-
Notifications
You must be signed in to change notification settings - Fork 19
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Event 104 - A log file was cleared: Added standard names, descriptions, sample values, and event sample in xml format. - Event 1100 - Windows Event Log service has shut down: Added dictionary without event fields and added event sample in xml format. - Event 1102 - The audit log was cleared: standard names, descriptions, sample values, and event sample in xml format. - Event 6005 - The event log service was started: Added dictionary with event sample in xml format. We still need to review the event fields section of dictionary. - Event 6006 - The event log service was stopped: Added dictionary with event sample in xml format. We still need to review the event fields section of dictionary. - Event 4656 - Handle requested to registry object: updated descriptions to make reference to registry objects. - Event 4656 - handle requested to service object: Added dictionary with event sample in xml format. - Event 4697 - a service was installed in the system: Removed double quotation marks from descriptions and added event sample in xml format.
- Loading branch information
1 parent
e39a079
commit bcf3fbf
Showing
8 changed files
with
403 additions
and
31 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
36 changes: 36 additions & 0 deletions
36
windows/etw-providers/Microsoft-Windows-Eventlog/events/event-1100.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| name: Event 1100 - Windows Event Log service has shut down | ||
| description: This event generates every time Windows Event Log service has shut down | ||
| platform: windows | ||
| log_source: Microsoft-Windows-Eventlog | ||
| event_id: '1101' | ||
| event_version: '0' | ||
| event_fields: [] | ||
| references: | ||
| - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100 | ||
| tags: | ||
| - etw_level_Informational | ||
| event_sample: | ||
| - format: xml | ||
| sample: |- | ||
| <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> | ||
| <System> | ||
| <Provider Name="Microsoft-Windows-Eventlog" Guid="{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}" /> | ||
| <EventID>1100</EventID> | ||
| <Version>0</Version> | ||
| <Level>4</Level> | ||
| <Task>103</Task> | ||
| <Opcode>0</Opcode> | ||
| <Keywords>0x4020000000000000</Keywords> | ||
| <TimeCreated SystemTime="2022-08-08T19:56:55.801610900Z" /> | ||
| <EventRecordID>243916</EventRecordID> | ||
| <Correlation /> | ||
| <Execution ProcessID="976" ThreadID="6056" /> | ||
| <Channel>Security</Channel> | ||
| <Computer>Pedro01</Computer> | ||
| <Security /> | ||
| </System> | ||
| <UserData> | ||
| <ServiceShutdown xmlns="http://manifests.microsoft.com/win/2004/08/windows/eventlog"> | ||
| </ServiceShutdown> | ||
| </UserData> | ||
| </Event> |
58 changes: 44 additions & 14 deletions
58
windows/etw-providers/Microsoft-Windows-Eventlog/events/event-1102.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,35 +1,65 @@ | ||
| name: Event 1102 - Logclear | ||
| description: | ||
| name: Event 1102 - The audit log was cleared | ||
| description: This event generates every time Windows Security audit log files is cleared | ||
| platform: windows | ||
| log_source: Microsoft-Windows-Eventlog | ||
| event_id: '1102' | ||
| event_version: '0' | ||
| event_fields: | ||
| - standard_name: TBD | ||
| - standard_name: user_sid | ||
| standard_type: TBD | ||
| name: SubjectUserSid | ||
| type: SID | ||
| description: | ||
| sample_value: | ||
| - standard_name: TBD | ||
| description: SID of the account that cleared the system security audit log | ||
| sample_value: S-1-5-21-968647429-258479840-2507984072-1001 | ||
| - standard_name: user_name | ||
| standard_type: TBD | ||
| name: SubjectUserName | ||
| type: UnicodeString | ||
| description: | ||
| sample_value: | ||
| - standard_name: TBD | ||
| description: The name of the account that cleared the system security audit log | ||
| sample_value: pedro | ||
| - standard_name: user_domain | ||
| standard_type: TBD | ||
| name: SubjectDomainName | ||
| type: UnicodeString | ||
| description: | ||
| sample_value: | ||
| - standard_name: TBD | ||
| description: Subject's domain or computer name | ||
| sample_value: PEDRO01 | ||
| - standard_name: user_logon_id | ||
| standard_type: TBD | ||
| name: SubjectLogonId | ||
| type: HexInt64 | ||
| description: | ||
| sample_value: | ||
| description: Logon ID of the subject's logon session | ||
| sample_value: 0x20256d6 | ||
| references: | ||
| - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102 | ||
| tags: | ||
| - etw_level_Informational | ||
| - etw_task_Logclear | ||
| event_sample: | ||
| - format: xml | ||
| sample: |- | ||
| <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> | ||
| <System> | ||
| <Provider Name="Microsoft-Windows-Eventlog" Guid="{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}" /> | ||
| <EventID>1102</EventID> | ||
| <Version>0</Version> | ||
| <Level>4</Level> | ||
| <Task>104</Task> | ||
| <Opcode>0</Opcode> | ||
| <Keywords>0x4020000000000000</Keywords> | ||
| <TimeCreated SystemTime="2022-08-09T14:44:05.629920700Z" /> | ||
| <EventRecordID>266417</EventRecordID> | ||
| <Correlation /> | ||
| <Execution ProcessID="1444" ThreadID="2044" /> | ||
| <Channel>Security</Channel> | ||
| <Computer>Pedro01</Computer> | ||
| <Security /> | ||
| </System> | ||
| <UserData> | ||
| <LogFileCleared xmlns="http://manifests.microsoft.com/win/2004/08/windows/eventlog"> | ||
| <SubjectUserSid>S-1-5-21-968647429-258479840-2507984072-1001</SubjectUserSid> | ||
| <SubjectUserName>pedro</SubjectUserName> | ||
| <SubjectDomainName>PEDRO01</SubjectDomainName> | ||
| <SubjectLogonId>0x20256d6</SubjectLogonId> | ||
| </LogFileCleared> | ||
| </UserData> | ||
| </Event> |
37 changes: 37 additions & 0 deletions
37
windows/etw-providers/Microsoft-Windows-Eventlog/events/event-6005.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| name: Event 6005 - The Event Log service was started | ||
| description: The Event Log service was started. Indicates the system startup. | ||
| platform: windows | ||
| log_source: Microsoft-Windows-Eventlog | ||
| event_id: '6005' | ||
| event_version: '0' | ||
| event_fields: | ||
| - standard_name: TBD | ||
| standard_type: TBD | ||
| name: Binary | ||
| type: TBD | ||
| description: TBD | ||
| sample_value: E607080002000900100009001B0038000000000000000000 | ||
| references: | ||
| - https://www.shellhacks.com/windows-shutdown-reboot-event-ids-get-logs/ | ||
| tags: | ||
| - etw_level_Informational | ||
| event_sample: | ||
| - format: xml | ||
| sample: |- | ||
| <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> | ||
| <System> | ||
| <Provider Name="EventLog" /> | ||
| <EventID Qualifiers="32768">6005</EventID> | ||
| <Level>4</Level> | ||
| <Task>0</Task> | ||
| <Keywords>0x80000000000000</Keywords> | ||
| <TimeCreated SystemTime="2022-08-09T16:09:27.056581000Z" /> | ||
| <EventRecordID>686</EventRecordID> | ||
| <Channel>System</Channel> | ||
| <Computer>Pedro01</Computer> | ||
| <Security /> | ||
| </System> | ||
| <EventData> | ||
| <Binary>E607080002000900100009001B0038000000000000000000</Binary> | ||
| </EventData> | ||
| </Event> |
37 changes: 37 additions & 0 deletions
37
windows/etw-providers/Microsoft-Windows-Eventlog/events/event-6006.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| name: Event 6006 - The Event Log service was stopped | ||
| description: The Event Log service was stopped. Indicates the proper system shutdown. | ||
| platform: windows | ||
| log_source: Microsoft-Windows-Eventlog | ||
| event_id: '6006' | ||
| event_version: '0' | ||
| event_fields: | ||
| - standard_name: TBD | ||
| standard_type: TBD | ||
| name: Binary | ||
| type: TBD | ||
| description: TBD | ||
| sample_value: 0100000031F40800 | ||
| references: | ||
| - https://www.shellhacks.com/windows-shutdown-reboot-event-ids-get-logs/ | ||
| tags: | ||
| - etw_level_Informational | ||
| event_sample: | ||
| - format: xml | ||
| sample: |- | ||
| <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> | ||
| <System> | ||
| <Provider Name="EventLog" /> | ||
| <EventID Qualifiers="32768">6006</EventID> | ||
| <Level>4</Level> | ||
| <Task>0</Task> | ||
| <Keywords>0x80000000000000</Keywords> | ||
| <TimeCreated SystemTime="2022-08-09T16:08:38.915070600Z" /> | ||
| <EventRecordID>678</EventRecordID> | ||
| <Channel>System</Channel> | ||
| <Computer>Pedro01</Computer> | ||
| <Security /> | ||
| </System> | ||
| <EventData> | ||
| <Binary>0100000031F40800</Binary> | ||
| </EventData> | ||
| </Event> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.