新建服务:eventlog[System,,,"Service control Manager",^7045$,,skip]
新建任务计划:eventlog[Microsoft-Windows-TaskScheduler/Operational,,,"TaskScheduler",^106$,,skip]
删除任务计划:eventlog["Microsoft-Windows-TaskScheduler/Operational",,,"TaskScheduler",^141$,,skip]
修改组策略:eventlog[Security,,,,4739,,]
删除安全日志:eventlog[Security,,,,1102,,]
删除用户:eventlog[Security,,,,4726,,]
用户登录:eventlog[Security,,,,4722,,]
A member was added to a security-enabled global group:eventlog[Security,,,,4728,,]
trigger:
{Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].logseverity(0)}>1 and {Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].nodata(600)}=0 and ({Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].str(Admins)}=1 or {Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].str(Management)}=1 or {Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].str(Group Policy)}=1 or {Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].str(RODC)}=1 or {Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].str(Controllers)}=1 )
A member was added to a security-enabled universal group:eventlog[Security,,,,4756,,]
A memeber was added a security-enabled local group:eventlog[Security,,,,4732,,]
A security-enabled global group was deleted:eventlog[Security,,,,^4730$]
A security-enabled universal group was deleted:eventlog[Security,,,,^4758$]