Group Changed

Sub Rule

Group Attribute Modified

Account Modified

EVID 4735 : Local Security Group Changed

Sub Rule

Group Attribute Modified

Account Modified

EVID 4725 : User Account Disabled

Sub Rule

Account Disabled

Access Revoked

EVID 4724 : Password Reset

Sub Rule

Password Modified

Account Modified

EVID 4723 : Password Change Attempted

Sub Rule

Password Modified

Account Modified

EVID 4722 : User Account Enabled

Sub Rule

Account Enabled

Access Granted

EVID 4792 : LDAP Query Group Deleted

Sub Rule

Group Deleted

Account Deleted

EVID 4789 : Basic App Group Deleted

Sub Rule

Group Deleted

Account Deleted

EVID 4763 : Universal Dstr Grp Deleted

Sub Rule

Group Deleted

Account Deleted

EVID 4758 : Universal Sec Grp Deleted

Sub Rule

Group Deleted

Account Deleted

EVID 4753 : Global Dstr Grp Deleted

Sub Rule

Group Deleted

Account Deleted

EVID 4748 : Local Dstr Grp Deleted

Sub Rule

Group Deleted

Account Deleted

EVID 4743 : Computer Account Deleted

Sub Rule

Computer Account Deleted

Account Deleted

EVID 4734 : Local Security Group Deleted

Sub Rule

Group Deleted

Account Deleted

EVID 4730 : Global Security Group Deleted

Sub Rule

Group Deleted

Account Deleted

EVID 4726 : User Account Deleted

Sub Rule

User Account Deleted

Account Deleted

EVID 4790 : LDAP Query Group Created

Sub Rule

Group Created

Account Created

EVID 4783 : Basic App Group Created

Sub Rule

Group Created

Account Created

EVID 4759 : Universal Dstr Grp Created

Sub Rule

Group Created

Account Created

EVID 4754 : Universal Sec Grp Created

Sub Rule

Group Created

Account Created

EVID 4749 : Global Dstr Grp Created

Sub Rule

Group Created

Account Created

EVID 4744 : Local Dstr Grp Created

Sub Rule

Group Created

Account Created

EVID 4741 : Computer Account Created

Sub Rule

Computer Account Created

Account Created

EVID 4731 : Local Security Group Created

Sub Rule

Group Created

Account Created

EVID 4727 : Global Security Group Created

Sub Rule

Group Created

Account Created

EVID 4720 : User Account Created

Sub Rule

User Account Created

Account Created

EVID 6278 : Network Policy Server Granted Access

Sub Rule

Access Granted Activity

Access Granted

EVID 6277 : Network Policy Server Granted Access

Sub Rule

Access Granted Activity

Access Granted

EVID 6272 : Network Policy Server Granted Access

Sub Rule

Access Granted Activity

Access Granted

EVID 5890 : COM+ Object Added

Sub Rule

Object Added

Access Success

EVID 5889 : COM+ Object Deleted

Sub Rule

Object Deleted/Removed

Access Success

EVID 5888 : COM+ Object Modified

Sub Rule

Object Modified

Access Success

EVID 5141 : Directory Service Object Deleted

Sub Rule

Object Deleted/Removed

Access Success

EVID 5140 : Network Share Object Accessed

Sub Rule

Object Accessed

Access Success

EVID 5139 : Directory Service Object Moved

Sub Rule

Object Moved

Access Success

EVID 5138 : Directory Service Object Restored

Sub Rule

Directory Service Object Restored

Other Audit Success

EVID 5137 : Directory Service Object Created

Sub Rule

Object Created

Access Success

EVID 5136 : Directory Service Object Modified

Sub Rule

Object Modified

Access Success

EVID 5061 : Cryptographic Operation

Sub Rule

Cryptographic Operation

Other Audit Success

EVID 5059 : Key Migration Operation

Sub Rule

Key Migration Operation

Other Audit Success

EVID 5058 : Key File Operation

Sub Rule

Key File Operation

Other Audit Success

EVID 5051 : File Virtualized

Sub Rule

File Virtualized

Other Audit Success

EVID 5039 : Registry Key Virtualized

Sub Rule

Registry Key Virtualized

Other Audit Success

EVID 4782 : Password Hash Accessed

Sub Rule

Object Accessed

Access Success

EVID 4695 : Auditable Protected Data Unprotected

Sub Rule

Auditable Protected Data Unprotected

Other Audit Success

EVID 4694 : Auditable Protected Data Protected

Sub Rule

Auditable Protected Data Protected

Other Audit Success

EVID 4693 : Data Protection Master Key Recovered

Sub Rule

Data Protection Master Key Recovered

Other Audit Success

EVID 4692 : Data Protection Master Key Backed Up

Sub Rule

Data Protection Master Key Backup Attempt

Other Audit Success

EVID 4691 : Indirect Object Access

Sub Rule

Object Accessed

Access Success

EVID 4674 : Privileged Object Operation

Sub Rule

Object Accessed

Access Success

EVID 4673 : Privileged Service Called

Sub Rule

Object Accessed

Access Success

EVID 4668 : Application Initialization Failed

Sub Rule

Application Initialization Failed

Critical

EVID 4668 : Application Initialized

Sub Rule

Object Initialized

Access Success

EVID 4666 : Application Operation Failed

Sub Rule

Command Execution Failure

Access Failure

EVID 4666 : Application Operation

Sub Rule

Application Operation

Other Audit Success

EVID 4664 : Hard Link Creation Attempt

Sub Rule

Hard Link Creation Attempt

Other Audit Success

EVID 4662 : Failed Object Operation

Sub Rule

Failed Object Operation

Error

EVID 4662 : Object Operation

Sub Rule

Object Operation

Other Audit Success

EVID 4660 : Object Delete Failed

Sub Rule

Delete/Remove Object Failure

Access Failure

EVID 4659 : Object Opened For Delete

Sub Rule

Object Deleted/Removed

Access Success

EVID 4657 : Registry Value Modification Failed

Sub Rule

Modify Object Failure

Access Failure

EVID 4656 : Object Open Failed

Sub Rule

Access Object Failure

Access Failure

EVID 4656 : Object Opened

Sub Rule

Object Read

Access Success

EVID 4870 : Cert Svcs Revoked Certificate

Sub Rule

Access Revoked Activity

Access Revoked

EVID 4788 : Non-Member Removed Basic App Group

Sub Rule

Account Removed From Group

Access Revoked

EVID 4786 : Usr Removed From Basic App Group

Sub Rule

Account Removed From Group

Access Revoked

EVID 4762 : User Rmvd From Univ Dstr Grp

Sub Rule

Account Removed From Group

Access Revoked

EVID 4757 : Usr Rmvd From Univ Sec Grp

Sub Rule

Account Removed From Group

Access Revoked

EVID 4752 : Usr Rmvd From Global Dstr Grp

Sub Rule

Account Removed From Group

Access Revoked

EVID 4747 : User Rmvd From Local Dstr Grp

Sub Rule

Account Removed From Group

Access Revoked

EVID 4733 : Usr Rmvd From Local Sec Grp

Sub Rule

Account Removed From Group

Access Revoked

EVID 4729 : User Removed Glbl Security Group

Sub Rule

Account Removed From Group

Access Revoked

EVID 4718 : Sys Sec Access Removed

Sub Rule

Access Revoked Activity

Access Revoked

EVID 4705 : User Right Removed

Sub Rule

User Account Attribute Modified

Account Modified

EVID 4887 : Cert Svcs Issued Certificate

Sub Rule

Certificate Services Issued Certificate

Information

EVID 4787 : Non-Member Added Basic App Group

Sub Rule

Account Added To Group

Access Granted

EVID 4785 : Usr Added To Basic App Group

Sub Rule

Account Added To Group

Access Granted

EVID 4761 : Usr Added To Univ Dstr Grp

Sub Rule

Account Added To Group

Access Granted

EVID 4756 : Usr Added To Univ Sec Grp

Sub Rule

Account Added To Group

Access Granted

EVID 4751 : Usr Added Global Dstr Grp

Sub Rule

Account Added To Group

Access Granted

EVID 4746 : User Added Local Dstr Group

Sub Rule

Account Added To Group

Access Granted

EVID 4732 : Usr Added To Local Sec Grp

Sub Rule

Account Added To Group

Access Granted

EVID 4728 : User Added Glbl Security Grp

Sub Rule

Account Added To Group

Access Granted

EVID 4717 : Sys Sec Access Granted

Sub Rule

Access Granted Activity

Access Granted

EVID 4704 : User Right Assigned

Sub Rule

Privilege Granted

Access Granted

EVID 6273 : Network Policy Server Denied Access

Sub Rule

Access Object Failure

Access Failure

EVID 5060 : Verification Operation Failed

Sub Rule

Command Execution Failure

Access Failure

EVID 4671 : App Blocked Ordinal Access Attempt

Sub Rule

Access Object Failure

Access Failure

EVID 1102 : Audit Log Cleared

Sub Rule

Log Cleared

Access Success

EVID 1100 : Logging Service Shut Down

Sub Rule

Process/Service Stopping

Startup and Shutdown

EVID 4797 : Query For Blank Password

Sub Rule

Query Information

Information

EVID 5380 : Vault Find Credential

Sub Rule

MS Windows User Rights Access Credential

Other Audit

EVID 5382 : Credential Were Read

Sub Rule

Object Read

Access Success