Spotting the Adversary with Windows Event Log Monitoring
Spotting the Adversary with Windows Event Log Monitoring
Spotting the Adversary with Windows Event Log Monitoring
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>Log</strong>ons<br />
SourceInitiated<br />
Non-Kerberos Success/Failed <strong>Log</strong>onstrue<br />
http://schemas.microsoft.com/wbem/wsman/1/windows/<strong>Event</strong><strong>Log</strong><br />
Custom<br />
<br />
11000<br />
<br />
<br />
<br />
<br />
*[System[(Level=4 or Level=0) and (<strong>Event</strong>ID=4624 or <strong>Event</strong>ID=4625)]]<br />
and<br />
*[<strong>Event</strong>Data[Data[@Name='Au<strong>the</strong>nticationPackageName'] != 'Kerberos']]<br />
and<br />
*[<strong>Event</strong>Data[Data[@Name='TargetUserName'] != 'ANONYMOUS LOGON']]<br />
<br />
]]><br />
true<br />
http<br />
<strong>Event</strong>s<br />
Forwarded<strong>Event</strong>s<br />
<br />
<br />
<br />
Application Crash, Hangs and <strong>Windows</strong> Error Reporting (AppCrash.xml)<br />
<br />
AppCrash<br />
SourceInitiated<br />
AppCrash and AppHang and WER <strong>Log</strong>s. Targets: <strong>Windows</strong> XP+<br />
true<br />
http://schemas.microsoft.com/wbem/wsman/1/windows/<strong>Event</strong><strong>Log</strong><br />
Custom<br />
<br />
1<br />
1000<br />
<br />
<br />
*[System[Provider[@Name='Application Error'] and (Level=2)]]<br />
<br />
*[System[Provider[@Name='Application Hang'] and (Level=2)]]<br />
<br />
*[System[Provider[@Name='<strong>Windows</strong> Error Reporting'] and (Level=4 or Level=0)]]<br />
<br />
]]><br />
true<br />
httpRenderedText<br />
Forwarded<strong>Event</strong>s<br />
<br />
<br />
<br />
Blue Screen of Death (BSODErr.xml)<br />
<br />
BSODErr<br />
SourceInitiated<br />
<strong>Windows</strong> Blue Screen of Death. Targets: <strong>Windows</strong> XP+<br />
true<br />
http://schemas.microsoft.com/wbem/wsman/1/windows/<strong>Event</strong><strong>Log</strong><br />
Custom<br />
<br />
1<br />
1000<br />
<br />
<br />
*[System[Provider[@Name='Microsoft-<strong>Windows</strong>-WER-SystemErrorReporting'] and (Level=2)]]<br />
*[System[Provider[@Name='System Error'] and (<strong>Event</strong>ID=1003)]]<br />
*[System[Provider[@Name='Save Dump'] and (<strong>Event</strong>ID=1001)]]<br />
<br />
<br />
]]><br />
true<br />
http<br />
<strong>Event</strong>s<br />
<br />
Forwarded<strong>Event</strong>s<br />
<br />
<br />
<br />
41
Change language