Windows event logs
462 event IDs from 73 event logs, with the fields EvtxECmd extracts and a sample event for each one
No events match ""
Clear searchSecurity
98 events
- 1100The event logging service has shut down
- 1102Event log cleared
- 4608Windows is starting up
- 4611A trusted logon process has been registered with the Local Security Authority
- 4616The system time was changed
- 4624Successful logon
- 4625Failed logon
- 4634An account was logged off
- 4647User initiated logoff
- 4648A logon was attempted using explicit credentials
- 4656A handle to an object was requested
- 4657A registry value was modified
- 4658The handle to an object was closed
- 4661Handle requested to an object
- 4662Operation performed on an object
- 4663Attempt was made to access an object
- 4672Administrative logon
- 4673A privileged service was called
- 4674An operation was attempted on a privileged object
- 4688A new process has been created
- 4689A process has exited
- 4696A privileged service was called
- 4697A service was installed on the system
- 4698Scheduled Task created
- 4699Scheduled Task deleted
- 4700A scheduled task was enabled
- 4701A scheduled task was disabled
- 4702A scheduled task was updated
- 4703A user right was adjusted
- 4704A user right was assigned
- 4705A user right was removed
- 4706A new trust was created to a domain
- 4707A trust to a domain was removed
- 4713Kerberos policy was changed
- 4716Trusted domain information was modified0
- 4717System security access was granted to an account
- 4718System security access was removed from an account
- 4719System audit policy was changed
- 4720A new account was created
- 4722A user account was enabled
- 4723An attempt was made to change an account's password
- 4724An attempt was made to reset an account's password
- 4725A user account was disabled
- 4726A user account was deleted
- 4728A member was added to a security-enabled global group
- 4731A security-enabled local group was created
- 4732A member was added to a security-enabled local group
- 4733A member was removed from a security-enabled local group
- 4734A security-enabled local group was deleted
- 4735A security-enabled local group was changed
- 4738A user account was changed
- 4740A user account was locked out
- 4741A computer account was created
- 4742A computer account was changed
- 4743A computer account was deleted
- 4764A group's type was changed
- 4768A Kerberos authentication ticket (TGT) was requested
- 4769A Kerberos service ticket was requested
- 4770A Kerberos service ticket was renewed
- 4771Kerberos pre-authentication failed
- 4772A Kerberos authentication ticket request failed
- 4773A Kerberos service ticket request failed
- 4774An account was mapped for logon
- 4775An account could not be mapped for logon
- 4776NTLM authentication request
- 4777The domain controller failed to validate the credentials for an account
- 4778RDP reconnecting
- 4779RDP disconnecting
- 4781The name of an account was changed
- 4782The password hash of an account was accessed
- 4793The Password Policy Checking API was called
- 4797An attempt was made to query the existence of a blank password for an account
- 4798A user's local group membership was enumerated
- 4799A security-enabled local group membership was enumerated
- 4800The workstation was locked
- 4801The workstation was unlocked
- 4802The screen saver was invoked
- 4803The screen saver was dismissed
- 5136A directory service object was modified
- 5137A directory service object was created
- 5138A directory service object was undeleted
- 5139A directory service object was moved
- 5140A network share object was accessed
- 5141A directory service object was deleted
- 5142A network share object was added
- 5143A network share object was modified
- 5144A network share object was deleted
- 5145Network share object access
- 5152The Windows Filtering Platform has blocked a packet
- 5154The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections
- 5156The Windows Filtering Platform has allowed a connection
- 5157The Windows Filtering Platform has blocked a connection
- 5158The Windows Filtering Platform has permitted a bind to a local port
- 5159The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections
- 5379Credential Manager credentials were read
- 6272Network Policy Server granted access to a user
- 6273Network Policy Server denied access to a user
- 6416A new external device was recognized by the system
Sysmon
29 events
- 1Process creation
- 2A process changed a file creation time
- 3Network connection
- 4Sysmon service state changed
- 5Process terminated
- 6Driver loaded
- 7Image loaded
- 8CreateRemoteThread
- 9RawAccessRead
- 10ProcessAccess
- 11FileCreate
- 12RegistryEvent (Object create and delete)
- 13RegistryEvent (Value Set)
- 14RegistryEvent (Key and Value Rename)
- 15FileCreateStreamHash
- 16ServiceConfigurationChange
- 17PipeEvent (Pipe Created)
- 18PipeEvent (Pipe Connected)
- 19WmiEvent (WmiEventFilter activity detected)
- 20WmiEvent (WmiEventConsumer activity detected)
- 21WmiEvent (WmiEventConsumerToFilter activity detected)
- 22DNSEvent (DNS query)
- 23FileDelete (A file delete was detected)
- 24ClipboardChange (New content in the clipboard)
- 25ProcessTampering (Process image change)
- 26FileDeleteDetected (A file delete was detected)
- 27FileBlockExecutable (An executable was blocked)
- 28FileBlockShredding (A file was blocked from being deleted)
- 29FileExecutableDetected (An executable file was created)
System
36 events
- 1The system time was changed / Sleep/wake events
- 2An attempt to exploit a known vulnerability detected
- 12OS was started
- 13OS was shutdown
- 26Application Error
- 35Synchronizing system time from time service
- 37Synchronizing system time from time service
- 42Sleep/wake events
- 56TermDD
- 104Event log cleared
- 105Power source change
- 1074A user initiated a system restart
- 1116Microsoft Antimalware Detection
- 1129Absence of network connectivity
- 1130Group Policy Script Failure
- 1500Group Policy Settings processed successfully for COMPUTER
- 1501Group Policy Settings processed successfully for USER
- 6005The Event log service was started
- 6006The Event log service was stopped
- 6008Unexpected system shutdown
- 6011System Name Changed
- 6013System uptime
- 7001User logon
- 7002User logoff
- 7031Service crashed unexpectedly
- 7034Service crashed unexpectedly
- 7035Service sent a Start/Stop control
- 7036Service started or stopped
- 7040Start type of a service has changed
- 7045A new service was installed in the system
- 10000Device driver installations begins (Device connection)
- 10028DCOM was unable to communicate with the computer
- 20001Device installation
- 20003Service installation
- 40960Security authentication error
- 45057Account disabled
Application
47 events
- 0A Quick Assist event was logged / Windows Script Host (WSH)
- 1Carbon Black Defense / Cylance alert / An attempt to exploit a known vulnerability detected
- 2Cylance alert
- 3McAfee Endpoint Detection / Trellix Endpoint Detection
- 15Windows Security Center State Changed
- 17Carbon Black Defense
- 30Screenconnect error - Your host has ended the remote session.
- 32Sophos Alert Identified
- 33Carbon Black Defense
- 42Sophos System Protection
- 49Carbon Black Defense
- 100Session connected
- 101Session disconnected
- 103F-Secure Anti-Virus - Manual scanning was finished - workstation was found infected / F-Secure Anti-Virus Detection
- 201Transferred files with action
- 207F-Secure Anti-Virus - Malicious code found in file
- 216NTDS database location change was detected
- 296F-Secure Anti-Virus - Spyware detected
- 325NTDS the database engine created a new database
- 326NTDS the database engine attached a database
- 327NTDS the database engine detached a database
- 722F-Secure Anti-Virus - Web Traffic Scanning Alert
- 911HitmanPro ALERT Identified
- 1000Application Error
- 1001Application Crash
- 1002The program has been terminated
- 1027Citrix user session started
- 1033A program was installed
- 1034A program was deleted
- 1040Installer Started
- 1042Installer Exited
- 1049Citrix user session disconnected
- 1106Citrix client printer auto-creation failed
- 4003Symantec Web and Cloud Access Protection Disabled
- 8194Restore point created successfully
- 8195System Restore has been disabled
- 8196System Restore has been enabled
- 10001Application is stopping shutdown operation
- 10002Shutting down application or service / Terminated due to non-response
- 11707Installation completed successfully
- 11708Installation operation failed.
- 11724Program uninstalled successfully
- 15457MSSQLSERVER Configuration change
- 18453MSSQLSERVER Login success (Integrated Auth)
- 18454MSSQLSERVER Login success (SQL Server Auth)
- 18456MSSQLSERVER Login failed
- 33205MSSQLSERVER Audit event
PowerShell
8 events
Remote access
41 events
- 72RDP Interface method called
- 98Successful RDP Connections
- 104Client timezone bias from UTC
- 131RDP server accepted a new TCP connection
- 140RDP connection from the client computer failed
- 200Remote Desktop Services: User meets resource authorization policy requirements needed to connect to TS Gateway server
- 300Remote Desktop Services: User meets resource authorization policy requirements needed to connect to resource
- 302Remote Desktop Services: User connected to resource
- 303Remote Desktop Services: User disconnected from resource
- 312Remote Desktop Services: User has initiated an outbound connection
- 313Remote Desktop Services: User has initiated an inbound connection
- 21Remote Desktop Services: Session logon succeeded
- 22Remote Desktop Services: Shell start notification received
- 23Remote Desktop Services: Session logoff succeeded
- 24Remote Desktop Services: Session has been disconnected
- 25Remote Desktop Services: Session reconnection succeeded
- 39Session (PayloadData1) has been disconnected by session (PayloadData2)
- 40Session (PayloadData1) has been disconnected, reason code (PayloadData2)
- 41RDP Begin session arbitration
- 1024RDP Client is trying to connect to the server
- 1025RDP ClientActiveX has connected to the server
- 1026RDP ClientActiveX has been disconnected
- 1027RDP Connected to domain
- 1029RDP (outgoing connection)
- 1102RDP client has initiated a multi-transport connection to the server
- 1103The RDP client has established a multi-transport connection to the server
- 1105RDP the multi-transport connection has been disconnected
- 261RDP Listener received a connection
- 1149RDP network connection established
- 6Creating WSMan Session
- 91Creating WSMan shell on server with ResourceUri
- 169WinRM Authentication
- 1SSH critical error
- 2SSH error
- 4SSH activity
- 1000Splashtop session connected
- 1001Splashtop session disconnected
- 1100Splashtop file transfer
- 1101Splashtop file transfer
- 1110Splashtop file transfer
- 1111Splashtop file transfer
Defender and policy
34 events
- 4004Code Signature Verification
- 8002An executable was allowed to run
- 8004An executable was prevented from running.
- 8005A script or MSI was allowed to run
- 8007A script or MSI was prevented from running
- 8020A packaged app was allowed to run
- 31001SMB Client: DiagReasonISC
- 31010The SMB client failed to connect to the share
- 3000A client attempted to access the server using SMB1
- 551SMB session authentication failure
- 1000An antimalware scan started
- 1001An antimalware scan finished
- 1002Warning - An antimalware scan was stopped before it finished
- 1003Warning - An antimalware scan was paused
- 1004An antimalware scan was resumed
- 1005Error - An antimalware scan failed
- 1006Detection - The antimalware engine found malware or other potentially unwanted software
- 1008Error - The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.
- 1011The antimalware platform deleted an item from quarantine
- 1013The antimalware platform deleted history of malware and other potentially unwanted software
- 1116Detection - The antimalware platform detected malware or other potentially unwanted software
- 1117Detection - The antimalware platform performed an action to protect your system from malware or other potentially unwanted software
- 1134Microsoft Defender Attack Surface Reduction has audited an operation
- 1150Defender is up and running in a healthy state
- 2000Update - The antimalware definitions updated successfully
- 2050Defender uploaded a file for further analysis
- 5000Real-time Protection was enabled
- 5001Real-time Protection was disabled
- 5007The antimalware platform configuration changed
- 2003The firewall has enabled/disabled
- 2004A rule has been added to the Windows Defender Firewall exception list
- 2005A rule has been modified in the Windows Defender Firewall exception list
- 2006A rule has been deleted in the Windows Defender Firewall exception list
- 2011Windows Firewall unable to notify user of blocked application
Windows operational
107 events
- 17Path of executed program
- 500Application Experience Program Telemetry
- 505Application Experience Program Telemetry
- 3BITS service created a new job
- 4BITS job completion
- 5BITS job cancellation
- 59BITS transfer has started
- 60BITS transfer has stopped
- 61BITS transfer has stopped
- 64BITS Job Configured to Launch, but failed will continue to try
- 20000The time was changed through the Control Panel
- 100Microsoft-Windows-DeviceSetupManager service starting
- 101Microsoft-Windows-DeviceSetupManager service shutting down
- 112USB Connection
- 50067Windows DHCP Client WiFi SSID Received
- 100Windows System was started
- 101Boot Performance Monitoring Degradation
- 200Windows System was shutdown
- 2100USB Connection
- 4004Starting manual processing of policy for COMPUTER
- 4005Starting manual processing of policy for USER
- 4016List of applicable Group Policy objects
- 4017Making LDAP calls to connect and bind to Active Directory
- 13002A new Hyper-V VM was created
- 13003A Hyper-V VM was deleted
- 18303Hyper-V VM was exported
- 18304A new Hyper-V VM was created
- 18500Hyper-V VM started successfully
- 18502Hyper-V VM turned off
- 18504Hyper-V VM was shut down
- 18508Hyper-V VM was shut down
- 18512Hyper-V VM reset by hyper-v manager
- 18514Hyper-V VM reset by guest OS
- 400Device driver error
- 410Device driver error
- 430Device requires further installation
- 10000Connect to the Internet
- 10001Disconnect from the Internet
- 4NTFS Volume Mount – Volume successfully mounted
- 9NTFS Volume Bitmap Scan – Full volume bitmap read and validation
- 10NTFS Volume Allocation Analysis – Cached runs and layout statistics
- 55The Master File Table (MFT) contains a corrupted file record.
- 142NTFS-formatted drive attached
- 145NTFS-formatted drive attached
- 146IO Connection
- 151File deletion on an NTFS-formatted volume
- 1006USB/VHD Insertion/Removal
- 307Printing a document
- 316Adding a printer driver
- 9701RunOnceEx commands started
- 9702RunOnceEx commands finished
- 9703RunOnce commands started
- 9704RunOnce commands finished
- 9705Started enumeration of commands for registry key
- 9706Finished enumeration of commands for registry key
- 9707Started execution of command
- 9708Finished execution of command
- 9709Executing From RunKey As Job
- 9710Finished Executing From RunKey As Job
- 9711Executing from startup menu
- 9712Finished executing from startup menu
- 28115Shortcut creation log after program installation
- 30805SMB Client: the client lost its session to the server
- 30806SMB Client: The client re-established its session to the server
- 30807The connection to the share was lost
- 1016Reopen failed
- 1017Handle scavenged
- 1020File system operation has taken longer than expected
- 507Completing a failed non-ReadWrite SCSI SRB request
- 504Error summary for Storport Device
- 505Performance summary for Storport Device
- 207USB Connection
- 1001USB Connection
- 100Scheduled Task started
- 102Scheduled Task completed
- 106Scheduled Task created
- 119Scheduled Task triggered on logon
- 129Scheduled Task created
- 140Scheduled Task updated
- 141Scheduled Task deleted
- 200Scheduled Task executed
- 201Scheduled Task completed
- 20001TZUtil (changed timezone)
- 55Internet connectivity status
- 2An account was logged on
- 4An account was logged off
- 67Account Information
- 1A VHD has been created
- 2A VHD has been removed
- 50Performing Create VHD
- 51Successfully performed Create VHD
- 1A VHD has been created
- 2A VHD has been removed
- 4Application Crash on Launch
- 260A program was executed
- 5600Proxy configuration changed
- 811User activity
- 812User activity
- 8000WIFI connection was attempted
- 8001WIFI connection was successful
- 8002WIFI connection was failed
- 8003WIFI connection was terminated
- 5857WMI wmiprvse execution
- 5858WMI Query Error
- 5860WMI Registration of Temporary Event Consumer
- 5861WMI Registration of Permanent Event Consumer
- 1005(Mobile) MTP Connection
Third party
62 events
- 110User account password change
- 2039Cisco AnyConnect VPN Connection Established
- 2048Cisco AnyConnect VPN encrypted connection type
- 2072Cisco AnyConnect VPN Active Interface Addresses
- 2079Cisco AnyConnect VPN Host Configuration
- 2085Cisco AnyConnect VPN client's public address
- 2086Cisco AnyConnect VPN reading host's IP
- 2127Cisco AnyConnect VPN IP assigned
- 3021Cisco AnyConnect VPN message sent to user
- 5005Cisco AnyConnect VPN connecting to target gateway X
- 2037VPN connection terminated
- 2039VPN connection established
- 2044Connection to secure gateway established
- 2073IP Addresses of active interfaces
- 2086The client's public address is now set
- 3002Initiating VPN connection to secure gateway
- 3026A VPN connection was requested
- 100Cisco Secure Endpoint Detection
- 1300Cisco Secure Endpoint Detection
- 1310Cisco Secure Endpoint Detection
- 3COMODO Security CEF Client
- 3CrowdStrike Alert
- 4CrowdStrike Alert
- 302Kaspersky AV Detection
- 362Kaspersky AV Detection
- 3203Threat detected / Threat detected (Real-time file protection)
- 300OAlerts 300 event
- 26File Quarantine Already Quarantined
- 31Sentinel Threat Detected
- 32Sentinel Mitigation Report
- 81Sentinel Scan Ended
- 91Sentinel Remote Script Logging
- 2Scan stopped
- 3Scan started
- 7New virus definition file loaded
- 12Configuration changed
- 21Scan canceled
- 23Symantec Endpoint Protection Auto-Protect Enabled
- 24Symantec Endpoint Protection Auto-Protect Disabled
- 51Security Risk Found
- 69Enhanced scan failed
- 80Symantec Endpoint Protection has failed to load the latest virus definitions
- 100Symantec Endpoint Protection client is online and able to access the management server
- 101Symantec Endpoint Protection client is unable to connect to the management server
- 129Reputation check timed out during unproven file evaluation, likely due to network delays
- 200Content downloaded successfully to the client
- 201Content download to the client failed
- 202Symantec Endpoint Protection client is online and able to access the management server
- 34054SONAR has been enabled
- 34056Symantec Endpoint Protection Tamper Protection Disabled
- 900Volume information
- 5118Various statistics
- 5120Volume statistics
- 5129RPC authentication request
- 5138Mount point validation
- 5140New mount point detected
- 5172Proxy disconnection
- 5176Proxy connection
- 5213Monitoring alert
- 5214Volume Shadow Copy successfully mounted
- 5220List of Devices Monitored and Logged by Varonis
- 5434System is shutting down
Results
Source: EvtxECmd maps (evtx/Maps)(opens in new tab) by Eric Zimmerman and contributors(opens in new tab), MIT License(opens in new tab)