mirror of
https://github.com/fleetdm/fleet
synced 2026-05-22 16:39:01 +00:00
19 lines
1 KiB
YAML
19 lines
1 KiB
YAML
name: windows_eventlog
|
|
examples: |-
|
|
Tracking user account changes is a key part of both detection & incident response. This query lists all Windows Eventlogs from the Security channel with an EventID of 4720 - A user account was created. There are many other relevant EventIDs that should be monitored as well:
|
|
|
|
- [4722: Account enabled](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4722)
|
|
|
|
- [4724: Password reset](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4724)
|
|
|
|
- [4728: Added to a security-enabled global group](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4728)
|
|
|
|
|
|
```
|
|
SELECT datetime,computer_name,data FROM windows_eventlog WHERE eventid=4720 AND channel='Security'
|
|
```
|
|
|
|
notes: |-
|
|
* This is not an evented table - instead, it pulls directly from the local system's existing eventlogs.
|
|
|
|
* The information returned in the `data` column will be JSON formatted, which will require additional parsing.
|