Microsoft Defender for Endpoint

This inventory contains data from HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection. Last updated: 15 July 2026

Provider	Rule names	Bound event IDs
Anaheim-SmartScreen	UriLookup BreakTheGlass
Anti Tampering	ETW Provider tampering Process tampering Com tampering	Event ID 1 Event ID 2 Event ID 3
Application Error	UserCrashLog	Event ID 1000: Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.
AppLocker	Srp New Policy Applied AppLocker Process Audit AppLocker Process Block AppLocker Script Audit AppLocker Script Block AppLocker Appx Process Audit AppLocker Appx Process Block AppLocker Appx script Audit AppLocker Appx script Block Wldp Script File Audited Wldp Script File Disabled	Event ID 8001: The AppLocker policy was applied successfully to this computer. Event ID 8003: RuleAndFileData.FilePath was allowed to run but would have been prevented from running if the AppLocker policy were enforced. Event ID 8004: FilePathBuffer was prevented from running. Event ID 8006: FilePathBuffer was allowed to run but would have been prevented from running if the AppLocker policy were enforced. Event ID 8007: FilePathBuffer was prevented from running. Event ID 8021: PackageBuffer was allowed to run but would have been prevented from running if the AppLocker policy were enforced. Event ID 8022: PackageBuffer was prevented from running. Event ID 8024: PackageBuffer was allowed to run but would have been prevented from running if the AppLocker policy were enforced. Event ID 8025: PackageBuffer was prevented from running. Event ID 8028: FilePath was allowed to run but would have been prevented if the Config CI policy were enforced. Event ID 8029: FilePath was prevented from running due to Config CI policy.
AttackSurfaceMonitor	Device creation via AST Device IOCTL called
Audit-CVE	CveEventWrite	Event ID 1: Possible detection of CVE: PossibleDetectionOfCVE.
Bits-Client	EVT_JOB_CREATION EVT_JOB_CANCEL BITS_EV_JOB_CANCELLED BITS_EV_JOB_TAKE_OWNERSHIP EVT_JOB_ADDFILE	Event ID 3: The BITS service created a new job: jobTitle, with owner jobId. Event ID 5: Job cancelled. Event ID 16384: The administrator User canceled job "Title" on behalf of Owner. Event ID 16388: The administrator User took ownership of job "Title" from Owner. Event ID 16403: task_016403
Bluetooth-Policy	Bluetooth_PolicyServiceBlockAudit	Event ID 7: Bluetooth has Accepted service ServiceGuid on remote device BtAddr due to policy PolicyPath\PolicyName.
CodeIntegrity	CiRevokedDriverNotLoaded CiRevokedImageNotLoaded DeviceGuard policy failure audit DeviceGuard policy failure Code Integrity signature information Smartlocker Operational Success Smartlocker Operational Audit Smartlocker Operational Failure Activate Policy Succeded	Event ID 3023: The driver FileNameBuffer is blocked from loading as the driver has been revoked by Microsoft. Event ID 3036: Windows is unable to verify the integrity of the file FileNameBuffer because the signing certificate has been revoked. Event ID 3076: Code Integrity determined that a process (Process Name) attempted to load File Name that did not meet the Requested Signing Level signing level requirements or violated code integrity p... Event ID 3077: Code Integrity determined that a process (Process Name) attempted to load File Name that did not meet the Requested Signing Level signing level requirements or violated code integrity p... Event ID 3089: Signature information for another event. Event ID 3090: Code Integrity testing module FileName against policy PolicyName. Event ID 3091: Code Integrity testing module FileName against policy PolicyName. Event ID 3092: Code Integrity testing module FileName against policy PolicyName. Event ID 3099: Refreshed and activated Code Integrity policy PolicyGUID PolicyNameBuffer.
Crypto-DPAPI-Events	DPAPI Crypt Data	Event ID 16385: DPAPIDefInformationEvent
Dhcp-Client	DhcpAddressPlumbed DhcpAddressUnplumbed	Event ID 50028: Address Address is plumbed on the interface InterfaceId. Event ID 50029: Address Address is unplumbed on the interface InterfaceId.
DHCPV6-Client-Events	DhcpV6AddressPlumbed DhcpV6AddressUnplumbed	Event ID 51039: Address Address is plumbed on the interface InterfaceId. Event ID 51040: Address Address is unplumbed on the interface InterfaceId.
DNS-Client	Send query to DNS server Send query to DNS server Aggregation Dns query response	Event ID 3010: DNS Query sent to DNS Server DnsServerIpAddress for name QueryName and type QueryType. Event ID 3020: Query response for name QueryName, type QueryType, interface index NetworkIndex and network index InterfaceIndex returned Status with results QueryResults.
DotNETRuntime	CLR ModuleDCStart	Event ID 152: ModuleID=ModuleID.
EDP-Audit-Regular	WIP Sensitive Data Copied WIP Application Generated	Event ID 201: DataInfo has been copied (Policy) from SourceAppName (tagged as SourceEnterpriseId) to DestinationAppName (tagged as DestinationEnterpriseId). Event ID 301: Object has been changed from SourceName (tagged as SourceEnterpriseId) to DestinationName (tagged as DestinationEnterpriseId) in ApplicationName.
EDP-Audit-TCB	WIP File Protection Removed	Event ID 101: Enterprise PreviousEnterpriseId tag has been removed (Policy) from the file: FilePath.
FilterManager	FLTMGR_FILTER_REGISTERED	Event ID 6: File System Filter 'DeviceName'.
Generic ETW CreateFile Pattern	Remote Non PE Create File Event PE Create File Event SMB create File Event Outlook Create File Event Non PE Create File Event Shell Link Create File Event Shell Link Create File Event (Remote) WDATP Tampering Create File Event WDATP Program Files Create File Event User Create File Event Browsers Create File Event Email Archive Create File Event	Event ID 1
IE-SmartScreen	UrlBlockLookup	Event ID 1100: task_0
Kernel Integrity	KernelIntegrityCheck	Event ID 1
Kernel-Audit-API-Calls	ObMgrSymlinkCreation	Event ID 3: task_03
Kernel-Network	Kernel network bytes sent TCP IPv4 non Filtered Kernel network bytes sent TCP IPv6 non Filtered Kernel Network Byte Send IPv4 Filtered Kernel network bytes received TCP IPv4 non Filtered Kernel network bytes received TCP IPv6 non Filtered	Event ID 10: TCPv4: size bytes transmitted from saddr:sport to daddr:dport. Event ID 11: TCPv4: size bytes received from saddr:sport to daddr:dport. Event ID 26: TCPv6: size bytes transmitted from saddr:sport to daddr:dport. Event ID 27: TCPv6: size bytes received from saddr:sport to daddr:dport.
Kernel-PnP-Events	configuration blocked by policy Device Config Success by policy	Event ID 400: Device DeviceInstanceId was configured. Event ID 402: Device Driver_Name had its configuration blocked by policy.
Ldap-Client	Ldap Search	Event ID 30: LDAP search request
LiveId	Function token provider	Event ID 11008: +.
LsaSrv	Encryption oracle remediation LsaSrv UI user LsaSrv UI computer account	Event ID 300: Groups assigned to a new logon. Event ID 6041: A CredSSP authentication to TargetName failed to negotiate a common protocol version.
Machine state	Timna - OXO HKLM reg keys Onboarding information collection Url Cache Size Timna - VA - .NET Framework Timna - VA - Office click to run Timna - secure configuration - application configuration (compatibility) Timna - Internet Explorer - version information Timna - SCA configurations Timna - Information Gathering Timna - KBs AppUsage process list Timna - Firmware - TPM Timna - Internet Explorer Installation Status Timna - Firmware - BaseBoard Timna - Firmware - Bios Timna - Local Users Timna - Computer system information WDAV tamper-protection (Windows Defender configuration) WDAV tamper-protection (Windows Defender configuration) Timna - Add or remove programs Timna - Add or remove programs - WOW6432Node Timna - Add or remove programs (hkey_users) Timna - Add or remove programs - WOW6432Node (hkey_users) WDAV state Firewall state CodeIntegrity state AppGuard state SmartScreen state KernelIntegrity state AntiExploit State HIPS ASR state FolderGuard state Windows Updates state Machine properties state BitLocker state Firmware State KB Item State KB Index State Isolation State Capabilities State Azure Vm Metadata State Registry collection AppGuard state GP Network protection configuration Timna - secure configuration LDAP Security Configuration Disable Remote Registry Service Disable NTLM authentication for Windows workstations Exchange OwaVersion Collection SCA WMI Defender configurations XSPM - TPM Status XSPM - RDP Status XSPM - HKLM PowerShell Execution Status Effective Configuration	Event ID 2 Event ID 3 Event ID 4 Event ID 5 Event ID 6 Event ID 7 Event ID 8 Event ID 9 Event ID 10 Event ID 11 Event ID 12 Event ID 13 Event ID 16 Event ID 17 Event ID 18 Event ID 19 Event ID 20 Event ID 21 Event ID 22 Event ID 1000 Event ID 1001 Event ID 1002
Microsoft-Antimalware-Engine	BmFileOverwriteEvent AVEngineBASTelemetry UefiFirmwareVolume AVEngineThreatTelemetry AVEngineNonThreatTelemetry AvDeviceHeartbeat	Event ID 69: Message Event ID 74: SenseRemediationTask Event ID 76: SenseHeartbeatTask Event ID 95: Behavior Monitoring
Microsoft-Antimalware-RTP	DC_RemovableStorageRWE DC_DataDuplicationEvent DC_DevicePresenceEvent DC_HealthReportEvent	Event ID 25: DCEvent Event ID 26: DCEvent26 Event ID 28: DCEvent28 Event ID 29: DCEvent29
Microsoft-Antimalware-Scan-Interface	AMSIScan AMSIContent AMSIContentForIIS AMSIContentForDotNet VssAmsiContent	Event ID 1101: AmsiScanBuffer
Microsoft-Antimalware-Service	RemediationInfo HIPS NetworkFilterLookup NetworkFilterBypass TroubleshootingModeNotification TamperProtectionNotification HipsAsrUserExclusionInfo NetworkFilterConnectionInfo MpPreferenceExclusionsHardening PolicyExclusionsHardening	Event ID 48: Sense_RemediationInfoThreat Event ID 49: Sense_HipsFGInfo Event ID 50: Sense_NetworkFilterLookup Event ID 51: Sense_NetworkFilterConnectionInfo Event ID 55: Sense_NetworkFilterBreakTheGlass Event ID 56: Sense_HipsAsrUserExclusionInfo Event ID 60: Sense_TroubleshootingModeNotification Event ID 67: Sense_TamperProtectionNotification Event ID 70: Sense_DisruptionExclusionsHardeningEvent Event ID 76
Microsoft-Antimalware-UacScan	UacScanExe UacScanCom UacScanPackagedApp UacScanOther	Event ID 1201: UacScan
Microsoft-ThreatProtectionService	SqliStatelessDetector
microsoft-windows-grouppolicy	DomainControllerDiscovery	Event ID 5308: Domain Controller details.
Microsoft.Office.Security	Office SafeDocs file scanning
Microsoft.Windows.ComOleAut32	Com OleAut32 - TypeLibVerifyTrust Com OleAut32 - TypeLibMonikerFallback Com OleAut32 - TypeLibRegister Com OleAut32 - TypeLibLoad Com OleAut32 - TypeLibMonikerLoad Com OleAut32 - GetDocumentationDllLoad
Microsoft.Windows.Console.Host	conhost cooked read buffer
Microsoft.Windows.Defender	Legacy Process Creation Elam bypass
Microsoft.Windows.FileSystem.CloudFiles	CfRegisterSyncRoot_Success
Microsoft.Windows.HVSI.ContainerService	CreateVMEnd SuspendComputeSystemEnd ResumeComputeSystemEnd
Microsoft.Windows.HVSI.Manager	LaunchDocumentInContainer
Microsoft.Windows.HyperV.Compute	ContainerStopped
Microsoft.Windows.NdrCollector	ModelCollectorNdrScanner NdrCollectorHyperVVmDiscovery NdrCollectorAdUserComputer NdrCollectorAdUserComputerV2 NdrCollectorAdUserComputerV3 NdrCollectorLdapExchangeServerV3 NdrCollectorVirtualMachineInfo NdrCollectorHyperVVmDiscoveryV2 NdrCollectorDomainTrust NdrCollectorDomainController NdrCollectorAdcaInfo NdrCollectorAadConnectInfo NdrCollectorAadConnectInfoV2 NdrCollectorDiscoveredAadConnectInfo NdrCollectorSccmInfo NdrCollectorSccmAgentInfo NdrCollectorAdfsInfoV2 NdrCollectorDefaultGatewayDiscovery NdrCollectorVeritasBackupExecInfo
Microsoft.Windows.NdrScanner	NdrScannerDefaultGatewayDiscovery NdrScannerSsh SipDiscoveryNdrScanner SnmpDiscoveryNdrScanner WsDiscoveryNdrScanner mDnsNdrScanner UPnPNdrScanner NdrScannerTelemetry NdrCveLocalScanner NdrScannerBannerGrab NdrScannerFtpBannerGrab NdrScannerHostDiscovery NdrScannerPortScan NdrScannerHttpProbe NdrScannerIcmp NdrScannerIpp NdrScannerWsdExtension NdrScannerNetBios NdrScannerSmb NdrScannerSmbV1 NdrScannerPjl NdrScannerCrestronIP NdrScannerLdap NdrScannerAfp NdrScannerRdpNla NdrScannerNtlm ShieldsUpSetupResults NdrScannerIphoneSync NdrScannerAirplay NdrScannerRpcMapper NdrScannerVnc NdrScannerSlp NdrLdapComputerDiscovery NdrScannerSpring4Shell SnmpExtendedDiscoveryNdrScanner
Microsoft.Windows.Oct.Enclave	SGRM Assertion Event
Microsoft.Windows.OLE.Clipboard	OLE Clipboard Get Data
Microsoft.Windows.Print.Winspool	Print Job Created
Microsoft.Windows.Security.Wininit	lsaIsoStartupCheck LsassStarted
Microsoft.Windows.Security.Wsc	WSC RegisterAntiVirus WSC UnregisterAntiVirus
Microsoft.Windows.Sense.AccountsLockoutProvider	AccountLockoutPolicy
Microsoft.Windows.Sense.BrowserExtensionCollection	CollectedBrowserExtensions TvmCollectedBrowserExtensionsIndex
Microsoft.Windows.Sense.CollectionEtw	AWS CLI authentication data Azure CLI authentication data GCP ADC Authentication Data GCP Gcloud CLI Authentication Data DangerousWifiProfiles LocalServices LocalServicesIndex Timna - Products files scanning Timna - open handles scanning Timna - Products files scanning index DataCollection - Certificate not installed DataCollection - execution policy reduced Logon Audit Security Policy Browser data logged Azure user Browser data logged AWS user Browser data logged Azure users unified Browser data logged AWS users unified Azure CLI Authentication Data Unified AWS CLI Authentication Data Unified GCP ADC Authentication Data Unified GCP Gcloud CLI Authentication Data Unified DataCollection - Action response DataCollection - Action failure
Microsoft.Windows.Sense.ConnectivityChecker	ConnectivityCheckerReport ConnectivityCheckerFailure
Microsoft.Windows.Sense.GeneratedETW	HangDetection - report a hung component HangDetection - looking for hung components ResourceManagerEvent OfflineCommandStatus IsolationAutoRecoveryHandler IsolationStartup_IsolationAfterReboot PlatformUpdateStatus PlatformUpdateStatus_Collector Create process using G-ETW OsInfo OsSettings SecurityLogCleared LogCleared StorageVolumeInformation Policy dispatcher critical error PSScriptSignatureValidation_Mismatch RunPSScript_InvalidSasUrl RunPSScript_InvalidValidationConfig OnlineActionSampler_InvalidCmd FirewallConfiguratorApplyEvent FirewallConfiguratorRemoveEvent FirewallConfiguratorGeneralEvent LMF Policy Applied LMF force close SMB session LMF force disconnect WTS session LMF force logoff WTS session SmbBouncerPolicy policy applied Geppetto policy applied Geppetto policy removal SBG policy applied SBG policy removed SBG mitigation RiskAssessment policy applied RiskAssessment policy removed WDAC policy applied WfpConfigurator policy applied WfpConfigurator policy removed DeviceContain policy applied DeviceContain policy did not match DeviceContain policy removed OffboardingEpochBlock policy applied Offboarding blob epoch blocked Offboarding blob epoch blocked - audit WfpGuard Policy Applied DLP Telemetry Event DLP Operational Information CrashCollector_CrashReport CrashCollector_WER InternalOpticsEvent InternalOpticsCompressedEvent Sense Uploaded Size PerformanceCounterProcessAndSystem PerformanceCounterProcess Orchestrator info Orchestrator error SenseService_ShutdownEvent SenseService_StopEvent SenseService_RestartEvent SenseService_UpdateInfoEvent SenseService_UpdateFailedEvent LogicResolverTelemetry
Microsoft.Windows.Sense.Immune	Driver Collection Event ImmuneCodeIntegrity ImmuneComTelemetry ImmuneComAnalyzer
Microsoft.Windows.Sense.LocalGroupsUsersCollection	Timna - LocalGroupsUsers
Microsoft.Windows.Sense.Olympus	ADFS pre-authentication ADFS post-authentication
Microsoft.Windows.Sense.PasswordPolicyProvider	PasswordPolicy
Microsoft.Windows.Sense.PendingRebootUpdates	Timna - Pending Reboot Collection
Microsoft.Windows.Sense.RegHeartBeat	Possible ACL Tampering
Microsoft.Windows.Sense.ResearchCollectionEtw	WfpFilterAudit WfpFilterDelete
Microsoft.Windows.Sense.ScheduledTasksCollection	ScheduledTasks
Microsoft.Windows.Sense.SenseCm	SenseCM CheckinScriptResults
Microsoft.Windows.Sense.SenseCm	CheckinScriptResults
Microsoft.Windows.Sense.SharesCollection	Shares
Microsoft.Windows.Sense.SubAuth	SubAuth user logon audited SubAuth user logon blocked SubAuth initialization completion SubAuth package conflict detection SubAuth policy updated SubAuth policy removed
Microsoft.Windows.Sense.TimnaProductsFromRegistry	Timna - Products From Registry 64 PowerShell Timna - Products From Registry 6432 PowerShell Timna - Products From User Registry 64 PowerShell Timna - Products From User Registry 6432 PowerShell
Microsoft.Windows.Sense.Tvm.Axon	Timna - SenseTVM registry programs collection event Timna - SenseTVM windows programs collection event Timna - SenseTVM windows services collection event Timna - SenseTVM browser extensions collection event Timna - SenseTVM certificates collection event Timna - SenseTVM pending updates collection event Timna - SenseTVM ms store appx collection event Timna - SenseTVM windows KBs collection event Timna - SenseTVM PE collection event Timna - SenseTVM dev library collection event Timna - SenseTVM regex file extraction collection event Timna - SenseTVM JSON config collection event Timna - SenseTVM device info event Timna - SenseTVM windows device info event Timna - SenseTVM telemetry event Timna - SenseTVM scrubbed telemetry event
Microsoft.Windows.Sense.Tvm.Collector	Timna - VA collector event TvmCveLocalScanner Outbound block windows firewall rules that have no exceptions/scoping Collect Local security policy user rights assignments Collect device users roles info and authority Collect device services info
Microsoft.Windows.Sense.Tvm.NetworkScanner	NetworkScanOutput NetworkScanAgentTrace Petra - Scan command status Timna - Internet Explorer Installation Status (Petra4Windows) Timna - KBs (Petra4Windows) Timna - Computer system information (Petra4Windows) Timna - Firmware - BaseBoard (Petra4Windows) Timna - Firmware - Bios (Petra4Windows) Timna - Local Users (Petra4Windows) Timna - Firmware - TPM (Petra4Windows) Timna - VA - .NET Framework (Petra4Windows) Timna - VA - Office click to run (Petra4Windows) Timna - Internet Explorer - version information (Petra4Windows) Timna - Add or remove programs (Petra4Windows) Timna - Add or remove programs - WOW6432Node (Petra4Windows) Timna - Add or remove programs (hkey_users) (Petra4Windows) Timna - Add or remove programs - WOW6432Node (hkey_users) (Petra4Windows) Petra - Operating system data (Petra4Windows) Petra - Computer system data (Petra4Windows) Timna - secure configuration - application configuration (compatibility) (Petra4Windows) Timna - SCA configurations (Petra4Windows) Timna - secure configuration (Petra4Windows) Timna - Information Gathering (Petra4Windows)
Microsoft.Windows.Sense.TvmBaselineAssessorEtw	TvmBaselineAssessor
Microsoft.Windows.Sense.TvmCertificateCollectionEtw	TvmCertificateCollection TvmCertificateIndexCollection
Microsoft.Windows.Sense.TvmInfoGatheringCollectorEtw	TvmInfoGatheringCollector
Microsoft.Windows.Sense.ValidationEtw	DataCollection - Parent Validation
Microsoft.Windows.Sense.WDCollection	MDATP Security Baseline - AntiVirus
Microsoft.Windows.SenseComponent.GeneratedETW	PerformanceCounterProcessAndSystem PerformanceCounterProcess
Microsoft.Windows.SenseNdr	SenseNdrMdns SenseNdrMdnsCveLog4j SenseNdrDhcp SenseNdrDhcpV6 SenseNdrLldp SenseNdrLlmnr SenseNdrSsdp SenseNdrCDP SenseNdrArp SenseNdrArpRequest SenseNdrTcpHeader SenseNdrNbns SenseNdrMndp SenseNdrWsd SenseNdrUdpHeader SenseNdrIPHeader SenseNdrTcpHeaderSynPackets SenseNdr Telemetery ZeekSetupStatusEvent SenseNdrInfo SenseNdrError SenseNdrThrottling SenseNdrSignaturePii SenseNdrSignatureNtlm SenseNdrSignatureSmbServerGuid SenseNdrSignatureMsBrowser SenseNdrSignatureHttpServerHeader SenseNdrSignaturePublicIpScan SenseNdrSignaturePublicIpScanUdp SenseNdrSignatureIphoneSync SenseNdrSignatureCveDetection SenseNdrSignatureSpring4Shell SenseNdrSignatureKerberos SenseNdrSignatureLdapRbcdModify SenseNdrSignatureMsMsdt SenseNdrSignatureJavaReferenceOverLdap SenseNdrSignatureSkypeSsrf SenseNdrZeekSignatureBacnetBroadcastDiscovery SenseNdrZeekSignatureBacnetFW SenseNdrZeekSignatureBacnetLocation SenseNdrZeekSignatureBacnetModel SenseNdrZeekSignatureBacnetHostname SenseNdrZeekSignatureBacnetVendorCode SenseNdrZeekSignatureBacnetVendorName SenseNdrSignatureDns SenseNdrSignatureDnsCveLog4j SenseNdrSignatureJavaRMI SenseNdrSignatureSrvSvc SenseNdrSignatureWakeOnLan SenseNdrSignatureNegoEx SenseNdrSignaturePointOfCareTesting SenseNDRSignatureProfinetEPM SenseNDRSignatureProfinetIMZeroFive SenseNDRSignatureProfinetAssetManagement SenseNdrZeekDceRpc SenseNdrZeekSamr SenseNdrZeekSrvSvc SenseNdrZeekDns SenseNdrZeekFtp SenseNdrZeekConnTcp SenseNdrZeekConnUdp SenseNdrZeekSignature SenseNdrZeekDhcpV6Exploit SenseNdrZeekSmbGhost SenseNdrZeekIcmp SenseNdrZeekHttp SenseNdrZeekNtlm SenseNdrZeekSmbServerGuid SenseNdrZeekSsh SenseNdrZeekSmtp SenseNdrZeekKerberos SenseNdrZeekSsl SenseNdrZeekSmbFiles SenseNdrZeekSmbMapping SenseNdrZeekFiles SenseNdrZeekWireguard SenseNdrZeekNotice SenseNdrZeekPrintNightmare ZeekNdrRunnerEvent SenseNdrZeekStatistics SenseNdrZeekHealthLevelSeven SenseNdrZeekPointOfCareTesting SenseNdrZeekDicom SenseNdrZeekModbus SenseNdrZeekSnmp SenseNdrZeekEnip SenseNdrZeekCip SenseNDRZeekBacnetProperty SenseNDRZeekBacnetIAmVendor SenseNdrZeekModbusReadDeviceID SenseNdrZeekNicteaming SenseNdrZeekBacnetProperty SenseNdrZeekS7CommPlus SenseNdrZeekSignatureS7Comm SenseNdrZeekBoundarySix SenseNdrZeekReporterEvent SenseNdrZeekKerberosAuthTicketOut SenseNdrZeekKerberosAuthTicketIn SenseNdrZeekKerberosTgs SenseNdrSignatureTCPCIPGetAll SenseNdrSignatureUDPCIPGetAll SenseNdrSignatureTCPCIPGetSingle SenseNdrSignatureUDPCIPGetSingle SenseNdrSignatureUDPENIPListCIPIdentity SenseNdrSignatureTCPENIPListCIPIdentity SenseNdrSignatureBacnetBroadcastDiscovery SenseNdrSignatureBacnetProperty SenseNdrSignatureSNMPSysDescription SenseNdrSignatureSNMPSysName SenseNdrSignatureS7CommReadSZL_0111 SenseNdrSignatureS7CommReadSZL_001C SenseNdrSignatureS7CommReadSZL_0011 SenseNdrSignatureModbusReadDeviceID SenseNDRSignatureSiemensSICAM SenseNDRSignatureS7CommPlusCreateObject SenseNDRSignatureS7CommPlusGetVarSubStreamed SenseNDRSignatureS7CommPlusGeneric SenseNDRSignatureCSP2DiagnosticStatusResponseLocal SenseNDRSignatureCSP2DiagnosticStatusResponseRemote SenseNDRSignatureCSP2Generic SenseNdrSignatureHoneywellDiscovery SenseNdrZeekGhostCat SenseNdrZeekProfinetIoCm SenseNdrZeekProfinetHandshakeEPM SenseNdrZeekJA4SSH SenseNDRSignatureEmersonCpcE2SignOn SenseNDRSignatureEmersonCpcE2CtrlList SenseNdrZeekEmersonCpcE2
Microsoft.Windows.ServiceControlManager	ServiceStarted
Microsoft.Windows.User32	System shutdown (CSRSS)
Microsoft.Windows.WebDefense.SenseLogging	ThreatAssessmentSenseEvent
Microsoft.Windows.WSL.DefenderPlugin	WSLDefenderPlugin
NTLM	NTLM Client Blocked Audit	Event ID 8001: NTLM client blocked audit: Audit outgoing NTLM authentication traffic that would be blocked.
Powershell cmdlets	Cmdlet start Amsi Start	Event ID 7937: ContextInfo Context: Context User Data: User_Data. Event ID 16385: AmsiUtil state.
PrintService	Device Control Print Failed due to Restrictions	Event ID 871: The current print job was rejected due to Device Control Print Restrictions.
RemoteDesktopServices-RdpCoreTS	RdpCoreTS Accept Connection RdpCoreTS MST120 Virtual channel	Event ID 131: The server accepted a new ConnType connection from client ClientIP. Event ID 148: Channel ChannelName has been closed between the server and the client on transport tunnel: TunnelID.
RPC	RPC Interface Registration RPC Interface Unregistration	Event ID 14: RPC interface registered. Event ID 15: RPC interface unregistered.
RPC-Audit	Remote RPC inbound audit Remote RPC inbound block	Event ID 1: task_0 Event ID 2: task_02
SEC	LoadImage_ForProtectedProcess Delete file DeviceIoControl volsnap Filter Process Termination Atomic Open Remote File And Acquire Oplock Retry Failed IO Open network share Admin share opened remotely Outgoing admin share access, parent folder only Outgoing admin share access, raw events Registry Query Info Key System rename extension aggregation Named Pipe Event18 Event19 Event23 Event23_ForSense Event23_ForAmsiDetector Event24 Event25 Event27 Event28 Event29 Event30 Event32 Event33 Open process for read Event35 Event36 Event37 Event38 File create aggregation File delete aggregation File rename aggregation File create extension aggregation File delete extension aggregation File rename extension aggregation SEC unload High value file read High value file read aggregation RegistryQueryValue File Open File Open By Process Unauthorized file access attempts Registry Save Key Process Termination Aggregation Process Commandline Assertion Violation Script read from network share [FirstNSeen] LoadImage LMF File Open Blocked Audit LMF File Open Blocked Audit Aggregation LMF network share access blocked LMF sysvol access blocked	Event ID 2: task_02 Event ID 4: task_04 Event ID 5: task_05_V1 Event ID 6: task_06_V1 Event ID 17: task_017 Event ID 18: task_018 Event ID 19: task_019 Event ID 22: task_022 Event ID 23: task_023 Event ID 24: task_024 Event ID 25: task_025 Event ID 26: task_026 Event ID 27: task_027 Event ID 28: task_028 Event ID 29: task_029 Event ID 30: task_030 Event ID 31: task_031 Event ID 32: task_032 Event ID 33: task_033 Event ID 34: task_034 Event ID 35: task_035 Event ID 36: task_036 Event ID 37: task_037 Event ID 38: task_038 Event ID 40: task_040 Event ID 41: task_041 Event ID 42: task_042_V2 Event ID 44: task_044 Event ID 46: task_046 Event ID 47: task_047 Event ID 52: task_052_V2 Event ID 53: task_053 Event ID 54: task_054 Event ID 56: task_056_V2 Event ID 57: task_057_V2 Event ID 58: task_058
SEC-WFP	WfpGuard Block Event Contain connection blocked callout (legacy) ContainExclusions ManualDeviceContainBlock DisruptionContainBlock DisruptionContainHvaAudit OutgoingTrafficBlockerAudit OutgoingTrafficBlockerBlock	Event ID 1: task_01_V1 Event ID 2: task_02_V1 Event ID 3: task_03_V1 Event ID 4: task_0
SecureETW	Logon event SE_AUDITID_ETW_PROCESS_CREATED An Attempt was made to reset an account password File permissions change Persistent cryptographic key export. Taking Ownership on File from TrustedInstaller Taking Ownership on MDE Key Hardlink Create Audit Event Sense tampering through object sacl change A service was installed An account failed to log on A scheduled task was created A scheduled task was deleted A scheduled task was updated A user account was created Plug and Play event Firewall service started Firewall service stopped Firewall app blocked from listening Firewall has blocked a connection outbound Firewall has blocked a connection inbound Credman - Credentials Backup Credman - Read Credentials Vault Credential - Find Credential Vault Credential - Enumerate Credentials Vault Credential - Get Unique Credential Logon using explicit credentials System Audit Policy was changed A user account was deleted A member was added to a security-enabled local group Local group created A user account was deleted Local group removed Local group deleted A user account was changed A member was added to a security-enabled local group User's local group membership was enumerated Security-enabled local group membership was enumerated Persistent cryptographic key operation. SE_AUDITID_ETW_RPC_INBOUND_CALL LMF RPC Inbound enforcement SE_AUDITID_ETW_LOGON_FAILURE LMF network logon enforcement	Event ID 4624: An account was successfully logged on. Event ID 4625: An account failed to log on. Event ID 4648: A logon was attempted using explicit credentials. Event ID 4664: An attempt was made to create a hard link. Event ID 4670: Permissions on an object were changed. Event ID 4688: A new process has been created. Event ID 4697: A service was installed in the system. Event ID 4698: A scheduled task was created. Event ID 4699: A scheduled task was deleted. Event ID 4702: A scheduled task was updated. Event ID 4719: System audit policy was changed. Event ID 4720: A user account was created. Event ID 4724: An attempt was made to reset an account's password. Event ID 4726: A user account was deleted. Event ID 4731: A security-enabled local group was created. Event ID 4732: A member was added to a security-enabled local group. Event ID 4733: A member was removed from a security-enabled local group. Event ID 4734: A security-enabled local group was deleted. Event ID 4738: A user account was changed. Event ID 4798: A user's local group membership was enumerated. Event ID 4799: A security-enabled local group membership was enumerated. Event ID 4907: Auditing settings on object were changed. Event ID 5024: The Windows Firewall Service has started successfully. Event ID 5025: The Windows Firewall Service has been stopped. Event ID 5031: The Windows Firewall Service blocked an application from accepting incoming connections on the network. Event ID 5058: Key file operation. Event ID 5059: Key migration operation. Event ID 5157: The Windows Filtering Platform has blocked a connection. Event ID 5376: Credential Manager credentials were backed up. Event ID 5379: Credential Manager credentials were read. Event ID 5380: Vault Find Credential. Event ID 5381: Vault credentials were read. Event ID 5382: Vault credentials were read. Event ID 5712: A Remote Procedure Call (RPC) was attempted. Event ID 6416: A new external device was recognized by the system.
Security-Mitigations	AuditProcessProcessBlockGeneratingDynamicCode EnforceProcessProcessBlockGeneratingDynamicCode AuditProcessProcessBlockCreatingChildProcess EnforceProcessProcessBlockCreatingChildProcess AuditProcessLoadLowILImage EnforceProcessLoadLowILImage AuditProcessLoadBinaryFromRemoteShare EnforceProcessLoadBinaryFromRemoteShare AuditProcessCallWin32k EnforceProcessCallWin32k AuditProcessLoadNonMicrosoftSignedBinary EnforceProcessLoadNonMicrosoftSignedBinary AuditExportAddressFilter EnforceExportAddressFilter AuditExportAddressFilterPlus EnforceExportAddressFilterPlus AuditImportAddressFilter EnforceInputAddressFilter AuditRopStackPivot EnforceRopStackPivot AuditRopCallerCheck EnforceRopCallerCheck AuditRopSimExec EnforceRopSimExec	Event ID 1: Process 'ProcessPath' (PID CallingProcessId) would have been blocked from generating dynamic code. Event ID 2: Process 'ProcessPath' (PID CallingProcessId) was blocked from generating dynamic code. Event ID 3: Process 'ProcessPath' (PID CallingProcessId) would have been blocked from creating a child process 'ChildImagePathName' with command line 'ChildCommandLine'. Event ID 4: Process 'ProcessPath' (PID CallingProcessId) was blocked from creating a child process 'ChildImagePathName' with command line 'ChildCommandLine'. Event ID 5: Process 'ProcessPath' (PID ProcessId) would have been blocked from loading the low-integrity binary 'ImageName'. Event ID 6: Process 'ProcessPath' (PID ProcessId) was blocked from loading the low-integrity binary 'ImageName'. Event ID 7: Process 'ProcessPath' (PID CallingProcessId) would have been blocking from loading a binary from a remote share. Event ID 8: Process 'ProcessPath' (PID CallingProcessId) was blocked from loading a binary from a remote share. Event ID 9: Process 'ProcessPath' (PID CallingProcessId) would have been blocked from making system calls to Win32k. Event ID 10: Process 'ProcessPath' (PID CallingProcessId) was blocked from making system calls to Win32k. Event ID 11: Process 'ProcessPath' (PID ProcessId) would have been blocked from loading the non-Microsoft-signed binary 'ImageName'. Event ID 12: Process 'ProcessPath' (PID ProcessId) was blocked from loading the non-Microsoft-signed binary 'ImageName'. Event ID 13: Process 'ProcessPath' (PID ProcessId) would have been blocked from accessing the Export Address Table for module 'MemModuleFullPath'. Event ID 14: Process 'ProcessPath' (PID ProcessId) was blocked from accessing the Export Address Table for module 'MemModuleFullPath'. Event ID 15: Process 'ProcessPath' (PID ProcessId) would have been blocked from accessing the Export Address Table for module 'MemModuleFullPath'. Event ID 16: Process 'ProcessPath' (PID ProcessId) was blocked from accessing the Export Address Table for module 'MemModuleFullPath'. Event ID 17: Process 'ProcessPath' (PID ProcessId) would have been blocked from accessing the Import Address Table for API 'APIName'. Event ID 18: Process 'ProcessPath' (PID ProcessId) was blocked from accessing the Import Address Table for API 'APIName'. Event ID 19: Process 'ProcessPath' (PID ProcessId) would have been blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications. Event ID 20: Process 'ProcessPath' (PID ProcessId) was blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications. Event ID 21: Process 'ProcessPath' (PID ProcessId) would have been blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications. Event ID 22: Process 'ProcessPath' (PID ProcessId) was blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications. Event ID 23: Process 'ProcessPath' (PID ProcessId) would have been blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications. Event ID 24: Process 'ProcessPath' (PID ProcessId) was blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications.
Services	ServiceSendControlStop ServiceConfigChangeStartType ServiceConfigChangeBinaryPathName ServiceConfigChangeAccountInfo	Event ID 200: SendControl Event ID 201: ServiceConfigChange Event ID 202: ServiceConfigChange202 Event ID 203: ServiceConfigChange203
SGRM Report	SGRM Report SGRM Error	Event ID 1 Event ID 2
Shell-Core	Open http link Open .lnk file Explorer_ExecutingFromRunKey	Event ID 9708: Finished execution of command 'Command' (PID PID). Event ID 19501: CDesktopFolder_ParseDisplayNameStart
SmartScreen	AppLookup UserDecision	Event ID 1000: Application SmartScreen Event Event ID 1002: User Decision SmartScreen Event
TCPIP	Connection accepted Listening socket created Connect Complete Connect Failure	Event ID 1017: TCP: listener (local=LocalAddress remote=RemoteAddress) accept completed. Event ID 1033: TCP: connection Tcb (local=LocalAddress remote=RemoteAddress) connect completed. Event ID 1034: TCP: connection Tcb (local=LocalAddress remote=RemoteAddress) connect attempt failed with status = Status. Event ID 1123: TCP: listener Listener (sockaddr=SocketAddress) activated.
TerminalServices-LocalSessionManager	TerminalServices-LOGON TerminalServices-RECONNECT	Event ID 21: Remote Desktop Services: Session logon succeeded. Event ID 25: Remote Desktop Services: Session reconnection succeeded.
ThreatIntelligence	MemAllocRemote MemProtectRemote MapViewRemote QueueUserApcRemote SetThreadContextRemote MemAllocForHighRisk MemAllocForMeterpreter Image region local vmprotect MapViewForHighRiskProcesses ReadVMRemote ReadVMRemote clone WriteVMRemote - lsass SuspendThread ResumeThread SuspendProcess ResumeProcess FreezeProcess ThawProcess AllocVmKernelCallerRemote ProtectVmKernelCallerRemote QueueUserApcKernelCallerRemote Driver Object Creation Device Object Creation Token Impersonation	Event ID 1: Remote Virtual Memory Allocation Event ID 2: Remote Virtual Memory Protection Change Event ID 3: Remote Section Map Event ID 4: Remote APC Queue Event ID 5: Remote Thread Context Change Event ID 6: Local Virtual Memory Allocation Event ID 7: Local Virtual Memory Protection Change Event ID 8: Local Section Map Event ID 13: Remote Virtual Memory Read Event ID 14: Remote Virtual Memory Write Event ID 15: Remote Thread Suspend Event ID 16: Remote Thread Resume Event ID 17: Process Suspend Event ID 18: Process Resume Event ID 19: Process Freeze Event ID 20: Process Thaw Event ID 21: Remote Virtual Memory Allocation (Kernel Caller) Event ID 22: Remote Virtual Memory Protection Change (Kernel Caller) Event ID 24: Remote APC Queue (Kernel Caller) Event ID 29: Driver Object Patch Event ID 31: Device Object Create Event ID 33: Thread Token Impersonation (Elevation)
User32	System shutdown	Event ID 1074: The process param1 has initiated the param5 of computer param2 on behalf of user param7 for the following reason:
VHDMP	VHDMP Virtual Disk Mount	Event ID 1: The VHD VhdFileName has come online (surfaced) as disk number VhdDiskNumber.
WER-Diag	CFG Violation	Event ID 5: CFG violation is detected.
Win32k	UpdateEvent KLRegRawInput (20H1+) KLRegRawInput KLGetAsyncKeyState KLSetWindowsHook BitBlt API call Aggregation	Event ID 1: WindowUpdate Event ID 1001: RegisterRawInputDevices Event ID 1002: SetWindowsHookEx Event ID 1003: GetAsyncKeyState
Windows Defender	WDAV Scan Started WDAV Scan Completed WDAV Scan Cancelled WDAV Scan Failed MALWAREPROTECTION_RTP_ENABLED MALWAREPROTECTION_RTP_DISABLED MALWAREPROTECTION_CONFIG_CHANGED Defender Signature drop Attempted Defender AV Tampering	Event ID 1000: Product Name scan has started. Event ID 1001: Product Name scan has finished. Event ID 1002: Product Name scan has been stopped before completion. Event ID 1005: ProductName scan has encountered an error and terminated. Event ID 2000: Product Name security intelligence version updated. Event ID 5000: ProductName Real-time Protection scanning for malware and other potentially unwanted software was enabled. Event ID 5001: Product Name Real-time Protection scanning for malware and other potentially unwanted software was disabled. Event ID 5007: Product Name Configuration has changed. Event ID 5013: Tamper Protection Changed Type a change to Product Name.
WMI-Activity	Remote Win32_Process:Create Remote WMI execution Remote WMI Process Creation (RS5+) WMI remote query WMI local query Remote WMI Repository Update Local Win32_Process:Create Local WMI Process Creation (RS5+) WMI bind filter to consumer WMI Class Creation and Usage	Event ID 11: CorrelationId = CorrelationId; GroupOperationId = GroupOperationId; OperationId = OperationId; Operation = Operation; ClientMachine = ClientMachine; User = User; ClientProcessId = ClientProcessId; ... Event ID 20: Performing Update operation on the WMI repository. Event ID 22: CorrelationId = CorrelationId; GroupOperationId = GroupOperationId; OperationId = OperationId; ClassName= ClassName; MethodName = MethodName; ImplementationClass = ImplementationClass; ClientMachin... Event ID 23: CorrelationId = CorrelationId; GroupOperationId = GroupOperationId; OperationId = OperationId; Commandline= Commandline; CreatedProcessId = CreatedProcessId; ClientMachine = CreatedProcessCreationT... Event ID 5861: Namespace = Operation_ESStoConsumerBinding.Namespace; Eventfilter = Operation_ESStoConsumerBinding.ESS (refer to its activate eventid:5859); Consumer = Operation_ESStoConsumerBinding.CONSUMER; Poss...