Spotting the Adversary with Windows Event Log Monitoring
Spotting the Adversary with Windows Event Log Monitoring
Spotting the Adversary with Windows Event Log Monitoring
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
wecutil ss SubscriptionId /cf:RenderedText /e:true<br />
<strong>Log</strong>on Using Explicit Credentials (XP_ExpCreds.xml)<br />
<br />
XP_ExpCreds<br />
SourceInitiated<br />
true<br />
http://schemas.microsoft.com/wbem/wsman/1/windows/<strong>Event</strong><strong>Log</strong><br />
Custom<br />
<br />
1<br />
1000<br />
<br />
<br />
<br />
<br />
<br />
<br />
*[System[(Level=4 or Level=0) and <strong>Event</strong>ID=552]]<br />
<br />
<br />
]]><br />
true<br />
httpRenderedText<br />
Forwarded<strong>Event</strong>s<br />
<br />
<br />
<br />
Account Locked Out (XP_LockedOut.xml)<br />
<br />
XP_LockedOut<br />
SourceInitiated<br />
User Account Locked Outtrue<br />
http://schemas.microsoft.com/wbem/wsman/1/windows/<strong>Event</strong><strong>Log</strong><br />
Custom<br />
<br />
1<br />
1000<br />
<br />
<br />
<br />
<br />
<br />
*[System[(Level=4 or Level=0) and <strong>Event</strong>ID=644]]<br />
<br />
]]><br />
true<br />
httpRenderedText<br />
Forwarded<strong>Event</strong>s<br />
<br />
<br />
<br />
Account <strong>Log</strong>ons (XP_<strong>Log</strong>ons.xml)<br />
<br />
XP_<strong>Log</strong>ons<br />
SourceInitiated<br />
Non-Kerberos Success/Failed <strong>Log</strong>onstrue<br />
http://schemas.microsoft.com/wbem/wsman/1/windows/<strong>Event</strong><strong>Log</strong><br />
Custom<br />
<br />
11000<br />
<br />
<br />
<br />
<br />
*[System[(Level=4 or Level=0) and (<strong>Event</strong>ID=529 or <strong>Event</strong>ID=528 or <strong>Event</strong>ID=540)]]<br />
<br />
]]><br />
true<br />
httpRenderedText<br />
Forwarded<strong>Event</strong>s<br />
<br />
<br />
<br />
System <strong>Log</strong> Errors (XP_Sys<strong>Log</strong>Err.xml)<br />
47
Change language