2

Event Mapping

Jonathan Johnson edited this page 2025-01-27 09:37:53 -05:00

EventId	EventType	Collection Mechanism	Notes
1	ProcessCreation	PsSetCreateProcessNotifyRoutineEx
2	ProcessTerminate	PsSetCreateProcessNotifyRoutine
3	RemoteThreadCreation	PsSetCreateThreadNotifyRoutine
4	ImageLoad	PsSetLoadImageNotifyRoutine	Driver and UM DLL Loads
5	ProcessAccess	ObRegisterCallbacks.PostOperation.Operation OB_OPERATION_HANDLE_CREATE & OB_OPERATION_HANDLE_DUPLICATE
6	RegistrySaveKey	CmRegisterCallbackEx
8	RegistrySetValue	CmRegisterCallbackEx
9	RegistryKeyCreate	CmRegisterCallbackEx
10	FileCreate	FltRegisterCallback - IRP_MJ_CREATE
11	NamedPipeCreate	FltRegisterCallback - IRP_MJ_CREATE_NAMED_PIPE
12	NamedPipeConnect/Open	FltRegisterCallback - IRP_MJ_CREATE_NAMED_PIPE
13	MailslotCreate	FltRegisterCallback - IRP_MJ_CREATE_MAILSLOT
14	MailslotConnect/Open	FltRegisterCallback - IRP_MJ_CREATE
15	RemoteFileConnection	FltRegisterCallback - IRP_MJ_CREATE
16	DotNetLoad	ETW - Microsoft-Windows-DotNETRuntime
17	WMIPermanantSubscription	Microsoft-Windows-WMI-Activity
18	RPCClientCall	ETW - Microsoft-Windows-RPC	RPC events are collected around the interfaces specified in the MSRPC-to-ATTACK project
19	RPCServerCall	ETW - Microsoft-Windows-RPC	RPC events are collected around the interfaces specified in the MSRPC-to-ATTACK project
20	DPAPI - CryptUnprotectData	ETW - Microsoft-Windows-Crypto-DPAPI
21	NetworkTCPEvent	ETW - Microsoft-Windows-Kernel-Network
22	AMSI	ETW - Microsoft-Antimalware-Scan-Interface
23	RemoteReadProcessMemory	ETW - Microsoft-Windows-Threat-Intelligence
24	RemoteWriteProcessMemory	ETW - Microsoft-Windows-Threat-Intelligence
25	RemoteVirtualAllocation	ETW - Microsoft-Windows-Threat-Intelligence
26	QueueUserAPC	ETW - Microsoft-Windows-Threat-Intelligence
27	TokenImpersonation	UM DLL Extension - Thread Query	Periodically queries the system for threads that are executing as SYSTEM where the process is HIGH IL