CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-07 17:52:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Automated update

Browse Source
This commit is contained in:
github-actions[bot]
2025-03-09 06:53:42 +00:00
parent cbe0f4b1fa
commit 09866cb8d3
1 changed files with 69 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

115
config/eid_subcategory_mapping.csv
View File

@@ -1,46 +1,69 @@
Category,Subcategory,GUID,Event ID "Category","Subcategory","GUID"
System,Security State Change,0CCE9210-69AE-11D9-BED3-505054503030,"4608, 4616, 4621" "System","","69979848-797A-11D9-BED3-505054503030"
System,Security System Extension,0CCE9211-69AE-11D9-BED3-505054503030,"4610, 4611, 4614, 4622, 4697" "System","Security State Change","0CCE9210-69AE-11D9-BED3-505054503030"
System,System Integrity,0CCE9212-69AE-11D9-BED3-505054503030,"4612, 4615, 4618, 4816, 5038, 5056, 5057, 5060, 5061, 6281, 6410" "System","Security System Extension","0CCE9211-69AE-11D9-BED3-505054503030"
System,IPsec Driver,0CCE9213-69AE-11D9-BED3-505054503030,"4960, 4961, 4962, 4963, 4965, 5478, 5479, 5480, 5483, 5484, 5485" "System","System Integrity","0CCE9212-69AE-11D9-BED3-505054503030"
System,Other System Events,0CCE9214-69AE-11D9-BED3-505054503030,"5024, 5025, 5027, 5028, 5029, 5030, 5032, 5033, 5034, 5035, 5037, 5058, 5059, 6400, 6401, 6402, 6403, 6404, 6405, 6406, 6407, 6408, 6409" "System","IPsec Driver","0CCE9213-69AE-11D9-BED3-505054503030"
Logon/Logoff,Logon,0CCE9215-69AE-11D9-BED3-505054503030,"4624, 4625, 4648, 4675" "System","Other System Events","0CCE9214-69AE-11D9-BED3-505054503030"
Logon/Logoff,Logoff,0CCE9216-69AE-11D9-BED3-505054503030,"4634, 4647" "Logon/Logoff","","69979849-797A-11D9-BED3-505054503030"
Logon/Logoff,Account Lockout,0CCE9217-69AE-11D9-BED3-505054503030,4625 "Logon/Logoff","Logon","0CCE9215-69AE-11D9-BED3-505054503030"
Logon/Logoff,IPsec Main Mode,0CCE9218-69AE-11D9-BED3-505054503030,"4646, 4650, 4651, 4652, 4653, 4655, 4976, 5049, 5453" "Logon/Logoff","Logoff","0CCE9216-69AE-11D9-BED3-505054503030"
Logon/Logoff,IPsec Quick Mode,0CCE9219-69AE-11D9-BED3-505054503030,"4977, 5451, 5452" "Logon/Logoff","Account Lockout","0CCE9217-69AE-11D9-BED3-505054503030"
Logon/Logoff,IPsec Extended Mode,0CCE921A-69AE-11D9-BED3-505054503030,"4978, 4979, 4980, 4981, 4982, 4983, 4984" "Logon/Logoff","IPsec Main Mode","0CCE9218-69AE-11D9-BED3-505054503030"
Logon/Logoff,Special Logon,0CCE921B-69AE-11D9-BED3-505054503030,"4672, 4964" "Logon/Logoff","IPsec Quick Mode","0CCE9219-69AE-11D9-BED3-505054503030"
Logon/Logoff,Other Logon/Logoff Events,0CCE921C-69AE-11D9-BED3-505054503030,"4649, 4778, 4779, 4800, 4801, 4802, 4803, 5378, 5632, 5633" "Logon/Logoff","IPsec Extended Mode","0CCE921A-69AE-11D9-BED3-505054503030"
Logon/Logoff,Network Policy Server,0CCE9243-69AE-11D9-BED3-505054503030,"6272, 6273, 6274, 6275, 6276, 6277, 6278, 6279, 6280" "Logon/Logoff","Special Logon","0CCE921B-69AE-11D9-BED3-505054503030"
Logon/Logoff,User / Device Claims,0CCE9247-69AE-11D9-BED3-505054503030,4626 "Logon/Logoff","Other Logon/Logoff Events","0CCE921C-69AE-11D9-BED3-505054503030"
Logon/Logoff,Group Membership,0CCE9249-69AE-11D9-BED3-505054503030,4627 "Logon/Logoff","Network Policy Server","0CCE9243-69AE-11D9-BED3-505054503030"
Object Access,File System,0CCE921D-69AE-11D9-BED3-505054503030,"4656, 4658, 4660, 4663, 4664, 4670, 4985, 5051" "Logon/Logoff","User / Device Claims","0CCE9247-69AE-11D9-BED3-505054503030"
Object Access,Registry,0CCE921E-69AE-11D9-BED3-505054503030,"4656, 4657, 4658, 4660, 4663, 4670, 5039" "Logon/Logoff","Group Membership","0CCE9249-69AE-11D9-BED3-505054503030"
Object Access,Kernel Object,0CCE921F-69AE-11D9-BED3-505054503030,"4656, 4658, 4660, 4663" "Object Access","","6997984A-797A-11D9-BED3-505054503030"
Object Access,SAM,0CCE9220-69AE-11D9-BED3-505054503030,4661 "Object Access","File System","0CCE921D-69AE-11D9-BED3-505054503030"
Object Access,Certification Services,0CCE9221-69AE-11D9-BED3-505054503030,"4868, 4869, 4870, 4871, 4872, 4873, 4874, 4875, 4876, 4877, 4878, 4879, 4880, 4881, 4882, 4883, 4884, 4885, 4886, 4887, 4888, 4889, 4890, 4891, 4892, 4893, 4894, 4895, 4896, 4897, 4898" "Object Access","Registry","0CCE921E-69AE-11D9-BED3-505054503030"
Object Access,Application Generated,0CCE9222-69AE-11D9-BED3-505054503030,"4665, 4666, 4667, 4668" "Object Access","Kernel Object","0CCE921F-69AE-11D9-BED3-505054503030"
Object Access,Handle Manipulation,0CCE9223-69AE-11D9-BED3-505054503030,"4658, 4690" "Object Access","SAM","0CCE9220-69AE-11D9-BED3-505054503030"
Object Access,File Share,0CCE9224-69AE-11D9-BED3-505054503030,"5140, 5142, 5143, 5144, 5168" "Object Access","Certification Services","0CCE9221-69AE-11D9-BED3-505054503030"
Object Access,Filtering Platform Packet Drop,0CCE9225-69AE-11D9-BED3-505054503030,"5152, 5153" "Object Access","Application Generated","0CCE9222-69AE-11D9-BED3-505054503030"
Object Access,Filtering Platform Connection,0CCE9226-69AE-11D9-BED3-505054503030,"5031, 5150, 5151, 5154, 5155, 5156, 5157, 5158, 5159" "Object Access","Handle Manipulation","0CCE9223-69AE-11D9-BED3-505054503030"
Object Access,Other Object Access Events,0CCE9227-69AE-11D9-BED3-505054503030,"4671, 4691, 5148, 5149, 4698, 4699, 4700, 4701, 4702, 5888, 5889, 5890" "Object Access","File Share","0CCE9224-69AE-11D9-BED3-505054503030"
Object Access,Detailed File Share,0CCE9244-69AE-11D9-BED3-505054503030,5145 "Object Access","Filtering Platform Packet Drop","0CCE9225-69AE-11D9-BED3-505054503030"
Object Access,Removable Storage,0CCE9245-69AE-11D9-BED3-505054503030,"4656, 4658, 4663" "Object Access","Filtering Platform Connection","0CCE9226-69AE-11D9-BED3-505054503030"
Object Access,Central Policy Staging,0CCE9246-69AE-11D9-BED3-505054503030,4818 "Object Access","Other Object Access Events","0CCE9227-69AE-11D9-BED3-505054503030"
Privilege Use,Sensitive Privilege Use,0CCE9228-69AE-11D9-BED3-505054503030,"4673, 4674, 4985" "Object Access","Detailed File Share","0CCE9244-69AE-11D9-BED3-505054503030"
Privilege Use,Non Sensitive Privilege Use,0CCE9229-69AE-11D9-BED3-505054503030,"4673, 4674, 4985" "Object Access","Removable Storage","0CCE9245-69AE-11D9-BED3-505054503030"
Privilege Use,Other Privilege Use Events,0CCE922A-69AE-11D9-BED3-505054503030,4985 "Object Access","Central Policy Staging","0CCE9246-69AE-11D9-BED3-505054503030"
Detailed Tracking,Process Creation,0CCE922B-69AE-11D9-BED3-505054503030,"4688, 4696" "Privilege Use","","6997984B-797A-11D9-BED3-505054503030"
Detailed Tracking,Process Termination,0CCE922C-69AE-11D9-BED3-505054503030,4689 "Privilege Use","Sensitive Privilege Use","0CCE9228-69AE-11D9-BED3-505054503030"
Detailed Tracking,DPAPI Activity,0CCE922D-69AE-11D9-BED3-505054503030,"4692, 4693, 4694, 4695" "Privilege Use","Non Sensitive Privilege Use","0CCE9229-69AE-11D9-BED3-505054503030"
Detailed Tracking,RPC Events,0CCE922E-69AE-11D9-BED3-505054503030,5712 "Privilege Use","Other Privilege Use Events","0CCE922A-69AE-11D9-BED3-505054503030"
Detailed Tracking,Plug and Play Events,0CCE9248-69AE-11D9-BED3-505054503030,"6416, 6419, 6420, 6421, 6422, 6423, 6424" "Detailed Tracking","","6997984C-797A-11D9-BED3-505054503030"
Detailed Tracking,Token Right Adjusted Events,0CCE924A-69AE-11D9-BED3-505054503030,4703 "Detailed Tracking","Process Creation","0CCE922B-69AE-11D9-BED3-505054503030"
Policy Change,Audit Policy Change,0CCE922F-69AE-11D9-BED3-505054503030,"4715, 4719, 4817, 4902, 4904, 4905, 4906, 4907, 4908, 4912" "Detailed Tracking","Process Termination","0CCE922C-69AE-11D9-BED3-505054503030"
Policy Change,Authentication Policy Change,0CCE9230-69AE-11D9-BED3-505054503030,"4670, 4706, 4707, 4713, 4716, 4717, 4718, 4739, 4864, 4865, 4866, 4867" "Detailed Tracking","DPAPI Activity","0CCE922D-69AE-11D9-BED3-505054503030"
Policy Change,Authorization Policy Change,0CCE9231-69AE-11D9-BED3-505054503030,"4670, 4703, 4704, 4705, 4911, 4913" "Detailed Tracking","RPC Events","0CCE922E-69AE-11D9-BED3-505054503030"
Policy Change,Filtering Platform Policy Change,0CCE9233-69AE-11D9-BED3-505054503030,"4709, 4710, 4711, 4712, 5040, 5041, 5042, 5043, 5044, 5045, 5046, 5047, 5048" "Detailed Tracking","Plug and Play Events","0CCE9248-69AE-11D9-BED3-505054503030"
Policy Change,MPSSVC Rule-Level Policy Change,0CCE9232-69AE-11D9-BED3-505054503030,"4944, 4945, 4946, 4947, 4948, 4949, 4950, 4951, 4952, 4953, 4954, 4956, 4957, 4958" "Detailed Tracking","Token Right Adjusted Events","0CCE924A-69AE-11D9-BED3-505054503030"
Policy Change,Other Policy Change Events,0CCE9234-69AE-11D9-BED3-505054503030,"4714, 4819, 4826, 4909, 4910, 5063, 5064, 5065, 5066, 5067, 5068, 5069, 5070" "Policy Change","","6997984D-797A-11D9-BED3-505054503030"
"Policy Change","Audit Policy Change","0CCE922F-69AE-11D9-BED3-505054503030"
"Policy Change","Authentication Policy Change","0CCE9230-69AE-11D9-BED3-505054503030"
"Policy Change","Authorization Policy Change","0CCE9231-69AE-11D9-BED3-505054503030"
"Policy Change","MPSSVC Rule-Level Policy Change","0CCE9232-69AE-11D9-BED3-505054503030"
"Policy Change","Filtering Platform Policy Change","0CCE9233-69AE-11D9-BED3-505054503030"
"Policy Change","Other Policy Change Events","0CCE9234-69AE-11D9-BED3-505054503030"
"Account Management","","6997984E-797A-11D9-BED3-505054503030"
"Account Management","User Account Management","0CCE9235-69AE-11D9-BED3-505054503030"
"Account Management","Computer Account Management","0CCE9236-69AE-11D9-BED3-505054503030"
"Account Management","Security Group Management","0CCE9237-69AE-11D9-BED3-505054503030"
"Account Management","Distribution Group Management","0CCE9238-69AE-11D9-BED3-505054503030"
"Account Management","Application Group Management","0CCE9239-69AE-11D9-BED3-505054503030"
"Account Management","Other Account Management Events","0CCE923A-69AE-11D9-BED3-505054503030"
"DS Access","","6997984F-797A-11D9-BED3-505054503030"
"DS Access","Directory Service Access","0CCE923B-69AE-11D9-BED3-505054503030"
"DS Access","Directory Service Changes","0CCE923C-69AE-11D9-BED3-505054503030"
"DS Access","Directory Service Replication","0CCE923D-69AE-11D9-BED3-505054503030"
"DS Access","Detailed Directory Service Replication","0CCE923E-69AE-11D9-BED3-505054503030"
"Account Logon","","69979850-797A-11D9-BED3-505054503030"
"Account Logon","Credential Validation","0CCE923F-69AE-11D9-BED3-505054503030"
"Account Logon","Kerberos Service Ticket Operations","0CCE9240-69AE-11D9-BED3-505054503030"
"Account Logon","Other Account Logon Events","0CCE9241-69AE-11D9-BED3-505054503030"
"Account Logon","Kerberos Authentication Service","0CCE9242-69AE-11D9-BED3-505054503030"
1 Category Subcategory GUID Event ID
2 System Security State Change 0CCE9210-69AE-11D9-BED3-505054503030 69979848-797A-11D9-BED3-505054503030 4608, 4616, 4621
3 System Security System Extension Security State Change 0CCE9211-69AE-11D9-BED3-505054503030 0CCE9210-69AE-11D9-BED3-505054503030 4610, 4611, 4614, 4622, 4697
4 System System Integrity Security System Extension 0CCE9212-69AE-11D9-BED3-505054503030 0CCE9211-69AE-11D9-BED3-505054503030 4612, 4615, 4618, 4816, 5038, 5056, 5057, 5060, 5061, 6281, 6410
5 System IPsec Driver System Integrity 0CCE9213-69AE-11D9-BED3-505054503030 0CCE9212-69AE-11D9-BED3-505054503030 4960, 4961, 4962, 4963, 4965, 5478, 5479, 5480, 5483, 5484, 5485
6 System Other System Events IPsec Driver 0CCE9214-69AE-11D9-BED3-505054503030 0CCE9213-69AE-11D9-BED3-505054503030 5024, 5025, 5027, 5028, 5029, 5030, 5032, 5033, 5034, 5035, 5037, 5058, 5059, 6400, 6401, 6402, 6403, 6404, 6405, 6406, 6407, 6408, 6409
7 Logon/Logoff System Logon Other System Events 0CCE9215-69AE-11D9-BED3-505054503030 0CCE9214-69AE-11D9-BED3-505054503030 4624, 4625, 4648, 4675
8 Logon/Logoff Logoff 0CCE9216-69AE-11D9-BED3-505054503030 69979849-797A-11D9-BED3-505054503030 4634, 4647
9 Logon/Logoff Account Lockout Logon 0CCE9217-69AE-11D9-BED3-505054503030 0CCE9215-69AE-11D9-BED3-505054503030 4625
10 Logon/Logoff IPsec Main Mode Logoff 0CCE9218-69AE-11D9-BED3-505054503030 0CCE9216-69AE-11D9-BED3-505054503030 4646, 4650, 4651, 4652, 4653, 4655, 4976, 5049, 5453
11 Logon/Logoff IPsec Quick Mode Account Lockout 0CCE9219-69AE-11D9-BED3-505054503030 0CCE9217-69AE-11D9-BED3-505054503030 4977, 5451, 5452
12 Logon/Logoff IPsec Extended Mode IPsec Main Mode 0CCE921A-69AE-11D9-BED3-505054503030 0CCE9218-69AE-11D9-BED3-505054503030 4978, 4979, 4980, 4981, 4982, 4983, 4984
13 Logon/Logoff Special Logon IPsec Quick Mode 0CCE921B-69AE-11D9-BED3-505054503030 0CCE9219-69AE-11D9-BED3-505054503030 4672, 4964
14 Logon/Logoff Other Logon/Logoff Events IPsec Extended Mode 0CCE921C-69AE-11D9-BED3-505054503030 0CCE921A-69AE-11D9-BED3-505054503030 4649, 4778, 4779, 4800, 4801, 4802, 4803, 5378, 5632, 5633
15 Logon/Logoff Network Policy Server Special Logon 0CCE9243-69AE-11D9-BED3-505054503030 0CCE921B-69AE-11D9-BED3-505054503030 6272, 6273, 6274, 6275, 6276, 6277, 6278, 6279, 6280
16 Logon/Logoff User / Device Claims Other Logon/Logoff Events 0CCE9247-69AE-11D9-BED3-505054503030 0CCE921C-69AE-11D9-BED3-505054503030 4626
17 Logon/Logoff Group Membership Network Policy Server 0CCE9249-69AE-11D9-BED3-505054503030 0CCE9243-69AE-11D9-BED3-505054503030 4627
18 Object Access Logon/Logoff File System User / Device Claims 0CCE921D-69AE-11D9-BED3-505054503030 0CCE9247-69AE-11D9-BED3-505054503030 4656, 4658, 4660, 4663, 4664, 4670, 4985, 5051
19 Object Access Logon/Logoff Registry Group Membership 0CCE921E-69AE-11D9-BED3-505054503030 0CCE9249-69AE-11D9-BED3-505054503030 4656, 4657, 4658, 4660, 4663, 4670, 5039
20 Object Access Kernel Object 0CCE921F-69AE-11D9-BED3-505054503030 6997984A-797A-11D9-BED3-505054503030 4656, 4658, 4660, 4663
21 Object Access SAM File System 0CCE9220-69AE-11D9-BED3-505054503030 0CCE921D-69AE-11D9-BED3-505054503030 4661
22 Object Access Certification Services Registry 0CCE9221-69AE-11D9-BED3-505054503030 0CCE921E-69AE-11D9-BED3-505054503030 4868, 4869, 4870, 4871, 4872, 4873, 4874, 4875, 4876, 4877, 4878, 4879, 4880, 4881, 4882, 4883, 4884, 4885, 4886, 4887, 4888, 4889, 4890, 4891, 4892, 4893, 4894, 4895, 4896, 4897, 4898
23 Object Access Application Generated Kernel Object 0CCE9222-69AE-11D9-BED3-505054503030 0CCE921F-69AE-11D9-BED3-505054503030 4665, 4666, 4667, 4668
24 Object Access Handle Manipulation SAM 0CCE9223-69AE-11D9-BED3-505054503030 0CCE9220-69AE-11D9-BED3-505054503030 4658, 4690
25 Object Access File Share Certification Services 0CCE9224-69AE-11D9-BED3-505054503030 0CCE9221-69AE-11D9-BED3-505054503030 5140, 5142, 5143, 5144, 5168
26 Object Access Filtering Platform Packet Drop Application Generated 0CCE9225-69AE-11D9-BED3-505054503030 0CCE9222-69AE-11D9-BED3-505054503030 5152, 5153
27 Object Access Filtering Platform Connection Handle Manipulation 0CCE9226-69AE-11D9-BED3-505054503030 0CCE9223-69AE-11D9-BED3-505054503030 5031, 5150, 5151, 5154, 5155, 5156, 5157, 5158, 5159
28 Object Access Other Object Access Events File Share 0CCE9227-69AE-11D9-BED3-505054503030 0CCE9224-69AE-11D9-BED3-505054503030 4671, 4691, 5148, 5149, 4698, 4699, 4700, 4701, 4702, 5888, 5889, 5890
29 Object Access Detailed File Share Filtering Platform Packet Drop 0CCE9244-69AE-11D9-BED3-505054503030 0CCE9225-69AE-11D9-BED3-505054503030 5145
30 Object Access Removable Storage Filtering Platform Connection 0CCE9245-69AE-11D9-BED3-505054503030 0CCE9226-69AE-11D9-BED3-505054503030 4656, 4658, 4663
31 Object Access Central Policy Staging Other Object Access Events 0CCE9246-69AE-11D9-BED3-505054503030 0CCE9227-69AE-11D9-BED3-505054503030 4818
32 Privilege Use Object Access Sensitive Privilege Use Detailed File Share 0CCE9228-69AE-11D9-BED3-505054503030 0CCE9244-69AE-11D9-BED3-505054503030 4673, 4674, 4985
33 Privilege Use Object Access Non Sensitive Privilege Use Removable Storage 0CCE9229-69AE-11D9-BED3-505054503030 0CCE9245-69AE-11D9-BED3-505054503030 4673, 4674, 4985
34 Privilege Use Object Access Other Privilege Use Events Central Policy Staging 0CCE922A-69AE-11D9-BED3-505054503030 0CCE9246-69AE-11D9-BED3-505054503030 4985
35 Detailed Tracking Privilege Use Process Creation 0CCE922B-69AE-11D9-BED3-505054503030 6997984B-797A-11D9-BED3-505054503030 4688, 4696
36 Detailed Tracking Privilege Use Process Termination Sensitive Privilege Use 0CCE922C-69AE-11D9-BED3-505054503030 0CCE9228-69AE-11D9-BED3-505054503030 4689
37 Detailed Tracking Privilege Use DPAPI Activity Non Sensitive Privilege Use 0CCE922D-69AE-11D9-BED3-505054503030 0CCE9229-69AE-11D9-BED3-505054503030 4692, 4693, 4694, 4695
38 Detailed Tracking Privilege Use RPC Events Other Privilege Use Events 0CCE922E-69AE-11D9-BED3-505054503030 0CCE922A-69AE-11D9-BED3-505054503030 5712
39 Detailed Tracking Plug and Play Events 0CCE9248-69AE-11D9-BED3-505054503030 6997984C-797A-11D9-BED3-505054503030 6416, 6419, 6420, 6421, 6422, 6423, 6424
40 Detailed Tracking Token Right Adjusted Events Process Creation 0CCE924A-69AE-11D9-BED3-505054503030 0CCE922B-69AE-11D9-BED3-505054503030 4703
41 Policy Change Detailed Tracking Audit Policy Change Process Termination 0CCE922F-69AE-11D9-BED3-505054503030 0CCE922C-69AE-11D9-BED3-505054503030 4715, 4719, 4817, 4902, 4904, 4905, 4906, 4907, 4908, 4912
42 Policy Change Detailed Tracking Authentication Policy Change DPAPI Activity 0CCE9230-69AE-11D9-BED3-505054503030 0CCE922D-69AE-11D9-BED3-505054503030 4670, 4706, 4707, 4713, 4716, 4717, 4718, 4739, 4864, 4865, 4866, 4867
43 Policy Change Detailed Tracking Authorization Policy Change RPC Events 0CCE9231-69AE-11D9-BED3-505054503030 0CCE922E-69AE-11D9-BED3-505054503030 4670, 4703, 4704, 4705, 4911, 4913
44 Policy Change Detailed Tracking Filtering Platform Policy Change Plug and Play Events 0CCE9233-69AE-11D9-BED3-505054503030 0CCE9248-69AE-11D9-BED3-505054503030 4709, 4710, 4711, 4712, 5040, 5041, 5042, 5043, 5044, 5045, 5046, 5047, 5048
45 Policy Change Detailed Tracking MPSSVC Rule-Level Policy Change Token Right Adjusted Events 0CCE9232-69AE-11D9-BED3-505054503030 0CCE924A-69AE-11D9-BED3-505054503030 4944, 4945, 4946, 4947, 4948, 4949, 4950, 4951, 4952, 4953, 4954, 4956, 4957, 4958
46 Policy Change Other Policy Change Events 0CCE9234-69AE-11D9-BED3-505054503030 6997984D-797A-11D9-BED3-505054503030 4714, 4819, 4826, 4909, 4910, 5063, 5064, 5065, 5066, 5067, 5068, 5069, 5070
47 Policy Change Audit Policy Change 0CCE922F-69AE-11D9-BED3-505054503030
48 Policy Change Authentication Policy Change 0CCE9230-69AE-11D9-BED3-505054503030
49 Policy Change Authorization Policy Change 0CCE9231-69AE-11D9-BED3-505054503030
50 Policy Change MPSSVC Rule-Level Policy Change 0CCE9232-69AE-11D9-BED3-505054503030
51 Policy Change Filtering Platform Policy Change 0CCE9233-69AE-11D9-BED3-505054503030
52 Policy Change Other Policy Change Events 0CCE9234-69AE-11D9-BED3-505054503030
53 Account Management 6997984E-797A-11D9-BED3-505054503030
54 Account Management User Account Management 0CCE9235-69AE-11D9-BED3-505054503030
55 Account Management Computer Account Management 0CCE9236-69AE-11D9-BED3-505054503030
56 Account Management Security Group Management 0CCE9237-69AE-11D9-BED3-505054503030
57 Account Management Distribution Group Management 0CCE9238-69AE-11D9-BED3-505054503030
58 Account Management Application Group Management 0CCE9239-69AE-11D9-BED3-505054503030
59 Account Management Other Account Management Events 0CCE923A-69AE-11D9-BED3-505054503030
60 DS Access 6997984F-797A-11D9-BED3-505054503030
61 DS Access Directory Service Access 0CCE923B-69AE-11D9-BED3-505054503030
62 DS Access Directory Service Changes 0CCE923C-69AE-11D9-BED3-505054503030
63 DS Access Directory Service Replication 0CCE923D-69AE-11D9-BED3-505054503030
64 DS Access Detailed Directory Service Replication 0CCE923E-69AE-11D9-BED3-505054503030
65 Account Logon 69979850-797A-11D9-BED3-505054503030
66 Account Logon Credential Validation 0CCE923F-69AE-11D9-BED3-505054503030
67 Account Logon Kerberos Service Ticket Operations 0CCE9240-69AE-11D9-BED3-505054503030
68 Account Logon Other Account Logon Events 0CCE9241-69AE-11D9-BED3-505054503030
69 Account Logon Kerberos Authentication Service 0CCE9242-69AE-11D9-BED3-505054503030