detection.wiki

Detection rules › By event

Microsoft-Windows-Security-Auditing

EventRules
Event ID 4121
Event ID 5011
Event ID 6751
Event ID 46111
Event ID 46162
Event ID 46221
Event ID 462493
Event ID 462555
Event ID 46271
Event ID 46346
Event ID 46472
Event ID 464822
Event ID 46491
Event ID 465639
Event ID 465742
Event ID 46581
Event ID 466110
Event ID 466231
Event ID 466371
Event ID 46641
Event ID 46702
Event ID 46723
Event ID 46734
Event ID 46745
Event ID 46751
Event ID 46881897
Event ID 468914
Event ID 46901
Event ID 46921
Event ID 469735
Event ID 469827
Event ID 46997
Event ID 47004
Event ID 47013
Event ID 47027
Event ID 47033
Event ID 47043
Event ID 47061
Event ID 47171
Event ID 47196
Event ID 472017
Event ID 47224
Event ID 47239
Event ID 472410
Event ID 47253
Event ID 47266
Event ID 47275
Event ID 472821
Event ID 47292
Event ID 47302
Event ID 47314
Event ID 473220
Event ID 47332
Event ID 47341
Event ID 47351
Event ID 47372
Event ID 473819
Event ID 47416
Event ID 474217
Event ID 47432
Event ID 47441
Event ID 47491
Event ID 47543
Event ID 47551
Event ID 475616
Event ID 47571
Event ID 47591
Event ID 47641
Event ID 47651
Event ID 47661
Event ID 476826
Event ID 476924
Event ID 47701
Event ID 47716
Event ID 47769
Event ID 47782
Event ID 47793
Event ID 47801
Event ID 47818
Event ID 47831
Event ID 47901
Event ID 47943
Event ID 47981
Event ID 47995
Event ID 48001
Event ID 48252
Event ID 48761
Event ID 48821
Event ID 48865
Event ID 48877
Event ID 48881
Event ID 48901
Event ID 48911
Event ID 48921
Event ID 48982
Event ID 48992
Event ID 49041
Event ID 49051
Event ID 49461
Event ID 49471
Event ID 49481
Event ID 49501
Event ID 49641
Event ID 50381
Event ID 50581
Event ID 50591
Event ID 51231
Event ID 51241
Event ID 513673
Event ID 513716
Event ID 51382
Event ID 51392
Event ID 514013
Event ID 51414
Event ID 51422
Event ID 51433
Event ID 514570
Event ID 515219
Event ID 515418
Event ID 515517
Event ID 515651
Event ID 515720
Event ID 515817
Event ID 515917
Event ID 53793
Event ID 53822
Event ID 54411
Event ID 54473
Event ID 54481
Event ID 54491
Event ID 62811
Event ID 64163
Event ID 64231

Event ID 412

#

1 detection rules reference this event. View event page.

Kusto (1)

Event ID 501

#

1 detection rules reference this event. View event page.

Kusto (1)

Event ID 675

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4611

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4616

#

2 detection rules reference this event. View event page.

Sigma (2)

Event ID 4622

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4624

#

93 detection rules reference this event. View event page.

Sigma (29)

Elastic (12)

Splunk (21)

Kusto (19)

YARA-L (12)

Event ID 4625

#

55 detection rules reference this event. View event page.

Sigma (11)

Elastic (6)

Splunk (15)

Kusto (11)

YARA-L (12)

Event ID 4627

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4634

#

6 detection rules reference this event. View event page.

Sigma (1)

Kusto (5)

Event ID 4647

#

2 detection rules reference this event. View event page.

Sigma (1)

Kusto (1)

Event ID 4648

#

22 detection rules reference this event. View event page.

Sigma (4)

Splunk (5)

Kusto (1)

YARA-L (12)

Event ID 4649

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4656

#

39 detection rules reference this event. View event page.

Sigma (18)

Elastic (1)

Splunk (15)

Kusto (4)

YARA-L (1)

Event ID 4657

#

42 detection rules reference this event. View event page.

Sigma (5)

Splunk (14)

Kusto (8)

YARA-L (15)

Event ID 4658

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4661

#

10 detection rules reference this event. View event page.

Sigma (9)

Splunk (1)

Event ID 4662

#

31 detection rules reference this event. View event page.

Sigma (13)

Elastic (6)

Splunk (7)

Kusto (4)

YARA-L (1)

Event ID 4663

#

71 detection rules reference this event. View event page.

Sigma (22)

Splunk (31)

Kusto (18)

Event ID 4664

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4670

#

2 detection rules reference this event. View event page.

Splunk (1)

Kusto (1)

Event ID 4672

#

3 detection rules reference this event. View event page.

Elastic (1)

Splunk (1)

Kusto (1)

Event ID 4673

#

4 detection rules reference this event. View event page.

Sigma (3)

Splunk (1)

Event ID 4674

#

5 detection rules reference this event. View event page.

Sigma (4)

Elastic (1)

Event ID 4675

#

1 detection rules reference this event. View event page.

Kusto (1)

Event ID 4688

#

1897 detection rules reference this event. View event page.

Sigma (735)

Elastic (257)

Splunk (789)

Kusto (47)

YARA-L (69)

Event ID 4689

#

14 detection rules reference this event. View event page.

Kusto (14)

Event ID 4690

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4692

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4697

#

35 detection rules reference this event. View event page.

Sigma (27)

Elastic (4)

Splunk (2)

Kusto (1)

YARA-L (1)

Event ID 4698

#

27 detection rules reference this event. View event page.

Sigma (7)

Elastic (3)

Splunk (16)

Kusto (1)

Event ID 4699

#

7 detection rules reference this event. View event page.

Sigma (4)

Elastic (1)

Splunk (1)

Kusto (1)

Event ID 4700

#

4 detection rules reference this event. View event page.

Splunk (3)

Kusto (1)

Event ID 4701

#

3 detection rules reference this event. View event page.

Sigma (2)

Kusto (1)

Event ID 4702

#

7 detection rules reference this event. View event page.

Sigma (2)

Elastic (1)

Splunk (3)

Kusto (1)

Event ID 4703

#

3 detection rules reference this event. View event page.

Elastic (1)

Splunk (2)

Event ID 4704

#

3 detection rules reference this event. View event page.

Sigma (2)

Elastic (1)

Event ID 4706

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4717

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4719

#

6 detection rules reference this event. View event page.

Sigma (3)

Elastic (1)

Splunk (2)

Event ID 4720

#

17 detection rules reference this event. View event page.

Sigma (8)

Splunk (5)

Kusto (3)

YARA-L (1)

Event ID 4722

#

4 detection rules reference this event. View event page.

Sigma (1)

Splunk (1)

Kusto (2)

Event ID 4723

#

9 detection rules reference this event. View event page.

Sigma (2)

Splunk (5)

Kusto (2)

Event ID 4724

#

10 detection rules reference this event. View event page.

Sigma (4)

Elastic (1)

Splunk (4)

Kusto (1)

Event ID 4725

#

3 detection rules reference this event. View event page.

Splunk (2)

Kusto (1)

Event ID 4726

#

6 detection rules reference this event. View event page.

Sigma (1)

Splunk (3)

Kusto (1)

YARA-L (1)

Event ID 4727

#

5 detection rules reference this event. View event page.

Sigma (1)

Splunk (3)

Kusto (1)

Event ID 4728

#

21 detection rules reference this event. View event page.

Sigma (12)

Elastic (2)

Splunk (4)

Kusto (3)

Event ID 4729

#

2 detection rules reference this event. View event page.

Sigma (1)

Kusto (1)

Event ID 4730

#

2 detection rules reference this event. View event page.

Sigma (1)

Splunk (1)

Event ID 4731

#

4 detection rules reference this event. View event page.

Sigma (1)

Splunk (2)

Kusto (1)

Event ID 4732

#

20 detection rules reference this event. View event page.

Sigma (11)

Elastic (1)

Splunk (4)

Kusto (4)

Event ID 4733

#

2 detection rules reference this event. View event page.

Splunk (1)

Kusto (1)

Event ID 4734

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4735

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4737

#

2 detection rules reference this event. View event page.

Sigma (1)

Splunk (1)

Event ID 4738

#

19 detection rules reference this event. View event page.

Sigma (9)

Elastic (3)

Splunk (6)

Kusto (1)

Event ID 4741

#

6 detection rules reference this event. View event page.

Sigma (4)

Splunk (2)

Event ID 4742

#

17 detection rules reference this event. View event page.

Sigma (9)

Elastic (1)

Splunk (7)

Event ID 4743

#

2 detection rules reference this event. View event page.

Sigma (1)

Splunk (1)

Event ID 4744

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4749

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4754

#

3 detection rules reference this event. View event page.

Sigma (1)

Splunk (1)

Kusto (1)

Event ID 4755

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4756

#

16 detection rules reference this event. View event page.

Sigma (11)

Elastic (1)

Splunk (1)

Kusto (3)

Event ID 4757

#

1 detection rules reference this event. View event page.

Kusto (1)

Event ID 4759

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4764

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4765

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4766

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4768

#

26 detection rules reference this event. View event page.

Sigma (10)

Elastic (2)

Splunk (12)

Kusto (2)

Event ID 4769

#

24 detection rules reference this event. View event page.

Sigma (10)

Elastic (3)

Splunk (7)

Kusto (4)

Event ID 4770

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4771

#

6 detection rules reference this event. View event page.

Sigma (4)

Splunk (2)

Event ID 4776

#

9 detection rules reference this event. View event page.

Sigma (4)

Splunk (5)

Event ID 4778

#

2 detection rules reference this event. View event page.

Splunk (2)

Event ID 4779

#

3 detection rules reference this event. View event page.

Splunk (3)

Event ID 4780

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4781

#

8 detection rules reference this event. View event page.

Sigma (5)

Elastic (1)

Splunk (2)

Event ID 4783

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4790

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4794

#

3 detection rules reference this event. View event page.

Sigma (2)

Splunk (1)

Event ID 4798

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4799

#

5 detection rules reference this event. View event page.

Sigma (3)

Elastic (1)

Splunk (1)

Event ID 4800

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4825

#

2 detection rules reference this event. View event page.

Sigma (2)

Event ID 4876

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4882

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4886

#

5 detection rules reference this event. View event page.

Sigma (1)

Splunk (3)

Kusto (1)

Event ID 4887

#

7 detection rules reference this event. View event page.

Sigma (1)

Elastic (1)

Splunk (4)

Kusto (1)

Event ID 4888

#

1 detection rules reference this event. View event page.

Kusto (1)

Event ID 4890

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4891

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4892

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4898

#

2 detection rules reference this event. View event page.

Sigma (2)

Event ID 4899

#

2 detection rules reference this event. View event page.

Sigma (2)

Event ID 4904

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4905

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4946

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4947

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4948

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 4950

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 4964

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 5038

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 5058

#

1 detection rules reference this event. View event page.

Kusto (1)

Event ID 5059

#

1 detection rules reference this event. View event page.

Kusto (1)

Event ID 5123

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 5124

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 5136

#

73 detection rules reference this event. View event page.

Sigma (20)

Elastic (11)

Splunk (24)

Kusto (18)

Event ID 5137

#

16 detection rules reference this event. View event page.

Sigma (1)

Elastic (5)

Splunk (5)

Kusto (5)

Event ID 5138

#

2 detection rules reference this event. View event page.

Splunk (1)

Kusto (1)

Event ID 5139

#

2 detection rules reference this event. View event page.

Splunk (1)

Kusto (1)

Event ID 5140

#

13 detection rules reference this event. View event page.

Sigma (5)

Splunk (8)

Event ID 5141

#

4 detection rules reference this event. View event page.

Splunk (2)

Kusto (2)

Event ID 5142

#

2 detection rules reference this event. View event page.

Sigma (2)

Event ID 5143

#

3 detection rules reference this event. View event page.

Sigma (2)

Kusto (1)

Event ID 5145

#

70 detection rules reference this event. View event page.

Sigma (43)

Elastic (9)

Splunk (16)

Kusto (2)

Event ID 5152

#

19 detection rules reference this event. View event page.

Elastic (1)

Splunk (1)

Kusto (17)

Event ID 5154

#

18 detection rules reference this event. View event page.

Splunk (1)

Kusto (17)

Event ID 5155

#

17 detection rules reference this event. View event page.

Kusto (17)

Event ID 5156

#

51 detection rules reference this event. View event page.

Sigma (3)

Splunk (15)

Kusto (19)

YARA-L (14)

Event ID 5157

#

20 detection rules reference this event. View event page.

Sigma (1)

Elastic (1)

Splunk (1)

Kusto (17)

Event ID 5158

#

17 detection rules reference this event. View event page.

Kusto (17)

Event ID 5159

#

17 detection rules reference this event. View event page.

Kusto (17)

Event ID 5379

#

3 detection rules reference this event. View event page.

Sigma (3)

Event ID 5382

#

2 detection rules reference this event. View event page.

Sigma (1)

Elastic (1)

Event ID 5441

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 5447

#

3 detection rules reference this event. View event page.

Sigma (2)

Splunk (1)

Event ID 5448

#

1 detection rules reference this event. View event page.

Splunk (1)

Event ID 5449

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 6281

#

1 detection rules reference this event. View event page.

Sigma (1)

Event ID 6416

#

3 detection rules reference this event. View event page.

Sigma (2)

Splunk (1)

Event ID 6423

#

1 detection rules reference this event. View event page.

Sigma (1)