nxlog*


Group Membership Changes

Question: EventID : (4728 or 4729 or 4732 or 4733 or 4735 or 4737)

Question: EventID : (4728 or 4729 or 4732 or 4733 or 4735 or 4737)

Unique count of LogFileCleared.SubjectUserName.keyword

Top 5 values of LogFileCleared.SubjectUserName.keyword

Top 3 values of TargetOutboundUserName.keyword

Group Policy Changes

Question: EventID : (4739 or 5136)

Empty XY chart

Question: EventID : (4739 or 5136)

Unique count of LogFileCleared.SubjectDomainName.keyword

Top 3 values of LogFileCleared.SubjectUserName.keyword

Unique count of SubjectDomainName.keyword

USB Activity

6416 or 6424)

Question: EventID : (6416 or 6424)

Question: EventID : (6416 or 6424)

NPS Authentication

(6272 or 6273 or 6274)

Question: EventID : (6272 or 6273 or 6274)

Empty XY chart

Question: EventID : (6272 or 6273 or 6274)

nxlog*

WMI Execution

EventID : (5857 or 5858)

Question: EventID : (5857 or 5858)

Question: EventID : (5857 or 5858)

Question: EventID : (400 or 4102 or 4103 or 4104 or 4105 or 4106)

Question: EventID : (400 or 4102 or 4103 or 4104 or 4105 or 4106)

nxlog*

PowerShell Execution Events

PowerShell Execution Events (EventIDs 400, 4102–4106) – MITRE T1059.001

Question: EventID : (400 or 4102 or 4103 or 4104 or 4105 or 4106)

Question: EventID : (400 or 4102 or 4103 or 4104 or 4105 or 4106)

Question: "EventID": *

Question: "Hostname.keyword": *

Question: "Severity.keyword": *

Question: "AccountName.keyword": *

Question: "ScriptBlockText.keyword": *

Question: "Message.keyword": *

Question: "ScriptBlockId.keyword": *

nxlog*

Question: EventID : (4624 or 4625 or 4648)

Question: EventID : (4624 or 4625 or 4648)

nxlog*

Process Creation

(EventID 4688) – MITRE T1059 / T1204.002

Question: EventID : 4688

Question: EventID : 4688

Question: "Hostname.keyword": *

Question: "SubjectUserName.keyword": *

Question: "SubjectDomainName.keyword": *

Question: "NewProcessName.keyword": *

Question: "TokenElevationTypeResolved.keyword": *

Question: "MandatoryLabelName.keyword": *

Question: "EventID": *

Question: "Channel.keyword": *

Question: "NewProcessName.keyword": *

nxlog*

Question: EventID : 4688

Question: EventID : 4688

nxlog*

Service Abuse

Question: EventID : (4697 or 7045)

Question: EventID : (4697 or 7045)

Question: "ServiceFileName.keyword": *

Question: "ServiceAccount.keyword": *

Question: "ServiceStartType": *

Question: "ServiceType.keyword": *

Question: "Category.keyword": *

Question: "ExecutionProcessID": *

Question: "EventType.keyword": *

Question: "ClientProcessId": *

Question: "EventID": *

nxlog*

Question: EventID : (4697 or 7045)

Question: EventID : (4697 or 7045)

nxlog*

Question: EventID : 4699

Question: EventID : 4699

nxlog*

Question: EventID: 4700

Question: EventID: 4700

Question: EventID: 4701

Question: EventID: 4701

Question: EventID: 4702

Question: EventID: 4702

nxlog*

Question: EventID: 4672

Question: EventID: 4672

Special privileges assigned to new logon

nxlog*

Question: EventID: 4673

Question: EventID: 4673

Question: EventID: 4964

Question: EventID: 4964

Special groups have been assigned to a new logon

Scheduled Task Ops

EventID >= 4698 and EventID <= 4702

Question: EventID >= 4698 and EventID <= 4702

Question: EventID >= 4698 and EventID <= 4702

Question: "EventID": *

Question: "Hostname.keyword": *

Question: "EventType.keyword": *

Question: "SubjectUserSidName.keyword": *

Question: "SubjectUserName.keyword": *

Question: "SubjectDomainName.keyword": *

Question: "TaskName.keyword": *

Question: "ClientProcessId": *

nxlog*

Privilege Escalation

EventID : (4672 or 4673 or 4964)

Question: EventID : (4672 or 4673 or 4964)

Question: EventID : (4672 or 4673 or 4964)

Question: "EventID": *

Question: "EventType.keyword": *

Question: "Hostname.keyword": *

Question: "SubjectUserSid.keyword": *

Question: "SubjectUserName.keyword": *

Question: "SubjectDomainName.keyword": *

Question: "SubjectLogonId.keyword": *

Question: "Category.keyword": *

nxlog*

Question: EventID : 4625

Question: EventID : 4625

Question: EventID : 4624

Question: EventID : 4624

nxlog*

Question: EventID :4648

Question: EventID :4648

A logon was attempted using explicit credentials

Authentication

(4624 or 4625 or 4648)

Question: EventID : (4624 or 4625 or 4648)

Question: EventID : (4624 or 4625 or 4648)

Question: "LogonType": *

Question: "TargetUserName.keyword": *

Question: "TargetDomainName.keyword": *

Question: "TargetUserSidName.keyword": *

Question: "SubjectUserSid.keyword": *

Question: "LogonProcessName.keyword": *

Question: "AuthenticationPackageName.keyword": *

Question: "ElevatedToken.keyword": *

Question: "VirtualAccount.keyword": *

Question: "ImpersonationLevel.keyword": *

Question: "EventID": *

nxlog*

Question: EventID : 1102

Question: EventID : 1102

Audit Log Cleared

Security Log Cleared – EventID 1102 (T1070.001)"

Question: Hanye

Question: EventID : 1102

Question: EventID : 1102

Question: Hanye

Question: "Message.keyword": *

Question: "Hostname.keyword": *

Question: "EventID": *

Question: "LogFileCleared.SubjectDomainName.keyword": *

Question: "LogFileCleared.SubjectLogonId.keyword": *

Question: "LogFileCleared.SubjectUserSidName.keyword": *

Question: "LogFileCleared.ClientProcessId": *

nxlog*

Windows Security Monitoring