whx
/
killchain-compendium
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

more eventcodes

This commit is contained in:
gurkenhabicht 2026-04-11 16:47:10 +02:00
parent 57f80bd460
commit 311719b8a3
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
Forensics/Windows Event Logs.md
View File

@ -84,6 +84,13 @@ The `Logon ID` is the session identifier.
`net use /user:`) `net use /user:`)
* **4779**: Session disconnect * **4779**: Session disconnect
### AD & Entra ID
* **50126**: Invalide username or password
* **50053**: Account locked, because too many attempts were failed
* **50074**: MFA required but not provided
* **50055**: Password expired
### Active Directory Objects ### Active Directory Objects
* **5136**: Attribute-level modification on AD object (e.g. Group Policy Objects) * **5136**: Attribute-level modification on AD object (e.g. Group Policy Objects)
@ -91,6 +98,14 @@ The `Logon ID` is the session identifier.
* **5140**: Object Access * **5140**: Object Access
* **5145**: Shared Access * **5145**: Shared Access
#### Network Policy Server
RADIUS connection via VPN.
* **6272**: Network Policy Server granted access (e.g. VPN login)
* **6273**: Network Policy Server denied access (e.g. VPN login failed)
* **6274**: Network Policy Server discarded the request (e.g. incorrect request)
### Logon Types ### Logon Types
* **2**: Interactive * **2**: Interactive