deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-15 06:47:21 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #5572 from j0rt3g4/I#5521

Browse Source 
Added query 42 and source #5521
This commit is contained in:
Daniel Simpson 2019-12-03 06:55:48 -08:00 committed by GitHub
commit ded7bd9524
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
View File

@ -573,6 +573,11 @@ Here are the minimum steps for WEF to operate:
<Select Path="Microsoft-Windows-Windows Defender/Operational">*[System[( (EventID &gt;= 1006 and EventID &lt;= 1009) )]]</Select> <Select Path="Microsoft-Windows-Windows Defender/Operational">*[System[( (EventID &gt;= 1006 and EventID &lt;= 1009) )]]</Select>
<Select Path="Microsoft-Windows-Windows Defender/Operational">*[System[( (EventID &gt;= 1116 and EventID &lt;= 1119) )]]</Select> <Select Path="Microsoft-Windows-Windows Defender/Operational">*[System[( (EventID &gt;= 1116 and EventID &lt;= 1119) )]]</Select>
</Query> </Query>
<Query Id="42" Path="Security">
<!-- An account Failed to Log on events -->
<Select Path="Security">*[System[(EventID=4625)]] and (*[EventData[Data[@Name="LogonType"]!="2"]]) </Select>
</Query>
</QueryList> </QueryList>
``` ```
@ -654,5 +659,6 @@ You can get more info with the following links:
- [Event Queries and Event XML](https://msdn.microsoft.com/library/bb399427.aspx) - [Event Queries and Event XML](https://msdn.microsoft.com/library/bb399427.aspx)
- [Event Query Schema](https://msdn.microsoft.com/library/aa385760.aspx) - [Event Query Schema](https://msdn.microsoft.com/library/aa385760.aspx)
- [Windows Event Collector](https://msdn.microsoft.com/library/windows/desktop/bb427443.aspx) - [Windows Event Collector](https://msdn.microsoft.com/library/windows/desktop/bb427443.aspx)
- [4625(F): An account failed to log on](https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4625)