Microsoft Defender for Endpoint

This inventory contains data from HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection. Last updated: 15 July 2026

Provider	Rule bindings
Anaheim-SmartScreen	No event ID assigned UriLookup BreakTheGlass
Anti Tampering	Event ID 1 ETW Provider tampering Event ID 2 Process tampering Event ID 3 Com tampering
Application Error	Event ID 1000: Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name. UserCrashLog
AppLocker	Event ID 8001: The AppLocker policy was applied successfully to this computer. Srp New Policy Applied Event ID 8003: RuleAndFileData.FilePath was allowed to run but would have been prevented from running if the AppLocker policy were enforced. AppLocker Process Audit Event ID 8004: FilePathBuffer was prevented from running. AppLocker Process Block Event ID 8006: FilePathBuffer was allowed to run but would have been prevented from running if the AppLocker policy were enforced. AppLocker Script Audit Event ID 8007: FilePathBuffer was prevented from running. AppLocker Script Block Event ID 8021: PackageBuffer was allowed to run but would have been prevented from running if the AppLocker policy were enforced. AppLocker Appx Process Audit Event ID 8022: PackageBuffer was prevented from running. AppLocker Appx Process Block Event ID 8024: PackageBuffer was allowed to run but would have been prevented from running if the AppLocker policy were enforced. AppLocker Appx script Audit Event ID 8025: PackageBuffer was prevented from running. AppLocker Appx script Block Event ID 8028: FilePath was allowed to run but would have been prevented if the Config CI policy were enforced. Wldp Script File Audited Event ID 8029: FilePath was prevented from running due to Config CI policy. Wldp Script File Disabled
AttackSurfaceMonitor	No event ID assigned Device creation via AST Device IOCTL called
Audit-CVE	Event ID 1: Possible detection of CVE: PossibleDetectionOfCVE. CveEventWrite
Bits-Client	Event ID 3: The BITS service created a new job: jobTitle, with owner jobId. EVT_JOB_CREATION Event ID 5: Job cancelled. EVT_JOB_CANCEL Event ID 16384: The administrator User canceled job "Title" on behalf of Owner. BITS_EV_JOB_CANCELLED Event ID 16388: The administrator User took ownership of job "Title" from Owner. BITS_EV_JOB_TAKE_OWNERSHIP Event ID 16403: task_016403 EVT_JOB_ADDFILE
Bluetooth-Policy	Event ID 7: Bluetooth has Accepted service ServiceGuid on remote device BtAddr due to policy PolicyPath\PolicyName. Bluetooth_PolicyServiceBlockAudit
CodeIntegrity	Event ID 3023: The driver FileNameBuffer is blocked from loading as the driver has been revoked by Microsoft. CiRevokedDriverNotLoaded Event ID 3036: Windows is unable to verify the integrity of the file FileNameBuffer because the signing certificate has been revoked. CiRevokedImageNotLoaded Event ID 3076: Code Integrity determined that a process (Process Name) attempted to load File Name that did not meet the Requested Signing Level signing level requirements or violated code integrity p... DeviceGuard policy failure audit Event ID 3077: Code Integrity determined that a process (Process Name) attempted to load File Name that did not meet the Requested Signing Level signing level requirements or violated code integrity p... DeviceGuard policy failure Event ID 3089: Signature information for another event. Code Integrity signature information Event ID 3090: Code Integrity testing module FileName against policy PolicyName. Smartlocker Operational Success Event ID 3091: Code Integrity testing module FileName against policy PolicyName. Smartlocker Operational Audit Event ID 3092: Code Integrity testing module FileName against policy PolicyName. Smartlocker Operational Failure Event ID 3099: Refreshed and activated Code Integrity policy PolicyGUID PolicyNameBuffer. Activate Policy Succeded
Crypto-DPAPI-Events	Event ID 16385: DPAPIDefInformationEvent DPAPI Crypt Data
Dhcp-Client	Event ID 50028: Address Address is plumbed on the interface InterfaceId. DhcpAddressPlumbed Event ID 50029: Address Address is unplumbed on the interface InterfaceId. DhcpAddressUnplumbed
DHCPV6-Client-Events	Event ID 51039: Address Address is plumbed on the interface InterfaceId. DhcpV6AddressPlumbed Event ID 51040: Address Address is unplumbed on the interface InterfaceId. DhcpV6AddressUnplumbed
DNS-Client	Event ID 3010: DNS Query sent to DNS Server DnsServerIpAddress for name QueryName and type QueryType. Send query to DNS server Send query to DNS server Aggregation Event ID 3020: Query response for name QueryName, type QueryType, interface index NetworkIndex and network index InterfaceIndex returned Status with results QueryResults. Dns query response
DotNETRuntime	Event ID 152: ModuleID=ModuleID. CLR ModuleDCStart
EDP-Audit-Regular	Event ID 201: DataInfo has been copied (Policy) from SourceAppName (tagged as SourceEnterpriseId) to DestinationAppName (tagged as DestinationEnterpriseId). WIP Sensitive Data Copied Event ID 301: Object has been changed from SourceName (tagged as SourceEnterpriseId) to DestinationName (tagged as DestinationEnterpriseId) in ApplicationName. WIP Application Generated
EDP-Audit-TCB	Event ID 101: Enterprise PreviousEnterpriseId tag has been removed (Policy) from the file: FilePath. WIP File Protection Removed
FilterManager	Event ID 6: File System Filter 'DeviceName'. FLTMGR_FILTER_REGISTERED
Generic ETW CreateFile Pattern	Event ID 1 Remote Non PE Create File Event PE Create File Event SMB create File Event Outlook Create File Event Non PE Create File Event Shell Link Create File Event Shell Link Create File Event (Remote) WDATP Tampering Create File Event WDATP Program Files Create File Event User Create File Event Browsers Create File Event Email Archive Create File Event
IE-SmartScreen	Event ID 1100: task_0 UrlBlockLookup
Kernel Integrity	Event ID 1 KernelIntegrityCheck
Kernel-Audit-API-Calls	Event ID 3: task_03 ObMgrSymlinkCreation
Kernel-Network	Event ID 10: TCPv4: size bytes transmitted from saddr:sport to daddr:dport. Kernel network bytes sent TCP IPv4 non Filtered Kernel Network Byte Send IPv4 Filtered Event ID 11: TCPv4: size bytes received from saddr:sport to daddr:dport. Kernel network bytes received TCP IPv4 non Filtered Event ID 26: TCPv6: size bytes transmitted from saddr:sport to daddr:dport. Kernel network bytes sent TCP IPv6 non Filtered Event ID 27: TCPv6: size bytes received from saddr:sport to daddr:dport. Kernel network bytes received TCP IPv6 non Filtered
Kernel-PnP-Events	Event ID 400: Device DeviceInstanceId was configured. Device Config Success by policy Event ID 402: Device Driver_Name had its configuration blocked by policy. configuration blocked by policy
Ldap-Client	Event ID 30: LDAP search request Ldap Search
LiveId	Event ID 11008: +. Function token provider
LsaSrv	Event ID 300: Groups assigned to a new logon. LsaSrv UI user LsaSrv UI computer account Event ID 6041: A CredSSP authentication to TargetName failed to negotiate a common protocol version. Encryption oracle remediation
Machine state	Event ID 2 WDAV state Event ID 3 Firewall state Event ID 4 CodeIntegrity state Event ID 5 AppGuard state Event ID 6 SmartScreen state Event ID 7 KernelIntegrity state Event ID 8 AntiExploit State Event ID 9 HIPS ASR state Event ID 10 FolderGuard state Event ID 11 Windows Updates state Event ID 12 Machine properties state Event ID 13 BitLocker state Event ID 16 Firmware State Event ID 17 KB Item State Event ID 18 KB Index State Event ID 19 Isolation State Event ID 20 Azure Vm Metadata State Event ID 21 Effective Configuration Event ID 22 Capabilities State Event ID 1000 WDAV tamper-protection (Windows Defender configuration) Event ID 1001 WDAV tamper-protection (Windows Defender configuration) Event ID 1002 Timna - Information Gathering No event slot assigned Timna - OXO HKLM reg keys Onboarding information collection Url Cache Size Timna - VA - .NET Framework Timna - VA - Office click to run Timna - secure configuration - application configuration (compatibility) Timna - Internet Explorer - version information Timna - SCA configurations Timna - KBs AppUsage process list Timna - Firmware - TPM Timna - Internet Explorer Installation Status Timna - Firmware - BaseBoard Timna - Firmware - Bios Timna - Local Users Timna - Computer system information Timna - Add or remove programs Timna - Add or remove programs - WOW6432Node Timna - Add or remove programs (hkey_users) Timna - Add or remove programs - WOW6432Node (hkey_users) Registry collection AppGuard state GP Network protection configuration Timna - secure configuration LDAP Security Configuration Disable Remote Registry Service Disable NTLM authentication for Windows workstations Exchange OwaVersion Collection SCA WMI Defender configurations XSPM - TPM Status XSPM - RDP Status XSPM - HKLM PowerShell Execution Status
Microsoft-Antimalware-Engine	Event ID 69: Message UefiFirmwareVolume Event ID 74: SenseRemediationTask AVEngineBASTelemetry AVEngineThreatTelemetry AVEngineNonThreatTelemetry Event ID 76: SenseHeartbeatTask AvDeviceHeartbeat Event ID 95: Behavior Monitoring BmFileOverwriteEvent
Microsoft-Antimalware-RTP	Event ID 25: DCEvent DC_RemovableStorageRWE Event ID 26: DCEvent26 DC_DataDuplicationEvent Event ID 28: DCEvent28 DC_DevicePresenceEvent Event ID 29: DCEvent29 DC_HealthReportEvent
Microsoft-Antimalware-Scan-Interface	Event ID 1101: AmsiScanBuffer AMSIScan AMSIContent AMSIContentForIIS AMSIContentForDotNet VssAmsiContent
Microsoft-Antimalware-Service	Event ID 48: Sense_RemediationInfoThreat RemediationInfo Event ID 49: Sense_HipsFGInfo HIPS Event ID 50: Sense_NetworkFilterLookup NetworkFilterLookup Event ID 51: Sense_NetworkFilterConnectionInfo NetworkFilterConnectionInfo Event ID 55: Sense_NetworkFilterBreakTheGlass NetworkFilterBypass Event ID 56: Sense_HipsAsrUserExclusionInfo HipsAsrUserExclusionInfo Event ID 60: Sense_TroubleshootingModeNotification TroubleshootingModeNotification Event ID 67: Sense_TamperProtectionNotification TamperProtectionNotification Event ID 70: Sense_DisruptionExclusionsHardeningEvent MpPreferenceExclusionsHardening Event ID 76 PolicyExclusionsHardening
Microsoft-Antimalware-UacScan	Event ID 1201: UacScan UacScanExe UacScanCom UacScanPackagedApp UacScanOther
Microsoft-ThreatProtectionService	No event ID assigned SqliStatelessDetector
microsoft-windows-grouppolicy	Event ID 5308: Domain Controller details. DomainControllerDiscovery
Microsoft.Office.Security	No event ID assigned Office SafeDocs file scanning
Microsoft.Windows.ComOleAut32	No event ID assigned Com OleAut32 - TypeLibVerifyTrust Com OleAut32 - TypeLibMonikerFallback Com OleAut32 - TypeLibRegister Com OleAut32 - TypeLibLoad Com OleAut32 - TypeLibMonikerLoad Com OleAut32 - GetDocumentationDllLoad
Microsoft.Windows.Console.Host	No event ID assigned conhost cooked read buffer
Microsoft.Windows.Defender	No event ID assigned Legacy Process Creation Elam bypass
Microsoft.Windows.FileSystem.CloudFiles	No event ID assigned CfRegisterSyncRoot_Success
Microsoft.Windows.HVSI.ContainerService	No event ID assigned CreateVMEnd SuspendComputeSystemEnd ResumeComputeSystemEnd
Microsoft.Windows.HVSI.Manager	No event ID assigned LaunchDocumentInContainer
Microsoft.Windows.HyperV.Compute	No event ID assigned ContainerStopped
Microsoft.Windows.NdrCollector	No event ID assigned ModelCollectorNdrScanner NdrCollectorHyperVVmDiscovery NdrCollectorAdUserComputer NdrCollectorAdUserComputerV2 NdrCollectorAdUserComputerV3 NdrCollectorLdapExchangeServerV3 NdrCollectorVirtualMachineInfo NdrCollectorHyperVVmDiscoveryV2 NdrCollectorDomainTrust NdrCollectorDomainController NdrCollectorAdcaInfo NdrCollectorAadConnectInfo NdrCollectorAadConnectInfoV2 NdrCollectorDiscoveredAadConnectInfo NdrCollectorSccmInfo NdrCollectorSccmAgentInfo NdrCollectorAdfsInfoV2 NdrCollectorDefaultGatewayDiscovery NdrCollectorVeritasBackupExecInfo
Microsoft.Windows.NdrScanner	No event ID assigned NdrScannerDefaultGatewayDiscovery NdrScannerSsh SipDiscoveryNdrScanner SnmpDiscoveryNdrScanner WsDiscoveryNdrScanner mDnsNdrScanner UPnPNdrScanner NdrScannerTelemetry NdrCveLocalScanner NdrScannerBannerGrab NdrScannerFtpBannerGrab NdrScannerHostDiscovery NdrScannerPortScan NdrScannerHttpProbe NdrScannerIcmp NdrScannerIpp NdrScannerWsdExtension NdrScannerNetBios NdrScannerSmb NdrScannerSmbV1 NdrScannerPjl NdrScannerCrestronIP NdrScannerLdap NdrScannerAfp NdrScannerRdpNla NdrScannerNtlm ShieldsUpSetupResults NdrScannerIphoneSync NdrScannerAirplay NdrScannerRpcMapper NdrScannerVnc NdrScannerSlp NdrLdapComputerDiscovery NdrScannerSpring4Shell SnmpExtendedDiscoveryNdrScanner
Microsoft.Windows.Oct.Enclave	No event ID assigned SGRM Assertion Event
Microsoft.Windows.OLE.Clipboard	No event ID assigned OLE Clipboard Get Data
Microsoft.Windows.Print.Winspool	No event ID assigned Print Job Created
Microsoft.Windows.Security.Wininit	No event ID assigned lsaIsoStartupCheck LsassStarted
Microsoft.Windows.Security.Wsc	No event ID assigned WSC RegisterAntiVirus WSC UnregisterAntiVirus
Microsoft.Windows.Sense.AccountsLockoutProvider	No event ID assigned AccountLockoutPolicy
Microsoft.Windows.Sense.BrowserExtensionCollection	No event ID assigned CollectedBrowserExtensions TvmCollectedBrowserExtensionsIndex
Microsoft.Windows.Sense.CollectionEtw	No event ID assigned AWS CLI authentication data Azure CLI authentication data GCP ADC Authentication Data GCP Gcloud CLI Authentication Data DangerousWifiProfiles LocalServices LocalServicesIndex Timna - Products files scanning Timna - open handles scanning Timna - Products files scanning index DataCollection - Certificate not installed DataCollection - execution policy reduced Logon Audit Security Policy Browser data logged Azure user Browser data logged AWS user Browser data logged Azure users unified Browser data logged AWS users unified Azure CLI Authentication Data Unified AWS CLI Authentication Data Unified GCP ADC Authentication Data Unified GCP Gcloud CLI Authentication Data Unified DataCollection - Action response DataCollection - Action failure
Microsoft.Windows.Sense.ConnectivityChecker	No event ID assigned ConnectivityCheckerReport ConnectivityCheckerFailure
Microsoft.Windows.Sense.GeneratedETW	No event ID assigned HangDetection - report a hung component HangDetection - looking for hung components ResourceManagerEvent OfflineCommandStatus IsolationAutoRecoveryHandler IsolationStartup_IsolationAfterReboot PlatformUpdateStatus PlatformUpdateStatus_Collector Create process using G-ETW OsInfo OsSettings SecurityLogCleared LogCleared StorageVolumeInformation Policy dispatcher critical error PSScriptSignatureValidation_Mismatch RunPSScript_InvalidSasUrl RunPSScript_InvalidValidationConfig OnlineActionSampler_InvalidCmd FirewallConfiguratorApplyEvent FirewallConfiguratorRemoveEvent FirewallConfiguratorGeneralEvent LMF Policy Applied LMF force close SMB session LMF force disconnect WTS session LMF force logoff WTS session SmbBouncerPolicy policy applied Geppetto policy applied Geppetto policy removal SBG policy applied SBG policy removed SBG mitigation RiskAssessment policy applied RiskAssessment policy removed WDAC policy applied WfpConfigurator policy applied WfpConfigurator policy removed DeviceContain policy applied DeviceContain policy did not match DeviceContain policy removed OffboardingEpochBlock policy applied Offboarding blob epoch blocked Offboarding blob epoch blocked - audit WfpGuard Policy Applied DLP Telemetry Event DLP Operational Information CrashCollector_CrashReport CrashCollector_WER InternalOpticsEvent InternalOpticsCompressedEvent Sense Uploaded Size PerformanceCounterProcessAndSystem PerformanceCounterProcess Orchestrator info Orchestrator error SenseService_ShutdownEvent SenseService_StopEvent SenseService_RestartEvent SenseService_UpdateInfoEvent SenseService_UpdateFailedEvent LogicResolverTelemetry
Microsoft.Windows.Sense.Immune	No event ID assigned Driver Collection Event ImmuneCodeIntegrity ImmuneComTelemetry ImmuneComAnalyzer
Microsoft.Windows.Sense.LocalGroupsUsersCollection	No event ID assigned Timna - LocalGroupsUsers
Microsoft.Windows.Sense.Olympus	No event ID assigned ADFS pre-authentication ADFS post-authentication
Microsoft.Windows.Sense.PasswordPolicyProvider	No event ID assigned PasswordPolicy
Microsoft.Windows.Sense.PendingRebootUpdates	No event ID assigned Timna - Pending Reboot Collection
Microsoft.Windows.Sense.RegHeartBeat	No event ID assigned Possible ACL Tampering
Microsoft.Windows.Sense.ResearchCollectionEtw	No event ID assigned WfpFilterAudit WfpFilterDelete
Microsoft.Windows.Sense.ScheduledTasksCollection	No event ID assigned ScheduledTasks
Microsoft.Windows.Sense.SenseCm	No event ID assigned SenseCM CheckinScriptResults
Microsoft.Windows.Sense.SenseCm	No event ID assigned CheckinScriptResults
Microsoft.Windows.Sense.SharesCollection	No event ID assigned Shares
Microsoft.Windows.Sense.SubAuth	No event ID assigned SubAuth user logon audited SubAuth user logon blocked SubAuth initialization completion SubAuth package conflict detection SubAuth policy updated SubAuth policy removed
Microsoft.Windows.Sense.TimnaProductsFromRegistry	No event ID assigned Timna - Products From Registry 64 PowerShell Timna - Products From Registry 6432 PowerShell Timna - Products From User Registry 64 PowerShell Timna - Products From User Registry 6432 PowerShell
Microsoft.Windows.Sense.Tvm.Axon	No event ID assigned Timna - SenseTVM registry programs collection event Timna - SenseTVM windows programs collection event Timna - SenseTVM windows services collection event Timna - SenseTVM browser extensions collection event Timna - SenseTVM certificates collection event Timna - SenseTVM pending updates collection event Timna - SenseTVM ms store appx collection event Timna - SenseTVM windows KBs collection event Timna - SenseTVM PE collection event Timna - SenseTVM dev library collection event Timna - SenseTVM regex file extraction collection event Timna - SenseTVM JSON config collection event Timna - SenseTVM device info event Timna - SenseTVM windows device info event Timna - SenseTVM telemetry event Timna - SenseTVM scrubbed telemetry event
Microsoft.Windows.Sense.Tvm.Collector	No event ID assigned Timna - VA collector event TvmCveLocalScanner Outbound block windows firewall rules that have no exceptions/scoping Collect Local security policy user rights assignments Collect device users roles info and authority Collect device services info
Microsoft.Windows.Sense.Tvm.NetworkScanner	No event ID assigned NetworkScanOutput NetworkScanAgentTrace Petra - Scan command status Timna - Internet Explorer Installation Status (Petra4Windows) Timna - KBs (Petra4Windows) Timna - Computer system information (Petra4Windows) Timna - Firmware - BaseBoard (Petra4Windows) Timna - Firmware - Bios (Petra4Windows) Timna - Local Users (Petra4Windows) Timna - Firmware - TPM (Petra4Windows) Timna - VA - .NET Framework (Petra4Windows) Timna - VA - Office click to run (Petra4Windows) Timna - Internet Explorer - version information (Petra4Windows) Timna - Add or remove programs (Petra4Windows) Timna - Add or remove programs - WOW6432Node (Petra4Windows) Timna - Add or remove programs (hkey_users) (Petra4Windows) Timna - Add or remove programs - WOW6432Node (hkey_users) (Petra4Windows) Petra - Operating system data (Petra4Windows) Petra - Computer system data (Petra4Windows) Timna - secure configuration - application configuration (compatibility) (Petra4Windows) Timna - SCA configurations (Petra4Windows) Timna - secure configuration (Petra4Windows) Timna - Information Gathering (Petra4Windows)
Microsoft.Windows.Sense.TvmBaselineAssessorEtw	No event ID assigned TvmBaselineAssessor
Microsoft.Windows.Sense.TvmCertificateCollectionEtw	No event ID assigned TvmCertificateCollection TvmCertificateIndexCollection
Microsoft.Windows.Sense.TvmInfoGatheringCollectorEtw	No event ID assigned TvmInfoGatheringCollector
Microsoft.Windows.Sense.ValidationEtw	No event ID assigned DataCollection - Parent Validation
Microsoft.Windows.Sense.WDCollection	No event ID assigned MDATP Security Baseline - AntiVirus
Microsoft.Windows.SenseComponent.GeneratedETW	No event ID assigned PerformanceCounterProcessAndSystem PerformanceCounterProcess
Microsoft.Windows.SenseNdr	No event ID assigned SenseNdrMdns SenseNdrMdnsCveLog4j SenseNdrDhcp SenseNdrDhcpV6 SenseNdrLldp SenseNdrLlmnr SenseNdrSsdp SenseNdrCDP SenseNdrArp SenseNdrArpRequest SenseNdrTcpHeader SenseNdrNbns SenseNdrMndp SenseNdrWsd SenseNdrUdpHeader SenseNdrIPHeader SenseNdrTcpHeaderSynPackets SenseNdr Telemetery ZeekSetupStatusEvent SenseNdrInfo SenseNdrError SenseNdrThrottling SenseNdrSignaturePii SenseNdrSignatureNtlm SenseNdrSignatureSmbServerGuid SenseNdrSignatureMsBrowser SenseNdrSignatureHttpServerHeader SenseNdrSignaturePublicIpScan SenseNdrSignaturePublicIpScanUdp SenseNdrSignatureIphoneSync SenseNdrSignatureCveDetection SenseNdrSignatureSpring4Shell SenseNdrSignatureKerberos SenseNdrSignatureLdapRbcdModify SenseNdrSignatureMsMsdt SenseNdrSignatureJavaReferenceOverLdap SenseNdrSignatureSkypeSsrf SenseNdrZeekSignatureBacnetBroadcastDiscovery SenseNdrZeekSignatureBacnetFW SenseNdrZeekSignatureBacnetLocation SenseNdrZeekSignatureBacnetModel SenseNdrZeekSignatureBacnetHostname SenseNdrZeekSignatureBacnetVendorCode SenseNdrZeekSignatureBacnetVendorName SenseNdrSignatureDns SenseNdrSignatureDnsCveLog4j SenseNdrSignatureJavaRMI SenseNdrSignatureSrvSvc SenseNdrSignatureWakeOnLan SenseNdrSignatureNegoEx SenseNdrSignaturePointOfCareTesting SenseNDRSignatureProfinetEPM SenseNDRSignatureProfinetIMZeroFive SenseNDRSignatureProfinetAssetManagement SenseNdrZeekDceRpc SenseNdrZeekSamr SenseNdrZeekSrvSvc SenseNdrZeekDns SenseNdrZeekFtp SenseNdrZeekConnTcp SenseNdrZeekConnUdp SenseNdrZeekSignature SenseNdrZeekDhcpV6Exploit SenseNdrZeekSmbGhost SenseNdrZeekIcmp SenseNdrZeekHttp SenseNdrZeekNtlm SenseNdrZeekSmbServerGuid SenseNdrZeekSsh SenseNdrZeekSmtp SenseNdrZeekKerberos SenseNdrZeekSsl SenseNdrZeekSmbFiles SenseNdrZeekSmbMapping SenseNdrZeekFiles SenseNdrZeekWireguard SenseNdrZeekNotice SenseNdrZeekPrintNightmare ZeekNdrRunnerEvent SenseNdrZeekStatistics SenseNdrZeekHealthLevelSeven SenseNdrZeekPointOfCareTesting SenseNdrZeekDicom SenseNdrZeekModbus SenseNdrZeekSnmp SenseNdrZeekEnip SenseNdrZeekCip SenseNDRZeekBacnetProperty SenseNDRZeekBacnetIAmVendor SenseNdrZeekModbusReadDeviceID SenseNdrZeekNicteaming SenseNdrZeekBacnetProperty SenseNdrZeekS7CommPlus SenseNdrZeekSignatureS7Comm SenseNdrZeekBoundarySix SenseNdrZeekReporterEvent SenseNdrZeekKerberosAuthTicketOut SenseNdrZeekKerberosAuthTicketIn SenseNdrZeekKerberosTgs SenseNdrSignatureTCPCIPGetAll SenseNdrSignatureUDPCIPGetAll SenseNdrSignatureTCPCIPGetSingle SenseNdrSignatureUDPCIPGetSingle SenseNdrSignatureUDPENIPListCIPIdentity SenseNdrSignatureTCPENIPListCIPIdentity SenseNdrSignatureBacnetBroadcastDiscovery SenseNdrSignatureBacnetProperty SenseNdrSignatureSNMPSysDescription SenseNdrSignatureSNMPSysName SenseNdrSignatureS7CommReadSZL_0111 SenseNdrSignatureS7CommReadSZL_001C SenseNdrSignatureS7CommReadSZL_0011 SenseNdrSignatureModbusReadDeviceID SenseNDRSignatureSiemensSICAM SenseNDRSignatureS7CommPlusCreateObject SenseNDRSignatureS7CommPlusGetVarSubStreamed SenseNDRSignatureS7CommPlusGeneric SenseNDRSignatureCSP2DiagnosticStatusResponseLocal SenseNDRSignatureCSP2DiagnosticStatusResponseRemote SenseNDRSignatureCSP2Generic SenseNdrSignatureHoneywellDiscovery SenseNdrZeekGhostCat SenseNdrZeekProfinetIoCm SenseNdrZeekProfinetHandshakeEPM SenseNdrZeekJA4SSH SenseNDRSignatureEmersonCpcE2SignOn SenseNDRSignatureEmersonCpcE2CtrlList SenseNdrZeekEmersonCpcE2
Microsoft.Windows.ServiceControlManager	No event ID assigned ServiceStarted
Microsoft.Windows.User32	No event ID assigned System shutdown (CSRSS)
Microsoft.Windows.WebDefense.SenseLogging	No event ID assigned ThreatAssessmentSenseEvent
Microsoft.Windows.WSL.DefenderPlugin	No event ID assigned WSLDefenderPlugin
NTLM	Event ID 8001: NTLM client blocked audit: Audit outgoing NTLM authentication traffic that would be blocked. NTLM Client Blocked Audit
Powershell cmdlets	Event ID 7937: ContextInfo Context: Context User Data: User_Data. Cmdlet start Event ID 16385: AmsiUtil state. Amsi Start
PrintService	Event ID 871: The current print job was rejected due to Device Control Print Restrictions. Device Control Print Failed due to Restrictions
RemoteDesktopServices-RdpCoreTS	Event ID 131: The server accepted a new ConnType connection from client ClientIP. RdpCoreTS Accept Connection Event ID 148: Channel ChannelName has been closed between the server and the client on transport tunnel: TunnelID. RdpCoreTS MST120 Virtual channel
RPC	Event ID 14: RPC interface registered. RPC Interface Registration Event ID 15: RPC interface unregistered. RPC Interface Unregistration
RPC-Audit	Event ID 1: task_0 Remote RPC inbound audit Event ID 2: task_02 Remote RPC inbound block
SEC	Event ID 2: task_02 SEC unload Event ID 4: task_04 File create aggregation File create extension aggregation Event ID 5: task_05_V1 System rename extension aggregation File rename aggregation File rename extension aggregation Event ID 6: task_06_V1 Delete file File delete aggregation File delete extension aggregation Event ID 17: task_017 Named Pipe Event ID 18: task_018 Event18 Event ID 19: task_019 Event19 Event ID 22: task_022 Filter Process Termination Process Termination Aggregation Event ID 23: task_023 LoadImage_ForProtectedProcess Event23 Event23_ForSense Event23_ForAmsiDetector [FirstNSeen] LoadImage Event ID 24: task_024 Event24 Event ID 25: task_025 Event25 Event ID 26: task_026 Open network share Admin share opened remotely Outgoing admin share access, parent folder only Outgoing admin share access, raw events Event ID 27: task_027 Event27 Event ID 28: task_028 Event28 Event ID 29: task_029 Event29 Event ID 30: task_030 Event30 Event ID 31: task_031 Unauthorized file access attempts Event ID 32: task_032 Event32 Event ID 33: task_033 Event33 Event ID 34: task_034 Open process for read Event ID 35: task_035 Event35 Event ID 36: task_036 Event36 Event ID 37: task_037 Event37 Event ID 38: task_038 Event38 Event ID 40: task_040 High value file read High value file read aggregation Script read from network share Event ID 41: task_041 RegistryQueryValue Event ID 42: task_042_V2 File Open File Open By Process Event ID 44: task_044 Registry Save Key Event ID 46: task_046 Process Commandline Assertion Violation Event ID 47: task_047 DeviceIoControl volsnap Event ID 52: task_052_V2 LMF File Open Blocked Audit LMF File Open Blocked Audit Aggregation Event ID 53: task_053 Atomic Open Remote File And Acquire Oplock Event ID 54: task_054 Retry Failed IO Event ID 56: task_056_V2 LMF network share access blocked Event ID 57: task_057_V2 LMF sysvol access blocked Event ID 58: task_058 Registry Query Info Key
SEC-WFP	Event ID 1: task_01_V1 Contain connection blocked callout (legacy) ManualDeviceContainBlock DisruptionContainBlock OutgoingTrafficBlockerBlock Event ID 2: task_02_V1 ContainExclusions Event ID 3: task_03_V1 DisruptionContainHvaAudit OutgoingTrafficBlockerAudit Event ID 4: task_0 WfpGuard Block Event
SecureETW	Event ID 4624: An account was successfully logged on. Logon event Event ID 4625: An account failed to log on. An account failed to log on SE_AUDITID_ETW_LOGON_FAILURE LMF network logon enforcement Event ID 4648: A logon was attempted using explicit credentials. Logon using explicit credentials Event ID 4664: An attempt was made to create a hard link. Hardlink Create Audit Event Event ID 4670: Permissions on an object were changed. File permissions change Taking Ownership on File from TrustedInstaller Taking Ownership on MDE Key Event ID 4688: A new process has been created. SE_AUDITID_ETW_PROCESS_CREATED Event ID 4697: A service was installed in the system. A service was installed Event ID 4698: A scheduled task was created. A scheduled task was created Event ID 4699: A scheduled task was deleted. A scheduled task was deleted Event ID 4702: A scheduled task was updated. A scheduled task was updated Event ID 4719: System audit policy was changed. System Audit Policy was changed Event ID 4720: A user account was created. A user account was created Event ID 4724: An attempt was made to reset an account's password. An Attempt was made to reset an account password Event ID 4726: A user account was deleted. A user account was deleted A user account was deleted Event ID 4731: A security-enabled local group was created. Local group created Event ID 4732: A member was added to a security-enabled local group. A member was added to a security-enabled local group A member was added to a security-enabled local group Event ID 4733: A member was removed from a security-enabled local group. Local group removed Event ID 4734: A security-enabled local group was deleted. Local group deleted Event ID 4738: A user account was changed. A user account was changed Event ID 4798: A user's local group membership was enumerated. User's local group membership was enumerated Event ID 4799: A security-enabled local group membership was enumerated. Security-enabled local group membership was enumerated Event ID 4907: Auditing settings on object were changed. Sense tampering through object sacl change Event ID 5024: The Windows Firewall Service has started successfully. Firewall service started Event ID 5025: The Windows Firewall Service has been stopped. Firewall service stopped Event ID 5031: The Windows Firewall Service blocked an application from accepting incoming connections on the network. Firewall app blocked from listening Event ID 5058: Key file operation. Persistent cryptographic key operation. Event ID 5059: Key migration operation. Persistent cryptographic key export. Event ID 5157: The Windows Filtering Platform has blocked a connection. Firewall has blocked a connection outbound Firewall has blocked a connection inbound Event ID 5376: Credential Manager credentials were backed up. Credman - Credentials Backup Event ID 5379: Credential Manager credentials were read. Credman - Read Credentials Event ID 5380: Vault Find Credential. Vault Credential - Find Credential Event ID 5381: Vault credentials were read. Vault Credential - Enumerate Credentials Event ID 5382: Vault credentials were read. Vault Credential - Get Unique Credential Event ID 5712: A Remote Procedure Call (RPC) was attempted. SE_AUDITID_ETW_RPC_INBOUND_CALL LMF RPC Inbound enforcement Event ID 6416: A new external device was recognized by the system. Plug and Play event
Security-Mitigations	Event ID 1: Process 'ProcessPath' (PID CallingProcessId) would have been blocked from generating dynamic code. AuditProcessProcessBlockGeneratingDynamicCode Event ID 2: Process 'ProcessPath' (PID CallingProcessId) was blocked from generating dynamic code. EnforceProcessProcessBlockGeneratingDynamicCode Event ID 3: Process 'ProcessPath' (PID CallingProcessId) would have been blocked from creating a child process 'ChildImagePathName' with command line 'ChildCommandLine'. AuditProcessProcessBlockCreatingChildProcess Event ID 4: Process 'ProcessPath' (PID CallingProcessId) was blocked from creating a child process 'ChildImagePathName' with command line 'ChildCommandLine'. EnforceProcessProcessBlockCreatingChildProcess Event ID 5: Process 'ProcessPath' (PID ProcessId) would have been blocked from loading the low-integrity binary 'ImageName'. AuditProcessLoadLowILImage Event ID 6: Process 'ProcessPath' (PID ProcessId) was blocked from loading the low-integrity binary 'ImageName'. EnforceProcessLoadLowILImage Event ID 7: Process 'ProcessPath' (PID CallingProcessId) would have been blocking from loading a binary from a remote share. AuditProcessLoadBinaryFromRemoteShare Event ID 8: Process 'ProcessPath' (PID CallingProcessId) was blocked from loading a binary from a remote share. EnforceProcessLoadBinaryFromRemoteShare Event ID 9: Process 'ProcessPath' (PID CallingProcessId) would have been blocked from making system calls to Win32k. AuditProcessCallWin32k Event ID 10: Process 'ProcessPath' (PID CallingProcessId) was blocked from making system calls to Win32k. EnforceProcessCallWin32k Event ID 11: Process 'ProcessPath' (PID ProcessId) would have been blocked from loading the non-Microsoft-signed binary 'ImageName'. AuditProcessLoadNonMicrosoftSignedBinary Event ID 12: Process 'ProcessPath' (PID ProcessId) was blocked from loading the non-Microsoft-signed binary 'ImageName'. EnforceProcessLoadNonMicrosoftSignedBinary Event ID 13: Process 'ProcessPath' (PID ProcessId) would have been blocked from accessing the Export Address Table for module 'MemModuleFullPath'. AuditExportAddressFilter Event ID 14: Process 'ProcessPath' (PID ProcessId) was blocked from accessing the Export Address Table for module 'MemModuleFullPath'. EnforceExportAddressFilter Event ID 15: Process 'ProcessPath' (PID ProcessId) would have been blocked from accessing the Export Address Table for module 'MemModuleFullPath'. AuditExportAddressFilterPlus Event ID 16: Process 'ProcessPath' (PID ProcessId) was blocked from accessing the Export Address Table for module 'MemModuleFullPath'. EnforceExportAddressFilterPlus Event ID 17: Process 'ProcessPath' (PID ProcessId) would have been blocked from accessing the Import Address Table for API 'APIName'. AuditImportAddressFilter Event ID 18: Process 'ProcessPath' (PID ProcessId) was blocked from accessing the Import Address Table for API 'APIName'. EnforceInputAddressFilter Event ID 19: Process 'ProcessPath' (PID ProcessId) would have been blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications. AuditRopStackPivot Event ID 20: Process 'ProcessPath' (PID ProcessId) was blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications. EnforceRopStackPivot Event ID 21: Process 'ProcessPath' (PID ProcessId) would have been blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications. AuditRopCallerCheck Event ID 22: Process 'ProcessPath' (PID ProcessId) was blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications. EnforceRopCallerCheck Event ID 23: Process 'ProcessPath' (PID ProcessId) would have been blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications. AuditRopSimExec Event ID 24: Process 'ProcessPath' (PID ProcessId) was blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications. EnforceRopSimExec
Services	Event ID 200: SendControl ServiceSendControlStop Event ID 201: ServiceConfigChange ServiceConfigChangeStartType Event ID 202: ServiceConfigChange202 ServiceConfigChangeBinaryPathName Event ID 203: ServiceConfigChange203 ServiceConfigChangeAccountInfo
SGRM Report	Event ID 1 SGRM Report Event ID 2 SGRM Error
Shell-Core	Event ID 9708: Finished execution of command 'Command' (PID PID). Explorer_ExecutingFromRunKey Event ID 19501: CDesktopFolder_ParseDisplayNameStart Open http link Open .lnk file
SmartScreen	Event ID 1000: Application SmartScreen Event AppLookup Event ID 1002: User Decision SmartScreen Event UserDecision
TCPIP	Event ID 1017: TCP: listener (local=LocalAddress remote=RemoteAddress) accept completed. Connection accepted Event ID 1033: TCP: connection Tcb (local=LocalAddress remote=RemoteAddress) connect completed. Connect Complete Event ID 1034: TCP: connection Tcb (local=LocalAddress remote=RemoteAddress) connect attempt failed with status = Status. Connect Failure Event ID 1123: TCP: listener Listener (sockaddr=SocketAddress) activated. Listening socket created
TerminalServices-LocalSessionManager	Event ID 21: Remote Desktop Services: Session logon succeeded. TerminalServices-LOGON Event ID 25: Remote Desktop Services: Session reconnection succeeded. TerminalServices-RECONNECT
ThreatIntelligence	Event ID 1: Remote Virtual Memory Allocation MemAllocRemote Event ID 2: Remote Virtual Memory Protection Change MemProtectRemote Event ID 3: Remote Section Map MapViewRemote Event ID 4: Remote APC Queue QueueUserApcRemote Event ID 5: Remote Thread Context Change SetThreadContextRemote Event ID 6: Local Virtual Memory Allocation MemAllocForHighRisk MemAllocForMeterpreter Event ID 7: Local Virtual Memory Protection Change Image region local vmprotect Event ID 8: Local Section Map MapViewForHighRiskProcesses Event ID 13: Remote Virtual Memory Read ReadVMRemote ReadVMRemote clone Event ID 14: Remote Virtual Memory Write WriteVMRemote - lsass Event ID 15: Remote Thread Suspend SuspendThread Event ID 16: Remote Thread Resume ResumeThread Event ID 17: Process Suspend SuspendProcess Event ID 18: Process Resume ResumeProcess Event ID 19: Process Freeze FreezeProcess Event ID 20: Process Thaw ThawProcess Event ID 21: Remote Virtual Memory Allocation (Kernel Caller) AllocVmKernelCallerRemote Event ID 22: Remote Virtual Memory Protection Change (Kernel Caller) ProtectVmKernelCallerRemote Event ID 24: Remote APC Queue (Kernel Caller) QueueUserApcKernelCallerRemote Event ID 29: Driver Object Patch Driver Object Creation Event ID 31: Device Object Create Device Object Creation Event ID 33: Thread Token Impersonation (Elevation) Token Impersonation
User32	Event ID 1074: The process param1 has initiated the param5 of computer param2 on behalf of user param7 for the following reason: System shutdown
VHDMP	Event ID 1: The VHD VhdFileName has come online (surfaced) as disk number VhdDiskNumber. VHDMP Virtual Disk Mount
WER-Diag	Event ID 5: CFG violation is detected. CFG Violation
Win32k	Event ID 1: WindowUpdate UpdateEvent BitBlt API call Aggregation Event ID 1001: RegisterRawInputDevices KLRegRawInput (20H1+) KLRegRawInput Event ID 1002: SetWindowsHookEx KLSetWindowsHook Event ID 1003: GetAsyncKeyState KLGetAsyncKeyState
Windows Defender	Event ID 1000: Product Name scan has started. WDAV Scan Started Event ID 1001: Product Name scan has finished. WDAV Scan Completed Event ID 1002: Product Name scan has been stopped before completion. WDAV Scan Cancelled Event ID 1005: ProductName scan has encountered an error and terminated. WDAV Scan Failed Event ID 2000: Product Name security intelligence version updated. Defender Signature drop Event ID 5000: ProductName Real-time Protection scanning for malware and other potentially unwanted software was enabled. MALWAREPROTECTION_RTP_ENABLED Event ID 5001: Product Name Real-time Protection scanning for malware and other potentially unwanted software was disabled. MALWAREPROTECTION_RTP_DISABLED Event ID 5007: Product Name Configuration has changed. MALWAREPROTECTION_CONFIG_CHANGED Event ID 5013: Tamper Protection Changed Type a change to Product Name. Attempted Defender AV Tampering
WMI-Activity	Event ID 11: CorrelationId = CorrelationId; GroupOperationId = GroupOperationId; OperationId = OperationId; Operation = Operation; ClientMachine = ClientMachine; User = User; ClientProcessId = ClientProcessId; ... WMI remote query WMI local query WMI Class Creation and Usage Event ID 20: Performing Update operation on the WMI repository. Remote WMI Repository Update Event ID 22: CorrelationId = CorrelationId; GroupOperationId = GroupOperationId; OperationId = OperationId; ClassName= ClassName; MethodName = MethodName; ImplementationClass = ImplementationClass; ClientMachin... Remote Win32_Process:Create Remote WMI execution Local Win32_Process:Create Event ID 23: CorrelationId = CorrelationId; GroupOperationId = GroupOperationId; OperationId = OperationId; Commandline= Commandline; CreatedProcessId = CreatedProcessId; ClientMachine = CreatedProcessCreationT... Remote WMI Process Creation (RS5+) Local WMI Process Creation (RS5+) Event ID 5861: Namespace = Operation_ESStoConsumerBinding.Namespace; Eventfilter = Operation_ESStoConsumerBinding.ESS (refer to its activate eventid:5859); Consumer = Operation_ESStoConsumerBinding.CONSUMER; Poss... WMI bind filter to consumer