hunters-forge-OSSEM/docs/attack/windows/ds_mapping_table.md

Data Modeling Table

Data Source	Sub Data Source	Source	Relationship	Target	EventID	Event Description	Event Channel
Authentication logs	NTLM Credentials Validation	host	authenticated	user	4776	The computer attempted to validate the credentials for an account	Security
Authentication logs	kerberos TGT authentication failure	user	authenticated_with	ticket granting ticket	4771	Kerberos pre-authentication failed	Security
Authentication logs	user account successful authentication	user	authenticated	host	4624	An account was successfully logged on	Security
Authentication logs	user account authentication with explicit credential	user	authenticated	host	4648	A logon was attempted using explicit credentials	Security
DLL monitoring	module load	process	loaded	module	7	The image loaded event logs when a module is loaded in a specific process .	Microsoft-windows-sysmon/operational
DNS records	DNS Queries	process	execute	dns_query	22	This event generates when a process executes a DNS query, whether the result is successful or fails, cached or not.	Microsoft-windows-sysmon/operational
File monitoring	drivers load	driver	loaded	driver	6	The driver loaded events provides information about a driver being loaded on the system	Microsoft-windows-sysmon/operational
File monitoring	drive raw access	process	raw_access_read	drive	9	The RawAccessRead event detects when a process conducts reading operations from the drive using the .\ denotation	Microsoft-windows-sysmon/operational
File monitoring	file creation	process	created	file	11	File create operations are logged when a file is created or overwritten.	Microsoft-windows-sysmon/operational
File monitoring	file timestamp modification	process	modified	file	2	A process changed a file creation time	Microsoft-windows-sysmon/operational
File monitoring	file modification	process	modified	file	11	File create operations are logged when a file is created or overwritten.	Microsoft-windows-sysmon/operational
File monitoring	file modification	process	renamed	file	11	File create operations are logged when a file is created or overwritten.	Microsoft-windows-sysmon/operational
File monitoring	file download	process	downloaded	file	11	File create operations are logged when a file is created or overwritten.	Microsoft-windows-sysmon/operational
File monitoring	file access	user	accessed	file	5145	A network share object was checked to see whether client can be granted desired access	Security
File monitoring	file access request	user	requested_a_handle	file	4656	A handle to an object was requested.	Security
File monitoring	file deletion request	user	requested_a_handle	file	4656	A handle to an object was requested.	Security
File monitoring	file access	user	accessed	file	4663	An attempt was made to access an object.	Security
File monitoring	file deletion	user	deleted	file	4663	An attempt was made to access an object.	Security
File monitoring	file permissions change	user	changed_permissions	file	4670	Permissions on an object were changed.	Security
File monitoring	file deletion	process	deleted	None	4660	An object was deleted	Security
File monitoring	win registry key handle closed	process	closed_a_handle	handle	4658	The handle to an object was closed	Security
Loaded DLLs	module load	process	loaded	module	7	The image loaded event logs when a module is loaded in a specific process .	Microsoft-windows-sysmon/operational
Named Pipes	win pipe creation	process	created	pipe	17	This event generates when a named pipe is created.	Microsoft-windows-sysmon/operational
Named Pipes	win pipe connection	process	connected_to	pipe	18	This event logs when a named pipe connection is made between a client and a server.	Microsoft-windows-sysmon/operational
Process command-line parameters	process creation	process	created	process	4688	A new process has been created	Security
Process command-line parameters	process creation	process	created	process	1	Process creation	Microsoft-windows-sysmon/operational
Process monitoring	process creation	process	created	process	4688	A new process has been created	Security
Process monitoring	process creation	process	created	process	1	Process creation	Microsoft-windows-sysmon/operational
Process monitoring	process termination	user	terminated	process	4689	A process has exited	Security
Process monitoring	process termination	process	terminated	None	5	The process terminate event reports when a process terminates.	Microsoft-windows-sysmon/operational
Process monitoring	process write to process	process	wrote_to	process	8	The CreateRemoteThread event detects when a process creates a thread in another process.	Microsoft-windows-sysmon/operational
Process monitoring	process access	process	opened	process	10	The process accessed event reports when a process opens another process.	Microsoft-windows-sysmon/operational
Process use of network	process network connection allow	process	connected_to	ip	3	The network connection event logs TCP/UDP connections on the machine.	Microsoft-windows-sysmon/operational
Process use of network	process network connection allow	process	connected_to	host	3	The network connection event logs TCP/UDP connections on the machine.	Microsoft-windows-sysmon/operational
Process use of network	process network connection allow	user	connected_to	host	3	The network connection event logs TCP/UDP connections on the machine.	Microsoft-windows-sysmon/operational
Process use of network	process network connection allow	user	connected_to	ip	3	The network connection event logs TCP/UDP connections on the machine.	Microsoft-windows-sysmon/operational
Process use of network	process network service connection block	host	blocked_service_connection_to	process	5031	The Windows Firewall Service blocked an application from accepting incoming connections on the network.	Security
Process use of network	process network listener allow	host	permitted_listener_on	process	5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.	Security
Process use of network	process network listener block	host	blocked_listener_on	process	5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.	Security
Process use of network	process network connection allow	host	permitted_inbound_connection_on	process	5156	The Windows Filtering Platform has permitted a connection.	Security
Process use of network	process network connection allow	process	connected_from	ip	5156	The Windows Filtering Platform has permitted a connection.	Security
Process use of network	process network connection allow	host	permitted_outbound_connection_on	process	5156	The Windows Filtering Platform has permitted a connection.	Security
Process use of network	process network connection allow	process	connected_to	ip	5156	The Windows Filtering Platform has permitted a connection.	Security
Process use of network	process network connection block	host	blocked_inbound_connection_on	process	5157	The Windows Filtering Platform has blocked a connection.	Security
Process use of network	process network connection block	host	blocked_outbound_connection_on	process	5157	The Windows Filtering Platform has blocked a connection.	Security
Process use of network	process network local port bind allow	host	permitted_local_port_bind_on	process	5158	The Windows Filtering Platform has permitted a bind to a local port.	Security
Process use of network	process network local port bind allow	process	bound _to	port	5158	The Windows Filtering Platform has permitted a bind to a local port.	Security
Process use of network	process network local port bind blocked	host	blocked_local_port_bind_on	process	5159	The Windows Filtering Platform has blocked a bind to a local port.	Security
Windows event logs	kerberos TGT request	user	requested	ticket granting ticket	4768	A Kerberos authentication ticket (TGT) was requested	Security
Windows event logs	kerberos service ticket request	user	requested	service ticket	4769	A Kerberos service ticket was requested	Security
Windows event logs	kerberos service ticket renewal	user	renewed	service ticket	4770	A Kerberos service ticket was renewed	Security
Windows event logs	kerberos service ticket failure	user	requested	service ticket	4773	A Kerberos service ticket request failed	Security
Windows event logs	user rdp session	user	disconnected_from	host	4779	A session was disconnected from a Window Station	Security
Windows event logs	user rdp session	user	connected_to	host	4778	A session was reconnected to a Window Station	Security
Windows event logs	user lock operation	user	locked	host	4800	The workstation was locked	Security
Windows event logs	user unlock operation	user	unlocked	host	4801	The workstation was unlocked	Security
Windows event logs	computer account creation	user	created	computer	4741	A computer account was created	Security
Windows event logs	computer account change	user	changed	computer	4742	A computer account was changed	Security
Windows event logs	computer account deletion	user	deleted	computer	4743	A computer account was deleted	Security
Windows event logs	distribution group creation	user	created	group	4749	A security-disabled global group was created	Security
Windows event logs	distribution group change	user	changed	group	4750	A security-disabled global group was changed	Security
Windows event logs	distribution group member addition	user	added	user	4751	A member was added to a security-disabled global group	Security
Windows event logs	distribution group member removal	user	removed	user	4752	A member was removed from a security-disabled global group	Security
Windows event logs	distribution group deletion	user	deleted	group	4753	A security-disabled global group was deleted	Security
Windows event logs	security group creation	user	created	group	4731	A security-enabled local group was created	Security
Windows event logs	security group member addition	user	added	user	4732	A member was added to a security-enabled local group.	Security
Windows event logs	security group member removal	user	removed	user	4733	A member was removed from a security-enabled local group.	Security
Windows event logs	security group deletion	user	deleted	group	4734	A security-enabled local group was deleted.	Security
Windows event logs	security group change	user	changed	group	4735	A security-enabled local group was changed.	Security
Windows event logs	security group type change	user	changed_type	group	4764	A group’s type was changed	Security
Windows event logs	security group enumeration	user	enumerated	group members	4799	A security-enabled local group membership was enumerated	Security
Windows event logs	user account creation	user	created	user	4720	A user account was created.	Security
Windows event logs	user account enable	user	enabled	user	4722	A user account was enabled.	Security
Windows event logs	user account password change	user	changed_password	user	4723	An attempt was made to change an account's password.	Security
Windows event logs	user account password reset	user	reset_password	user	4724	An attempt was made to reset an account's password.	Security
Windows event logs	user account disable	user	disabled	user	4725	A user account was disabled.	Security
Windows event logs	user account deletion	user	deleted	user	4726	A user account was deleted.	Security
Windows event logs	user account change	user	changed	user	4738	A user account was changed.	Security
Windows event logs	user account lock	user	locked	user	4740	A user account was locked out.	Security
Windows event logs	user account unlock	user	unlocked	user	4767	A user account was unlocked.	Security
Windows event logs	user account name change	user	changed_name	user	4781	The name of an account was changed	Security
Windows event logs	user account group enumeration	user	enumerated	user	4798	A user's local group membership was enumerated.	Security
Windows event logs	user account group enumeration	user	enumerated	group	4799	A security-enabled local group membership was enumerated	Security
Windows event logs	directory service object access	user	accessed	ad object	4662	An operation was performed on an object	Security
Windows event logs	directory service object handle request	user	requested_a_handle	ad object	4661	A handle to an object was requested	Security
Windows event logs	directory service object modification	user	modified	ad object	5136	A directory service object was modified	Security
Windows event logs	directory service object creation	user	created	ad object	5137	A directory service object was created	Security
Windows event logs	directory service object restoration	user	restored	ad object	5138	A directory service object was undeleted	Security
Windows event logs	directory service object move	user	moved	ad object	5139	A directory service object was moved	Security
Windows event logs	directory service object deletion	user	deleted	ad object	5141	A directory service object was deleted	Security
Windows event logs	user account lockout	user	failed	host	4625	An account failed to log on	Security
Windows event logs	network share access	user	accessed	network share	5140	A network share object was accessed.	Security
Windows event logs	network share addition	user	added	network share	5142	A network share object was added.	Security
Windows event logs	network share modification	user	modified	network share	5143	A network share object was modified.	Security
Windows event logs	network share deletion	user	deleted	network share	5144	A network share object was deleted.	Security
Windows event logs	win registry access request	process	requested_a_handle	win registry key	4656	A handle to an object was requested.	Security
Windows event logs	win registry access request	user	requested_a_handle	win registry key	4656	A handle to an object was requested.	Security
Windows event logs	win registry deletion request	process	requested_a_handle	win registry key	4656	A handle to an object was requested.	Security
Windows event logs	win registry deletion request	user	requested_a_handle	win registry key	4656	A handle to an object was requested.	Security
Windows event logs	symbolic link creation	user	created	symbolic link	4664	An attempt was made to create a hard link.	Security
Windows event logs	scheduled task creation	user	created	scheduled task	4698	A scheduled task was created.	Security
Windows event logs	scheduled task deletion	user	deleted	scheduled task	4699	A scheduled task was deleted.	Security
Windows event logs	scheduled task enable	user	enabled	scheduled task	4700	A scheduled task was enabled.	Security
Windows event logs	scheduled tast disable	user	disabled	scheduled task	4701	A scheduled task was disabled.	Security
Windows event logs	scheduled task update	user	updated	scheduled task	4702	A scheduled task was updated.	Security
Windows event logs	win registry key deletion	process	deleted	None	4660	An object was deleted	Security
Windows event logs	win registry key access	process	accessed	win registry key	4663	An attempt was made to access an object.	Security
Windows event logs	win registry key access	user	accessed	win registry key	4663	An attempt was made to access an object.	Security
Windows event logs	win registry key deletion	process	deleted	win registry key	4663	An attempt was made to access an object.	Security
Windows event logs	win registry key deletion	user	deleted	win registry key	4663	An attempt was made to access an object.	Security
Windows event logs	win registry key handle closed	process	closed_a_handle	handle	4658	The handle to an object was closed	Security
Windows event logs	win registry key permissions change	process	changed_permissions	win registry key	4670	Permissions on an object were changed.	Security
Windows event logs	win registry key permissions change	user	changed_permissions	win registry key	4670	Permissions on an object were changed.	Security
Windows event logs	win registry key value modification	user	modified	win registry key value	4657	A registry value was modified.	Security
Windows event logs	win registry key value modification	process	modified	win registry key value	4657	A registry value was modified.	Security
Windows event logs	sam service object handle request	user	requested_a_handle	sam object	4661	A handle to an object was requested	Security
Windows event logs	user account access addition	user	granted_access	user	4717	System security access was granted to an account.	Security
Windows event logs	user account access removal	user	removed_access	user	4718	System security access was removed from an account.	Security
Windows event logs	non-sensitive privileged operation	process	attempted	object	4674	An operation was attempted on a privileged object.	Security
Windows event logs	sensitive privileged service operation	process	called	privileged service	4673	A privileged service was called.	Security
Windows event logs	sensitive privileged operation	process	attempted	privileged object	4674	An operation was attempted on a privileged object.	Security
Windows event logs	win firewall service stop	process	stopped	Firewall Service	5025	The Windows Firewall Service has been stopped.	Security
Windows event logs	win firewall service stop	user	stopped	Firewall Service	5025	The Windows Firewall Service has been stopped.	Security
Windows event logs	win firewall driver stop	process	stopped	Firewall Driver	5034	The Windows Firewall Driver was stopped.	Security
Windows event logs	win firewall driver stop	user	stopped	Firewall Driver	5034	The Windows Firewall Driver was stopped.	Security
Windows event logs	win service installation	user	installed	service	4697	A service was installed in the system.	Security
Windows event logs	NTLM Credentials Validation	host	authenticated	user	4776	The computer attempted to validate the credentials for an account	Security
Windows event logs	kerberos TGT authentication failure	user	authenticated_with	ticket granting ticket	4771	Kerberos pre-authentication failed	Security
Windows event logs	user account successful authentication	user	authenticated	host	4624	An account was successfully logged on	Security
Windows event logs	user account authentication with explicit credential	user	authenticated	host	4648	A logon was attempted using explicit credentials	Security
Windows Registry	win registry key value modification	user	modified	win registry key value	4657	A registry value was modified.	Security
Windows Registry	win registry key value modification	process	modified	win registry key value	4657	A registry value was modified.	Security
Windows Registry	win registry key creation	process	created	win registry key	12	Registry key and value create and delete operations map to this event type. (Object create and delete)	Microsoft-windows-sysmon/operational
Windows Registry	win registry key deletion	process	deleted	win registry key	12	Registry key and value create and delete operations map to this event type. (Object create and delete)	Microsoft-windows-sysmon/operational
Windows Registry	win registry key modification	process	renamed	win registry key	14	Registry key and value rename operations map to this event type. (Key and Value Rename)	Microsoft-windows-sysmon/operational
Windows Registry	win registry key value modification	process	renamed	win registry key value	14	Registry key and value rename operations map to this event type. (Key and Value Rename)	Microsoft-windows-sysmon/operational
Windows Registry	win registry key value modification	process	modified	win registry key value	13	This Registry event type identifies Registry value modifications. (Value Set)	Microsoft-windows-sysmon/operational