AD FS Auditing

Event	Title	Channel	Sample	Rule
299	Event ID 299	Security	Y	N
307	Event ID 307	Security	Y	N
309	Event ID 309	Security	Y	N
324	Event ID 324	Security	Y	N
403	Event ID 403	Security	Y	N
404	Event ID 404	Security	Y	N
410	Event ID 410	Security	Y	N
411	Event ID 411	Security	Y	N
412	Event ID 412	Security	Y	N
413	Event ID 413	Security	Y	N
431	Event ID 431	Security	Y	N
500	Event ID 500	Security	Y	N
501	Event ID 501	Security	Y	Y
510	Event ID 510	Security	Y	N
1026	Event ID 1026	Security	Y	N
1030	Event ID 1030	Security	Y	N
1034	Event ID 1034	Security	Y	N
1090	Event ID 1090	Security	Y	N
1122	Event ID 1122	Security	Y	N
1126	Event ID 1126	Security	Y	N
1200	Event ID 1200	Security	Y	N
1201	Event ID 1201	Security	Y	N
1202	Event ID 1202	Security	Y	N
1203	Event ID 1203	Security	Y	N
1206	Event ID 1206	Security	Y	N

Event ID 299

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 299,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:09:23.769691+00:00",
    "event_record_id": 16632717,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11000
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "dfe08855-560f-41ef-aece-7943c7ce16a4",
    "Data_1": "ed63d0a9-7eb6-4970-a801-522c0914427d",
    "Data_2": "https://testrp4.example.com/claims",
    "Binary": ""
  },
  "message": ""
}

Event ID 307

Channel: Security
Collection Priority: Recommended (ASD)

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 307,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:04:29.340795+00:00",
    "event_record_id": 16606140,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 7996
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "c914da25-f07c-47a3-9e7b-d6e78d43f334",
    "Data_1": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "Data_2": "ludus\\domainadmin",
    "Binary": ""
  },
  "message": ""
}

Event ID 309

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 309,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:03:42.728019+00:00",
    "event_record_id": 16595119,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11000
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Data_0": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "Data_1": "ludus\\domainadmin",
    "Data_2": "    ConfigurationServiceAddress : net.tcp://localhost:1500/policy\r\n    ConfigurationDatabaseConnectionString : \r\n    ChannelMaxMessageSizeInBytes : 0\r\n",
    "Data_3": "    ConfigurationServiceAddress : net.tcp://localhost:1500/policy\r\n    ConfigurationDatabaseConnectionString : Data Source=np:\\\\.\\pipe\\microsoft##wid\\tsql\\query;Initial Catalog=AdfsConfigurationV4;Integrated Security=True\r\n    ChannelMaxMessageSizeInBytes : 20971520\r\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 324

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 324,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:37.247311+00:00",
    "event_record_id": 16621764,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "06aae50c-7a71-4208-a1b5-e4bd41408c7f",
    "Data_1": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_2": "ludus\\domainadmin\r\n",
    "Data_3": "https://testrp1.example.com/saml",
    "Binary": ""
  },
  "message": ""
}

Event ID 403

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Data_7`
`Data_8`
`Data_9`
`Data_10`
`Data_11`
`Data_12`
`Data_13`
`Data_14`
`Data_15`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 403,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.480193+00:00",
    "event_record_id": 16621720,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "d97c5901-104e-4ce1-a4f7-db055d721953",
    "Data_1": "015df8f6-5754-48e9-1300-00400a0000ff",
    "Data_2": "2026-03-13 23:07:36",
    "Data_3": "10.2.10.11",
    "Data_4": "GET",
    "Data_5": "/adfs/.well-known/openid-configuration",
    "Data_6": "-",
    "Data_7": "443",
    "Data_8": "10.2.10.11",
    "Data_9": "-",
    "Data_10": "0",
    "Data_11": "-",
    "Data_12": "-",
    "Data_13": "-",
    "Data_14": "False",
    "Data_15": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 404

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 404,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.570719+00:00",
    "event_record_id": 16621723,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "11a30859-37ab-4075-9ee9-df451c9ccf38",
    "Data_1": "015df8f6-5754-48e9-1300-00400a0000ff",
    "Data_2": "2026-03-13 23:07:36",
    "Data_3": "200",
    "Data_4": "OK",
    "Binary": ""
  },
  "message": ""
}

Event ID 410

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Data_7`
`Data_8`
`Data_9`
`Data_10`
`Data_11`
`Data_12`
`Data_13`
`Data_14`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 410,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.495811+00:00",
    "event_record_id": 16621722,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "015df8f6-5754-48e9-1300-00400a0000ff",
    "Data_1": "X-MS-Client-Application",
    "Data_2": "-",
    "Data_3": "X-MS-Client-User-Agent",
    "Data_4": "-",
    "Data_5": "client-request-id",
    "Data_6": "-",
    "Data_7": "X-MS-Endpoint-Absolute-Path",
    "Data_8": "/adfs/.well-known/openid-configuration",
    "Data_9": "X-MS-Forwarded-Client-IP",
    "Data_10": "-",
    "Data_11": "X-MS-Proxy",
    "Data_12": "-",
    "Data_13": "X-MS-ADFS-Proxy-Client-IP",
    "Data_14": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 411

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 411,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:36.815622+00:00",
    "event_record_id": 16621740,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11176
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "fcdc6f25-76f3-4bc2-b0eb-7efebd19bd6c",
    "Data_1": "http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/UserName",
    "Data_2": "fakeuser-The user name or password is incorrect",
    "Data_3": "System.IdentityModel.Tokens.SecurityTokenValidationException: fakeuser ---> System.ComponentModel.Win32Exception: The user name or password is incorrect\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUserHandle(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, SafeCloseHandle& tokenHandle, SafeLsaReturnBufferHandle& profileHandle)\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUserInfo(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String authenticationType, String issuerName)\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUser(String domain, String username, String password, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String issuerName)\r\n   at Microsoft.IdentityServer.Service.LocalAccountStores.ActiveDirectory.ActiveDirectoryCpTrustStore.ValidateUser(IAuthenticationContext context)\r\n   --- End of inner exception stack trace ---\r\n   at Microsoft.IdentityServer.Service.LocalAccountStores.ActiveDirectory.ActiveDirectoryCpTrustStore.ValidateUser(IAuthenticationContext context)\r\n   at Microsoft.IdentityServer.Service.Tokens.MsisLocalCpUserNameSecurityTokenHandler.ValidateTokenInternal(UsernameAuthenticationContext usernameAuthenticationContext, SecurityToken token)\r\n   at Microsoft.IdentityServer.Service.Tokens.MsisLocalCpUserNameSecurityTokenHandler.ValidateToken(SecurityToken token)\r\n\r\nSystem.ComponentModel.Win32Exception (0x80004005): The user name or password is incorrect\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUserHandle(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, SafeCloseHandle& tokenHandle, SafeLsaReturnBufferHandle& profileHandle)\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUserInfo(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String authenticationType, String issuerName)\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUser(String domain, String username, String password, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String issuerName)\r\n   at Microsoft.IdentityServer.Service.LocalAccountStores.ActiveDirectory.ActiveDirectoryCpTrustStore.ValidateUser(IAuthenticationContext context)",
    "Data_4": "10.2.10.11",
    "Binary": ""
  },
  "message": ""
}

Event ID 412

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 412,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.856834+00:00",
    "event_record_id": 16621748,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "ef2825bb-1423-481d-8a2a-63d8bffc6bbe",
    "Data_1": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_2": "http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/UserName",
    "Data_3": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 413

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 413,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:37.253084+00:00",
    "event_record_id": 16621769,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_1": "ludus\\domainadmin\r\n",
    "Data_2": "-",
    "Data_3": "-",
    "Data_4": "https://testrp1.example.com/saml",
    "Data_5": "-",
    "Data_6": "10.2.10.11",
    "Binary": ""
  },
  "message": ""
}

Event ID 431

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 431,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.940716+00:00",
    "event_record_id": 16621755,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_1": "-",
    "Data_2": "http://schemas.microsoft.com/idfx/keytype/bearer",
    "Data_3": "http://schemas.microsoft.com/idfx/requesttype/issue",
    "Data_4": "-",
    "Data_5": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 500

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Data_7`
`Data_8`
`Data_9`
`Data_10`
`Data_11`
`Data_12`
`Data_13`
`Data_14`
`Data_15`
`Data_16`
`Data_17`
`Data_18`
`Data_19`
`Data_20`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 500,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:09:23.769691+00:00",
    "event_record_id": 16632718,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11000
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "dfe08855-560f-41ef-aece-7943c7ce16a4",
    "Data_1": "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod",
    "Data_2": "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
    "Data_3": "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant",
    "Data_4": "2026-03-13T23:09:23.704Z",
    "Data_5": "-",
    "Data_6": "-",
    "Data_7": "-",
    "Data_8": "-",
    "Data_9": "-",
    "Data_10": "-",
    "Data_11": "-",
    "Data_12": "-",
    "Data_13": "-",
    "Data_14": "-",
    "Data_15": "-",
    "Data_16": "-",
    "Data_17": "-",
    "Data_18": "-",
    "Data_19": "-",
    "Data_20": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 501

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Data_7`
`Data_8`
`Data_9`
`Data_10`
`Data_11`
`Data_12`
`Data_13`
`Data_14`
`Data_15`
`Data_16`
`Data_17`
`Data_18`
`Data_19`
`Data_20`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 501,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.856834+00:00",
    "event_record_id": 16621749,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "ef2825bb-1423-481d-8a2a-63d8bffc6bbe",
    "Data_1": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
    "Data_2": "ludus\\domainadmin",
    "Data_3": "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid",
    "Data_4": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "Data_5": "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid",
    "Data_6": "S-1-5-21-1006758700-2167138679-1475694448-513",
    "Data_7": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_8": "S-1-5-21-1006758700-2167138679-1475694448-513",
    "Data_9": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_10": "S-1-1-0",
    "Data_11": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_12": "S-1-5-32-555",
    "Data_13": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_14": "S-1-5-32-573",
    "Data_15": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_16": "S-1-5-32-545",
    "Data_17": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_18": "S-1-5-32-554",
    "Data_19": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_20": "S-1-5-32-574",
    "Binary": ""
  },
  "message": ""
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto # view in coverage

AD FS Abnormal EKU object identifier attribute source high: This detection uses Security events from the "AD FS Auditing" provider to detect suspicious object identifiers (OIDs) as part EventID 501 and specifically part of the Enhanced Key Usage attributes. This query checks to see if you have any new OIDs in the last hour that have not been seen in the previous day. New OIDs should be validated and OIDs that are very long, as indicated by the OID_Length field, could also be an indicator of malicious activity. In order to use this query you need to enable AD FS auditing on the AD FS Server. References: https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/ https://docs.microsoft.com/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-loggingT1552

Event ID 510

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Data_7`
`Data_8`
`Data_9`
`Data_10`
`Data_11`
`Data_12`
`Data_13`
`Data_14`
`Data_15`
`Data_16`
`Data_17`
`Data_18`
`Data_19`
`Data_20`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 510,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:04:29.340795+00:00",
    "event_record_id": 16606141,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 7996
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "c914da25-f07c-47a3-9e7b-d6e78d43f334",
    "Data_1": "Modify of a configuration object.\n\nConfiguration:\n    Type: ServiceSettings\n    Object ID: 863dfa3c-2755-4264-a651-e52ab76ff427\n    Name: ConfigurationSettings\n\n    Properties Replaced:\n        Property Name  : ServiceSettingsData\r\n        Property Value : \r\n            ServiceSettingsData\r\n                xmlns:i : http://www.w3.org/2001/XMLSchema-instance\r\n                xmlns : ",
    "Data_2": "http://schemas.datacontract.org/2012/04/ADFS\r\n                SecurityTokenService\r\n                    AdditionalEncryptionTokens\r\n                        CertificateReference\r\n                            IsChainIncluded\r\n                                false\r\n                            IsChainIncludedSpecified\r\n                                false\r\n                            FindValue\r\n      ",
    "Data_3": "                          01558C149B276D6BCECC61717C1291EB2EEFD21C\r\n                            RawCertificate\r\n                                ",
    "Data_4": "MIIE5DCCAsygAwIBAgIQWhuw5A0OGK5PnivlYq/ndzANBgkqhkiG9w0BAQsFADAuMSwwKgYDVQQDEyNBREZTIEVuY3J5cHRpb24gLSBhZGZzLmx1ZHVzLmRvbWFpbjAeFw0yNjAzMTMyMzAzNDVaFw0yNzAzMTMyMzAzNDVaMC4xLDAqBgNVBAMTI0FERlMgRW5jcnlwdGlvbiAtIGFkZnMubHVkdXMuZG9tYWluMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxTCUA/+UQOrvYAur7gQeLr+ShrHzQKWafQzKLxJmJlbcOQD2Lqk/+czQxbjkiwP1XDCXKC93ERf7Rjjd+nb4d2S8AysFOzfVUYyZM4WZ/trc4I3isb0pr8q9z4EV",
    "Data_5": "dL8l9zaKBJn4qYQYrk4oi6Wuue4MtZWDkSoxvyywk++TVvPDR+Cjy+wpKgPP2o3isCjahN4c6DYf0Cyc4QBqbgBdhUqidxPkYcQurqFr7Pd41wNsNk+SWthBFilaHzYfTZcL5cElqPjNtKauPhbwXLdV1H8lqB3AHk78wQ+OsGYNB4Vxylh+Ww6kTZjv1zH2r+Lvyj4WOFUX+01JfebeyjkGCMZRHQVYaD20kEWQ5zkv5dNcnl4vMDkbXovYm5PEz5kK7cNlQcsfMV903oh1BuBBWyOht5T0MV6qdPyLSRjdq3ylfWj4p8SgrwKHqzhp/WJYdoE/FyM3LNoFxajqTX+pf5HNFmfd4vekV/yye6z9KXXgVex9iU4UBl9RKBK2s8F6chuK4qUBHgP8",
    "Data_6": "8BlLVJoAshcMrOJcRy8TmxknyuPI0/MiCpZ6RtmuUr/yhtqc9s66vBF2nPibd5GVFu98eq1dhxEOmwSLlRmigRKXBYQOVXpM/XkiE7PyqT4iaCQwvBRB/91YvgOEPORMJjRzHcm7Je9tY5cQ4XfQ/Y0za/8519kCAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAHBkYJW0/us0tQT7d+3UCpTppvK/Eu7cxvvC4zcvBLcsulg8Z1xdYOz0rnh/R83BhQ6WrChoS2Nimqk9YJurhXEGUo8X8BTVipQIM/sZ0Oz87W35VcEknCiVuGXfs9PdEQyA5Yg3F77J+qwoVkpWLObEWnzZMBSL7tc1jUOAXH+cClMBejvcylltwDPOBmBkOa1QOB2+A1DOOLsgX",
    "Data_7": "u1OCPG6bs+beIpinpULFVul4jhQi/Vui774xKLO7wIjxL7TGKPScmj8S9JvmrE4/YRVTFvllDAcIvi04kp1hjoj8wg63O4SUbnW2ysfQR1IXafIupHTNATzarIVJJEFRBYjwgczkcgolezzkcXx0uaTQw8J/ihuZHexyESx87Prf36PjpSyg7y4R7XlmBd3bHoxp+9fDmA/69Nm6v0sDEfpNYQ0xm5+Bc7mbtTpaUXsy49CB6FWp35xL6Plm/PFLnrhnT/tyXAgwDLeqcGkwYFkd6gJsQx/nYuYN7zRGz4kDnt/Vr3EdhAW4Wc9XD8Y4OTGHd3vBQbcPCfm2732R0gdtce2r42xvRXYSYZwS7AYqOWRupBbxmfMx6Fy4Ik/41M/Q6cHUIkZ/eB7j",
    "Data_8": "Kzxxvy0YKTSEc0hWOndcb/LDXiaB61WZu1ZW8YUy5SjQfZ2/ei+X70O6Z0F+nw8ITTei8ntTNG8=\r\n                            EncryptedPfx\r\n                                ",
    "Data_9": "AAAAAQAAAAAEEDEBQeN1uZlCqft6FErqM0wGCWCGSAFlAwQCAQYJYIZIAWUDBAIBBglghkgBZQMEAQIEIC6Q+/c54AD4ScU7ZszEEhMO8+Gsl1aM3Gpq9H6M8Z1kBBCOOzSqGbXoD5gYdaS4I3lYIIIQoKp62gOK56pS/oApdd6cd9aADWn6Q9sBk7phR6G2s3l+vM3JYW4Lo9qgudOl/bEoCMZxTeymcSkNgzUMU+hiE4ilugl4uxUon9u185N+XuamuTyKBXsIxSUEAXRXWUSyccUdujvzA84gUFBknWc9499q3MOl/EcvKxSOjH+pqwNSQMH+8cJ97h1FTCOnApLnmYgEARpNmerlaE9x1LxVqVCnNiHLN8CNbkjgpR3VgFCTkZUEBubrDebd",
    "Data_10": "zuQYyPS+X+7uGwAIa3QsgW8rXGLw7CMxyxZD632hMBCrdDNEhko092JcjXjxU24MisINXOEwRueEKdXXHsBwpgzrxw9IAo2q2geJzdS4VLRPjFjey8Janxixv4alQahF0yfygDSFxDiBXckZJMThhIJxWhcgfJ593H9QgVon5AZT+LMimooTmoXxPuasd6DwF6IJmsPTZr4FxAB19ow5dPV3/deyAYTATBw+E1fYf6bfEhtNFLMPLgXI8tMdCN5FBhzYuOhSfLc9z7PMXD/zgDS94e2qAPGu+Kbe7d4tLsFG5YKOwdXJyTocA3qbJLv8tnxCEzJlT5c1dshiHwa1eqmJTzRxV7LweLqZ4HE8uLqVP+4i/O2ryeLjvTXpkuE2Q1nxWluY9R/hpRfp",
    "Data_11": "qI2zS4L6gks6+QdcHA2Io+4QvWpyw3wNpt3wzxR9PZeRTx0UwmCMDB6RVOp0x+sf6ryKpPAv0m6/zm5oYPtBbqM1wQCzEOBCTNnMTy1G43T2wZDIgygF7IQPK/h1Q3ih9e8RusQzOHukxeuVp8YqEERtCAUGdBsLbun9osYzRBpxVsSG/3aYiu7w4o+4dSwJ2hMi2T7h2yvnycHl4oKE1MvLFK/Cg8jZcNooiC7js0Bsln4BoSqAMh2HJ7nl7Io/TH5gJnrJUvMX+8JtSr7vlroKjINGzYbhwCyiWIYUf7TDx39evbx83mXAEFquczB//jzqBcRfk7yyqmQ+3X4A1Rvb4pmsjwFxCHwd4tdbVzjstQsDV9BbGBE4xUEcF8WwtIyECq1xRxYFX2rU",
    "Data_12": "JKES5wRp+R64ixTbpl9AugvdWkAQlkBh+TFCIKCK3qqSTt0fWjFG7WROs3RMJO4GbsWXV8vsMxHwtBpqO4TxtxSYmpgzD1aUSdXy+AWcYFF43xVy5IFZKAMEzt2QOKy5O5Gq23HidfF3PTOb+i8JCLhWk/QsMMRBlL6OTjT/kKY+ttDyY1Oo1V9yjqj1FHIjkQ7tuXa3E4N4LnQiz3L4sJfGoSt5QSfAjXjJJMtWcyy6QTyS5hF280oivwQ9DsfC3vgU2lj9JDKcqp/2ijvn22SEaa4wIejO0mSS4k46KS8cRE+0V68jJ7yY0knoQiXzESmbEIkEBt0bUT1tw0lqHucExj094rXx3r8oPw5R1+I7N5d0iSNDp8R1+Ic10giZFSof4eamQWq4nfzA",
    "Data_13": "NPu5+JbxokEnSdLm8ASwwlKdfRNtXUT+WAQhDE4PimppXcQd7JhyVVVu1s1O4abvjsuzUOuNeDhe5vW4YgNL+jE7GoVJsd5ypughNFLST9HkrCCmkp6LqY/CPEz2gZXwLTbDg8cv3tD+pJWG9N34wmTMvnKEGB3RZPTdWfWghUYN4JpdHRpK/YCkDjlkSJPyVwSRWU08kz+Qx2D2M07uEUBrGk5ArT27KBMfSHzd42SwmqHuMruJ26Ns92YTLMOk3sqSkDOiKVwxq7M7vcMHU8k7OVfGpmplJy3r+PLfpHHhFSMAA9L+eYLRTdcZRFlH7lmHnJPezK7c6FCUrq9EfZkW20P19RmshjZ020KEcMTz5k+7n8Tz8sF3Ggs6Z6EDgLpr/dwiDMi6390B",
    "Data_14": "XSwz0B5xn4ne+lSQ4ODl7BMXIgqkUSlzp5Scb8NluBIsXrXVsRK5ckWQJDPhw5kzL6A3M213+nWbJtXiyeHy7sV0t8CuROMJgk+Hl9QVg+WG3Ud3zDPRMWhwJOL2dqAwtBwTtTCTR8YIFoq1cX6nl0k7ng4mgnLzkomVSOD0JYYrSMQDEHEt+42WDR0Q0hUnQavDncbbcreXxXjeLk54B16bg/ucb/dFgL30bDC16qpJ9Hlh5fwUA2QYDf2+ZAR6wGVr/OSWaGG6GTbSYstKRKQ+CXqHp8gArNe4xR0PARYMtTUObGFCZ0vCpqguuSvTCjginfZdXbfCA2ONLsaamU3BXyYlCWpIJYP6ie8JQ66H87SJKlpNHE5uYZ+0+BMwpzCXlRjDHSdLUr8W",
    "Data_15": "DvQLrv5n+5IW4kbRod34UXv/dNGNgifUxDqRKEjkqiSS6fyqoczVbchriJg4ccn0RyGvlMT8StJ5NwOhxhkHUfR5LyTzGNK0aqInKlRVkCC8AifCQTqdRrGr7yuTg0FjrWh4FKEvXVdo/On3C/CAl5I3ExuXstVW0NLeWLKnBsLYhWCmo+YIQwBtgcghLnwz9LGroPw7ndEqTpLY1j4VUPlJw06NstWqCt8pYAmG1dwZXAHQfr2AHx7V5SlLzYcIjPo8YN1kQUf8Jb1+hh88VFOnq9hVgHZKL1vKARl1ENO/2F5jkpUqhjn2Rp2ydJUGYABN75cCtyqg87KbXNIXwanpqvwi1BiJQFSCyyoD3hV07mhL/2Q7NHgmjUsL/4SWO4BvoWmigVw7OYGL",
    "Data_16": "+4ovjQrbPApDhlenJv5UUmGMSRXk0vvdeOAm2ZmjZkvoGXygzF9lkkZd8b6wUDvIEzx8Q3FxjhgcCFrff1S+Ro4x7MaMq5A1OHKfEv9HHHRDrAy31ZKxkOmKJFSKsdO2NkZOs0gEqxPJLfAWKoMpzAs6n/JYLat6gu3WRL0ByiPscb8u4UUN8PbBgyrsWOQzsc27B/QA1WVX8k8yFbektCx40ynN2RVwVud4ymwgyt11+e0ApkmNvABZjI3TnAtbrCTujalsiTwcFuM/ulBqPJavdp/0ZOFU4ztMKxigucphfFwiHL14z5Khd1z6m9Uc0zslFWCoaIERGlwQBfLnEeOzrIW9Zw8jCvE6WtbuPa3P1gsA4G4nPYSy193eP7xX4SRvnEaqbCTFU/7C",
    "Data_17": "CvaTZyuiuKMQRD/+XOU7vKVs4fc1tMirHY+2AZDNE/+ngnh0ZaU69XoPBpJhSksJdgNhx7hrEaZDErQjkVlK5jsq8x9KEceN9ZYv+Jva4SnERhyXOX5S7fU1pt6Wso7/iv7CY/OdZAlvMpNyWCLUjz9Zq9CzpDG7iIWYpDK/dRK9gO8SmioUtXqB99GTGOAfyr3owC4zw1oV8zDu//n2rIP6NzlRgvsawMSuK1P0si1sw1Gq+e0hcHhyfbOYw6lAT2uw5BbXnPV3MmR2ksfrQwCDQXPZ0uVO8ZDdY5k74cBV1DBqxtlBOY3p+6YDZA1CxEmY849+ce1h0ZynsgdJyFRbTRuH7gjPkQDABcqq94HZ/bhh80inLBU8wNQNbRk/ssLftR9ykPIEV1tl",
    "Data_18": "+Um46B48tlZc442sS6WOipJHAYI7sZ1YJ1wK5ybZdDttlbdFFDxUQvIMIIK7PIEfGMG3dJiaL2m3HJFd9PTmm1+tf1V0Hab/ivMrlnjBQRnrYIYKtuctjY5TU3jUwgI9e8H7/yYhFFmcdAQ2VtasnD2Ri4q9qXXD617F4ERKaZ/sxbU6hgrCnJVg9yAG5mmgyVIQlpi0gy86nly/jQ/FwskF1spKpvtPsn2srixjJBaND2zHntL4pZsVdIyzDx2SGP5hGQY8rynH1jidLx2d5NZnwgcu1zlNxRuX8cwTGtbv2svSBlnVIZzEVtOLg8hM0Wx5/trs99DA+HjTFPupV1AX2sWSxdF5/wkRNmg52PINUUJ8RRIC+ayN42DVXPZVUqYvaVWghdTn6c5Y",
    "Data_19": "VG45kGQRlaDiNH7PYrY7UUUqokzavw7GFJnRBqMei7RSqlHGsUrjUBXw5E7FFkuqpqMyT4IKD8j9jvJFjakrDQpHC4Max4aM+G7Uh4VkmLwLADaEfVp+Umfq58FDyZnWQnhcYr+7I3mX/4ogPJxUiVjnFXLA3PsuVRPHV4Hb8EsFkHjXjNMQoXZ4cwu8DB97cUSJ+uBRFACwrilEqHlCi4xaehkpWkKO2t7uCDA2gvnQz2SrovexCjznaPl6srkCcxZqun2ZHWfB0n6FaN/9fQLTHtdEHB+7kFm8D1PyfPAJpuXHoW1YNCC7dnq53hMIC39All0EXjX9DnzZS+exY6culHwaFn/KXWmifl4osmfTYu0Z99xtA1vUFkOFQPQBXD2P4JnxsJ5BPT9c",
    "Data_20": "AUNkPEI6P3EqkyJ+eT5nZ0kh2/6uXLZgzQkN+oC3V9tqEQzLw2hdvA65QsMG9DtuuARNSPYb1l6P33DS+/tSFlr/m24cafoq9uX3XxW4LMMDXUQrIiFa7fZ5pMC7BFb3VkA6lYasPC+KvAptfVuOFMYVwugyOcDJz/OTCazMwQMjG5xi4I5cQRBaKzWPFl8hpd4B8HcLB5C502do8x1/6djUq6JayL7/u/v9FZvz5ZlF9+RRrES346r+x+un2wVS4zZcP2TSgfgf9TBfjAil2SEsV8VivQ/SXnNYT+GS5efxeM3xa5aAA5VGPIEErpE9kDVvqjHvJKGi2XpirDf5n65T/pVfrkYjMHah1qyg8I25q4KRamwHMdvVgUXBbXPcSBq7GAbXZclunUPK",
    "Binary": ""
  },
  "message": ""
}

Event ID 1026

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Data_7`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1026,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:08:52.834431+00:00",
    "event_record_id": 16624207,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11176
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "2d2b5fdb-5717-4ed1-0300-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "fake",
    "Data_3": "https://localhost/cb",
    "Data_4": "-",
    "Data_5": "-",
    "Data_6": "-",
    "Data_7": "Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthInvalidClientException: MSIS9241: Received invalid OAuth access token request. The received 'client_id' is invalid as no registered client was found with this client identifier. Make sure that the client is registered. Received client_id: 'fake'. \r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthAccessTokenRequestContext.ValidateCore()\r\n   at Microsoft.IdentityServer.Web.Protocols.ProtocolContext.Validate()\r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthTokenProtocolHandler.PreAuthenticationProcess(ProtocolContext context)",
    "Binary": ""
  },
  "message": ""
}

Event ID 1030

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1030,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:36.668865+00:00",
    "event_record_id": 16621734,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "43ebe48f-e201-482c-1500-00400a0000ff",
    "Data_1": "10.2.10.11",
    "Data_2": "-",
    "Data_3": "nonexistent",
    "Data_4": "Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthInvalidClientException: MSIS9241: Received invalid OAuth access token request. The received 'client_id' is invalid as no registered client was found with this client identifier. Make sure that the client is registered. Received client_id: 'nonexistent'. \r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthTokenRequestContext.ValidateCore()\r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthClientCredentialsContext.ValidateCore()\r\n   at Microsoft.IdentityServer.Web.Protocols.ProtocolContext.Validate()\r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthTokenProtocolHandler.PreAuthenticationProcess(ProtocolContext context)",
    "Binary": ""
  },
  "message": ""
}

Event ID 1034

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1034,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:08:52.885864+00:00",
    "event_record_id": 16624228,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "e12e6b70-d9df-4a65-0600-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "-",
    "Data_3": "fake",
    "Data_4": "-",
    "Data_5": "Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthInvalidRequestException: MSIS9380: The 'requested_token_use' parameter is not specified. The access token request must contain the 'requested_token_use' parameter for 'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer'. \r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthOnBehalfOfContextBase.ValidateCore()\r\n   at Microsoft.IdentityServer.Web.Protocols.ProtocolContext.Validate()\r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthTokenProtocolHandler.PreAuthenticationProcess(ProtocolContext context)",
    "Binary": ""
  },
  "message": ""
}

Event ID 1090

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1090,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:08:53.172704+00:00",
    "event_record_id": 16624277,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "33d19343-e8af-4588-0d00-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "https://adfs.ludus.domain:443/adfs/userinfo",
    "Data_3": "Microsoft.IdentityServer.Web.Protocols.UserInfo.UserInfoMissingAccessTokenException: MSIS9914: Received invalid UserInfo request. Access token is not present in the request. The access token needs to be carried in Authorization Request Header Field or Form-Encoded Body Parameter.\r\n   at Microsoft.IdentityServer.Web.UserInfoListener.ParseRequest(WrappedHttpListenerContext context)\r\n   at Microsoft.IdentityServer.Web.UserInfoListener.OnGetContext(WrappedHttpListenerContext context)\r\n\r\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 1122

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1122,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:08:53.211424+00:00",
    "event_record_id": 16624283,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "26b7203e-f387-4b80-0e00-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "-",
    "Data_3": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 1126

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1126,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:08:53.142472+00:00",
    "event_record_id": 16624268,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "81f6458e-a9c1-4762-0c00-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "<null>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1200

Channel: Security
Collection Priority: Recommended (ASD)

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1200,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:09:23.769691+00:00",
    "event_record_id": 16632722,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11000
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "ed63d0a9-7eb6-4970-a801-522c0914427d",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"AppTokenAudit\">\r\n  <AuditType>AppToken</AuditType>\r\n  <AuditResult>Success</AuditResult>\r\n  <FailureType>None</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>https://testrp4.example.com/claims</RelyingParty>\r\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\r\n      <UserId>ludus\\domainadmin</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>http://adfs.ludus.domain/adfs/services/trust</Server>\r\n      <AuthProtocol>WsTrust</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1201

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1201,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:36.730824+00:00",
    "event_record_id": 16621737,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "43ebe48f-e201-482c-1500-00400a0000ff",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"AppTokenAudit\">\r\n  <AuditType>AppToken</AuditType>\r\n  <AuditResult>Failure</AuditResult>\r\n  <FailureType>CredentialValidationError</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>N/A</RelyingParty>\r\n      <ClaimsProvider>N/A</ClaimsProvider>\r\n      <UserId>N/A</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>N/A</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>N/A</Server>\r\n      <AuthProtocol>OAuth</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/oauth2/token</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1202

Channel: Security
Collection Priority: Recommended (ASD)

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1202,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.872525+00:00",
    "event_record_id": 16621752,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"FreshCredentialAudit\">\r\n  <AuditType>FreshCredentials</AuditType>\r\n  <AuditResult>Success</AuditResult>\r\n  <FailureType>None</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>N/A</RelyingParty>\r\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\r\n      <UserId>ludus\\domainadmin</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>N/A</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>http://adfs.ludus.domain/adfs/services/trust</Server>\r\n      <AuthProtocol>N/A</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1203

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1203,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:36.818834+00:00",
    "event_record_id": 16621741,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "fcdc6f25-76f3-4bc2-b0eb-7efebd19bd6c",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"FreshCredentialAudit\">\r\n  <AuditType>FreshCredentials</AuditType>\r\n  <AuditResult>Failure</AuditResult>\r\n  <FailureType>CredentialValidationError</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>N/A</RelyingParty>\r\n      <ClaimsProvider>N/A</ClaimsProvider>\r\n      <UserId>LUDUS\\fakeuser</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>N/A</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>http://adfs.ludus.domain/adfs/services/trust</Server>\r\n      <AuthProtocol>N/A</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1206

Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1206,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:08:53.223207+00:00",
    "event_record_id": 16624284,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "26b7203e-f387-4b80-0e00-0040080000f4",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"SignOutAudit\">\r\n  <AuditType>SignOut</AuditType>\r\n  <AuditResult>Success</AuditResult>\r\n  <FailureType>None</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>N/A</Server>\r\n      <AuthProtocol>N/A</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/oauth2/logout</Endpoint>\r\n    </Component>\r\n    <Component xsi:type=\"SignOutAuditComponent\">\r\n      <SignedInRPs>\r\n        <SignedInRPs>N/A</SignedInRPs>\r\n      </SignedInRPs>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}