detection.wiki
?
Blog
Labs
References
Microsoft-Windows-ACL-UI
12 events across 1 channel
Event ID
Title
Channel
4000
Operational
4001
Operational
4002
Operational
4003
Operational
4004
Operational
4005
Operational
4006
Operational
4007
Operational
4008
Operational
4009
Operational
4010
Operational
4011
Operational
Event ID 4000 —
Provider
Microsoft-Windows-ACL-UI
Channel
Operational
Task
LaunchAdvancedACLUI
Opcode
Start
Event ID 4001 —
Provider
Microsoft-Windows-ACL-UI
Channel
Operational
Task
LaunchAdvancedACLUI
Opcode
Stop
Event ID 4002 —
Provider
Microsoft-Windows-ACL-UI
Channel
Operational
Task
DownloadClaimIDs
Opcode
Start
Event ID 4003 —
Provider
Microsoft-Windows-ACL-UI
Channel
Operational
Task
DownloadClaimIDs
Opcode
Stop
Event ID 4004 —
Provider
Microsoft-Windows-ACL-UI
Channel
Operational
Task
DisplayPermissionsDialogwhenEditinganACE
Opcode
Start
Event ID 4005 —
Provider
Microsoft-Windows-ACL-UI
Channel
Operational
Task
DisplayPermissionsDialogwhenEditinganACE
Opcode
Stop
Event ID 4006 —
Provider
Microsoft-Windows-ACL-UI
Channel
Operational
Task
DisplayPermissionsDialogwhenAddinganACE
Opcode
Start
Event ID 4007 —
Provider
Microsoft-Windows-ACL-UI
Channel
Operational
Task
DisplayPermissionsDialogwhenAddinganACE
Opcode
Stop
Event ID 4008 —
Provider
Microsoft-Windows-ACL-UI
Channel
Operational
Task
DownloadCentralAccessPolicyIDs
Opcode
Start
Event ID 4009 —
Provider
Microsoft-Windows-ACL-UI
Channel
Operational
Task
DownloadCentralAccessPolicyIDs
Opcode
Stop
Event ID 4010 —
Provider
Microsoft-Windows-ACL-UI
Channel
Operational
Task
DisplayEffectivePermissionReport
Opcode
Start
Event ID 4011 —
Provider
Microsoft-Windows-ACL-UI
Channel
Operational
Task
DisplayEffectivePermissionReport
Opcode
Stop
Keyboard Shortcuts
j
/
k
Scroll down / up
d
/
u
Half-page down / up
h
/
l
Go back / forward
g
g
Go to top
G
Go to bottom
f
Follow link (SHIFT = new tab)
/
Focus search
?
Toggle this help
See
Navigation Reference
for search modifiers and filters.