detection.wiki

Microsoft-Windows-Windows Firewall With Advanced Security › Event 2039

Event ID 2039 — Http Proxies Changed.

Provider
Microsoft-Windows-Windows Firewall With Advanced Security
Channel
Network Isolation Operational
Level
Informational
Opcode
Info

Description

Http Proxies Changed.

Message #

Http Proxies Changed

Reason: %1

All Proxies: %2

All Domain Proxies: %3

Group Policy Configured Domain Proxies: %4

Group Policy Configured Local Proxies: %5

All DA Nat64 Domain Proxies: %6

Group Policy is authoritative: %7

Fields #

NameDescription
ChangeType UInt32—
All Proxies UnicodeString—
All Domain Proxies UnicodeString—
GP Configured Domain Proxies UnicodeString—
GP Configured Local Proxies UnicodeString—
All DA Nat64 Proxies UnicodeString—
GP Is Authoritative UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Windows Firewall With Advanced Security",
    "guid": "D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85",
    "event_source_name": "",
    "event_id": 2039,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 576460752303423504,
    "time_created": "2023-11-05T23:50:01.858901+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 2896,
      "thread_id": 9248
    },
    "channel": "Network Isolation Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "ChangeType": 0,
    "All Proxies": "*",
    "All Domain Proxies": "*",
    "GP Configured Domain Proxies": "*",
    "GP Configured Local Proxies": "*",
    "All DA Nat64 Proxies": "*",
    "GP Is Authoritative": 0
  },
  "message": ""
}

References #