Microsoft-Windows-RPC-Proxy

14 events across 1 channel

Event	Title	Channel	Sample
2	Event ID 2	Operational	N
3	Event ID 3	Operational	N
4	Event ID 4	Operational	N
5	Event ID 5	Operational	N
6	Event ID 6	Operational	N
7	Event ID 7	Operational	N
8	Event ID 8	Operational	N
1073741827	RPC Proxy successfully loaded in Internet Information Services (IIS) mode …	Operational	N
1073741828	RPC Proxy successfully loaded in Internet Information Services (IIS).	Operational	N
1073741829	RPC Proxy load balancing module (PID: param1) successfully loaded configuration …	Operational	N
3221225474	The following ValidPorts registry key could not be parsed.	Operational	N
3221225478	RPC Proxy load balancing module (PID: param1) cannot process registry key param2 …	Operational	N
3221225479	RPC Proxy load balancing module (PID: param1) does not recognize configuration …	Operational	N
3221225480	RPC Proxy load balancing module (PID: param1) cannot process configuration entry …	Operational	N

Event ID 2

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString

Event ID 3

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString

Event ID 4

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Event ID 5

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString

Event ID 6

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 7

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 8

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString
`param3` UnicodeString

Event ID 1073741827: RPC Proxy successfully loaded in Internet Information Services (IIS) mode param1.

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Description

RPC Proxy successfully loaded in Internet Information Services (IIS) mode .0.

Message #

RPC Proxy successfully loaded in Internet Information Services (IIS) mode %1.0.

Fields #

Name	Description
`param1`

Event ID 1073741828: RPC Proxy successfully loaded in Internet Information Services (IIS).

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Description

RPC Proxy successfully loaded in Internet Information Services (IIS).

Message #

RPC Proxy successfully loaded in Internet Information Services (IIS).

Event ID 1073741829: RPC Proxy load balancing module (PID: param1) successfully loaded configuration information.

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Description

RPC Proxy load balancing module (PID: ) successfully loaded configuration information.

Message #

RPC Proxy load balancing module (PID: %1) successfully loaded configuration information.

Fields #

Name	Description
`param1`

Event ID 3221225474: The following ValidPorts registry key could not be parsed.

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Description

The following ValidPorts registry key could not be parsed: param1. The RPC Proxy cannot load. The ValidPorts registry key might have been configured incorrectly. User Action Verify that the ValidPorts registry value is set correctly. If the value is not correct, edit the registry key to reflect the correct value.

Message #

The following ValidPorts registry key could not be parsed: %1. The RPC Proxy cannot load. The ValidPorts registry key might have been configured incorrectly.  User Action Verify that the ValidPorts registry value is set correctly. If the value is not correct, edit the registry key to reflect the correct value.

Fields #

Name	Description
`param1`

Event ID 3221225478: RPC Proxy load balancing module (PID: param1) cannot process registry key param2 as a valid UUID.

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Description

RPC Proxy load balancing module (PID: param1) cannot process registry key param2 as a valid UUID. User Action Verify that the registry key is a correctly formatted UUID. If the value is not correct, edit the registry key to reflect the correct value.

Message #

RPC Proxy load balancing module (PID: %1) cannot process registry key %2 as a valid UUID.  User Action Verify that the registry key is a correctly formatted UUID. If the value is not correct, edit the registry key to reflect the correct value.

Fields #

Name	Description
`param1`
`param2`

Event ID 3221225479: RPC Proxy load balancing module (PID: param1) does not recognize configuration type for key param2.

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Description

RPC Proxy load balancing module (PID: param1) does not recognize configuration type for key param2. User Action Verify that the registry key has configuration type that RPC Proxy load balancing module can recognize. If the value is not correct, edit the registry key to reflect the correct value.

Message #

RPC Proxy load balancing module (PID: %1) does not recognize configuration type for key %2.  User Action Verify that the registry key has configuration type that RPC Proxy load balancing module can recognize. If the value is not correct, edit the registry key to reflect the correct value.

Fields #

Name	Description
`param1`
`param2`

Event ID 3221225480: RPC Proxy load balancing module (PID: param1) cannot process configuration entry for resource UUID param2: ServerFarm is param3.

Provider: Microsoft-Windows-RPC-Proxy
Channel: Operational

Description

RPC Proxy load balancing module (PID: param1) cannot process configuration entry for resource UUID param2: ServerFarm is param3. User Action Verify that the registry key for this resource UUID has correctly formatted ServerFarm string. If the value is not correct, edit the registry key to reflect the correct value.

Message #

RPC Proxy load balancing module (PID: %1) cannot process configuration entry for resource UUID %2: ServerFarm is %3.  User Action  Verify that the registry key for this resource UUID has correctly formatted ServerFarm string. If the value is not correct, edit the registry key to reflect the correct value.

Fields #

Name	Description
`param1`
`param2`
`param3`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)