awesome-event-ids

Collection of Event ID ressources useful for Digital Forensics and Incident Response
https://github.com/stuhli/awesome-event-ids

Last synced: 7 days ago
JSON representation

Resources
- Event ID analysis
  - Attack and Defense Around PowerShell Event Logging - PowerShell logging deep dive from different perspectives by Mina Hao.
  - RDP Logon / Logoff events 1 - RDP event chain by Jonathon Poling.
  - RDP Logon / Logoff events 2 - RDP deep dive on 1149 by Mike Cary.
  - Task Scheduler Event IDs - List of the most common Event IDs for Windows Scheduled Tasks by mnaoumov.
  - Traces of Windows remote command execution - Blogpost focused on remote command execution techniques used by attackers and read teamers and detailed logging recommendations.
  - Windows Event ID 4776 [SOLVED - Blogpost explaining the meaning of 4776 by Diego Asturias.
  - EvtxECmd Map Repository - Maps used by Eric Zimmerman's EvtxECmd which provide examples of Event IDs with documentation, lookup tables, and important values within each respective event ID which are parsed by EvtxECmd using the associated Map.
  - Event Log Observer - View, analyze and monitor events recorded in Microsoft Windows event logs.
  - Antivirus Event Analysis Cheat Sheet - Antivirus Event Analysis Cheat Sheet.
  - EVTX Attack Samples - EVTX samples recorded during attack simulations by sbousseaden.
  - EVTX-to-MITRE-Attack - More than 170 EVTX samples matched to MITRE TTPs provided by [mdecrevoisier](https://twitter.com/mdecrevoisier)
  - Tool Analysis Result Sheet - Logs analyzed after tool execution by JPCERT.
  - Splunk advanced input configuration for Windows - Provides an advanced input.conf file for Windows and 3rd party related software with more than 70 different event log mapped to the MITRE Att&CK.
  - Windows Security Event ID Helper - [_Work in progress_] Will allow you to filter on each GPO setting and display all Event IDs produced by it.
- Event ID databases
  - EventTracker Knowledgebase - Database
  - MyEventlog.com - Database
- Event ID documentation
  - Kaspersky Security for Microsoft Exchange - Official resource.
  - Microsoft Windows Security Auditing by Randy Franklin Smith - Better known as _Ultimate Windows Security_.
  - Notable Event IDs - Collection of common event IDs with descriptions.
  - Sysmon - Official resource.
  - Symantec Endpoint Protection 14.0.X - Official resource.
  - Symantec Endpoint Protection Manager - Official resource.
  - McAfee VirusScan Enterprise 8.x - VirusScan Enterprise entries in the Windows Application Event Log (Official resource).
  - Compilation of Event IDs - Collection of event IDs from 1 to 9999 and above.
  - Events and Errors - Windows Server 2008 - Collection of event IDs from different windows event source. Applies to Windows Server 2008 and similar. (Official resource)
  - Finding Forensic Goodness In Obscure Windows Event Logs - List of lesser-known Event IDs.
  - Compilation of Event IDs - Collection of event IDs from 1 to 9999 and above.
  - Microsoft Defender Antivirus - Official resource.
  - Microsoft Windows Security Auditing - Official resource.
- Event ID configuration and monitoring suggestions
  - Audit Policy Recommendations - Audit Policy Recommendations by Microsoft.
  - Windows Auditing Mindmap - Set of Mindmaps providing a detailed overview of the different Windows auditing capacities and event log files.
  - Script Block Logging - Enable 4104.
  - Module Logging
  - Malware Archeology PowerShell Logging Cheat Sheet
  - PowerShell Logging for the Blue Team
  - Command line Process Auditing - Enable 4688 featuring command line.
  - Events to Monitor - Official resource.
  - Malware Archeology Windows Logging Cheat Sheet
  - Malware Archeology Advanced Windows Logging Cheat Sheet
  - Malware Archeology Splunk Logging Cheat Sheet - about specific exclusions to avoid getting noise from the Splunk Universal Forwarder agent.
  - Malware Archeology File Auditing Cheat Sheet
  - Malware Archeology Registry Auditing Cheat Sheet
  - Malware Archeology ATT&CK Logging Cheat Sheet - From 2018.
  - US NSA Spotting the Adversary with Windows Event Log Monitoring - Covers quite a lot of ground.
  - UK NCSC - Logging Made Easy WEC (Windows Event Collection) Configuration File
  - Windows Security Monitoring - Policy & Event IDs - Spreadsheet with recommendations sorted by system functions.
  - EventID Policy Map - Spreadsheet with policy map as well as reference collection.
  - Windows security event log library - Small database with explanations and monitoring suggestions.
  - Malware Archeology Sysmon Logging Cheat Sheet
  - SIEM Tactics, Techniques, and Procedures - Comprehensive SIEM resources be TonyPhipps.
  - Windows Auditing Mindmap - Set of Mindmaps providing a detailed overview of the different Windows auditing capacities and event log files.
  - Monitoring Guidance - Event monitoring guidance from JSCU (Joint SIGINT Cyber Unit) from Netherlands. With volume estimates, and WEC/WEF configurations.
  - US NSA Event Forwarding Guidance - Companion repository with WEF configurations, scripts to configure WEF, and WEB subscriptions in XML format.
  - Yamato Security's Ultimate Windows Event Log Configuration Guide For DFIR And Threat Hunting
  - Configuration by SwiftOnSecurity - Configuration file template with default high-quality event tracing.
  - Fork of SwiftOnSecurity by Neo23x0 Florian ROTH - Same as above, with all PR.
  - Configuration by olafhartong - A repository of Sysmon configuration modules.
  - Sysmon Community Guide
  - Greater Visibility Through PowerShell Logging
  - Greater Visibility Through PowerShell Logging
  - Script Block Logging - Enable 4104.
  - Module Logging
  - Critical Windows Event ID's to Monitor - Monitoring suggestions.
Contributing
- Event ID analysis

Programming Languages

PowerShell 4 HTML 2 CSS 1 Batchfile 1

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

awesome-event-ids

Resources

Event ID analysis

Event ID databases

Event ID documentation

Event ID configuration and monitoring suggestions

Contributing

Event ID analysis