MSExchangeServiceHost

Event	Title	Channel	Sample	Rule
2001	Event ID 2001	Application	Y	N
2003	Event ID 2003	Application	Y	N
2004	Event ID 2004	Application	Y	N
2009	Event ID 2009	Application	Y	N
2010	Event ID 2010	Application	Y	N
2014	Event ID 2014	Application	Y	N
2016	Event ID 2016	Application	Y	N
2018	Event ID 2018	Application	Y	N
2021	Event ID 2021	Application	Y	N

Event ID 2001

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeServiceHost",
    "guid": "",
    "event_source_name": "",
    "event_id": 2001,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:21.964060+00:00",
    "event_record_id": 4874,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Microsoft.Exchange.RPCOverHTTPAutoconfig.dll</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 2003

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeServiceHost",
    "guid": "",
    "event_source_name": "",
    "event_id": 2003,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:20.042152+00:00",
    "event_record_id": 4869,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": ""
  },
  "message": ""
}

Event ID 2004

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeServiceHost",
    "guid": "",
    "event_source_name": "",
    "event_id": 2004,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:22.073439+00:00",
    "event_record_id": 4890,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": ""
  },
  "message": ""
}

Event ID 2009

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeServiceHost",
    "guid": "",
    "event_source_name": "",
    "event_id": 2009,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:19.557821+00:00",
    "event_record_id": 4866,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": ""
  },
  "message": ""
}

Event ID 2010

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeServiceHost",
    "guid": "",
    "event_source_name": "",
    "event_id": 2010,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:19.573402+00:00",
    "event_record_id": 4868,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": ""
  },
  "message": ""
}

Event ID 2014

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeServiceHost",
    "guid": "",
    "event_source_name": "",
    "event_id": 2014,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:21.964060+00:00",
    "event_record_id": 4870,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": ""
  },
  "message": ""
}

Event ID 2016

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeServiceHost",
    "guid": "",
    "event_source_name": "",
    "event_id": 2016,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:21.964060+00:00",
    "event_record_id": 4871,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": ""
  },
  "message": ""
}

Event ID 2018

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeServiceHost",
    "guid": "",
    "event_source_name": "",
    "event_id": 2018,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:21.964060+00:00",
    "event_record_id": 4872,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": ""
  },
  "message": ""
}

Event ID 2021

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeServiceHost",
    "guid": "",
    "event_source_name": "",
    "event_id": 2021,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:21.964060+00:00",
    "event_record_id": 4873,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": ""
  },
  "message": ""
}