Microsoft-Windows-EapMethods-Sim

6 events across 1 channel

Event	Title	Channel	Sample
100	Method Name: User with telephone number Error Cause was successfully …	Operational	N
101	Method Name: Authentication was terminated by the client, reason: Error Cause.	Operational	N
102	Method Name: Authentication was terminated by the server, reason: Error Cause.	Operational	N
103	Method Name: Fast re-authentication was terminated and a full authentication was …	Operational	N
104	Method Name: The client and server were found to be out of sequence during …	Operational	N
105	EAP-AKA': The client detected a mismatch between its version of the network name …	Operational	N

Event ID 100: Method Name: User with telephone number Error Cause was successfully authenticated to the network.

Provider: Microsoft-Windows-EapMethods-Sim
Channel: Operational
Task: SIMbasedauthenticationsucceededevent

Description

Method Name: User with telephone number Error Cause was successfully authenticated to the network.

Message #

%1: User with telephone number %2 was successfully authenticated to the network.

Fields #

Name	Description
`MethodName` UnicodeString
`ErrorCause` UnicodeString

Event ID 101: Method Name: Authentication was terminated by the client, reason: Error Cause.

Provider: Microsoft-Windows-EapMethods-Sim
Channel: Operational
Task: SIMbasedauthenticationfailedevent

Description

Method Name: Authentication was terminated by the client, reason: Error Cause.

Message #

%1: Authentication was terminated by the client, reason: %2

Fields #

Name	Description
`MethodName` UnicodeString
`ErrorCause` UnicodeString

Event ID 102: Method Name: Authentication was terminated by the server, reason: Error Cause.

Provider: Microsoft-Windows-EapMethods-Sim
Channel: Operational
Task: SIMbasedauthenticationfailedevent

Description

Method Name: Authentication was terminated by the server, reason: Error Cause.

Message #

%1: Authentication was terminated by the server, reason: %2

Fields #

Name	Description
`MethodName` UnicodeString
`ErrorCause` UnicodeString

Event ID 103: Method Name: Fast re-authentication was terminated and a full authentication was initiated because the client and server were out of sequence.

Provider: Microsoft-Windows-EapMethods-Sim
Channel: Operational
Task: SIMbasedauthenticationfailedevent

Description

Method Name: Fast re-authentication was terminated and a full authentication was initiated because the client and server were out of sequence.

Message #

%1: Fast re-authentication was terminated and a full authentication was initiated because the client and server were out of sequence

Fields #

Name	Description
`MethodName` UnicodeString

Event ID 104: Method Name: The client and server were found to be out of sequence during authentication.

Provider: Microsoft-Windows-EapMethods-Sim
Channel: Operational
Task: SIMbasedauthenticationfailedevent

Description

Method Name: The client and server were found to be out of sequence during authentication. Re-synchronization occurred.

Message #

%1: The client and server were found to be out of sequence during authentication. Re-synchronization occurred.

Fields #

Name	Description
`MethodName` UnicodeString

Event ID 105: EAP-AKA': The client detected a mismatch between its version of the network name and the one received from the server.

Provider: Microsoft-Windows-EapMethods-Sim
Channel: Operational
Task: SIMbasedauthenticationfailedevent

Description

EAP-AKA': The client detected a mismatch between its version of the network name and the one received from the server.

Message #

EAP-AKA': The client detected a mismatch between its version of the network name and the one received from the server.

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 3d42a67d-9ce8-4284-b755-2550672b0ce0

Defined in SimAuth.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-EapMethods-Sim

Event ID 100: Method Name: User with telephone number Error Cause was successfully authenticated to the network.

Description

Message #

Fields #

Event ID 101: Method Name: Authentication was terminated by the client, reason: Error Cause.

Description

Message #

Fields #

Event ID 102: Method Name: Authentication was terminated by the server, reason: Error Cause.

Description

Message #

Fields #

Event ID 103: Method Name: Fast re-authentication was terminated and a full authentication was initiated because the client and server were out of sequence.

Description

Message #

Fields #

Event ID 104: Method Name: The client and server were found to be out of sequence during authentication.

Description

Message #

Fields #

Event ID 105: EAP-AKA': The client detected a mismatch between its version of the network name and the one received from the server.

Description

Message #

Provenance

Downloads

Keyboard shortcuts

Search operators