Detection rules › By event

Microsoft-Windows-Security-Auditing event 4663

31 detection rules reference this event. View event page.

Sigma (14)

Azure AD Health Monitoring Agent Registry Keys Access severity medium T1012
Azure AD Health Service Agents Registry Keys Access severity medium T1012
File Access Of Signal Desktop Sensitive Data severity medium T1003
ISO Image Mounted severity medium T1566.001
LSASS Access From Non System Account severity medium T1003.001
Potential Secure Deletion with SDelete severity medium T1027.005, T1070.004, T1485, T1553.002
Potentially Suspicious AccessMask Requested From LSASS severity medium T1003.001
Processes Accessing the Microphone and Webcam severity medium T1123
Service Registry Key Read Access Request severity low T1574.011
Suspicious Teams Application Related ObjectAcess Event severity high T1528
SysKey Registry Keys Access severity high T1012
Sysmon Channel Reference Deletion severity high T1112
WCE wceaux.dll Access severity critical T1003
Windows Defender Exclusion Registry Key - Write Access Requested severity medium T1562.001

Splunk (17)