search

keydet89 / Tools

Tools from WFA 4/e, timeline tools, etc.
130 stars 30 forks source link

Additional events for eventmap.txt #1

Open elhoim opened 9 years ago

elhoim commented 9 years ago

Suggestion for additions:

https://www.nsa.gov/ia/_files/app/spotting_the_adversary_with_windows_event_log_monitoring.pdf Has a nice categorized list starting at page 25 with explanations and one page summary with categories / event IDs at page 8.

Other events not listed in it and that might be of interest: 4719 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4719 4679 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4697

keydet89 commented 9 years ago

Have you added any of these to your copy of eventmap.txt?

Sent from my iPhone7 running iOS 6.5

On Apr 24, 2015, at 2:43 AM, David André notifications@github.com wrote:

https://www.nsa.gov/ia/_files/app/spotting_the_adversary_with_windows_event_log_monitoring.pdf Has a nice categorized list starting at page 25 with explanations and one page summary with categories / event IDs at page 8.

Other events not listed in it and that might be of interest: 4719 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4719 4679 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4697

— Reply to this email directly or view it on GitHub.