win:etw Microsoft-Windows-Kernel-File
Microsoft-Windows-Kernel-File
- Log source
- ETW providers (not persisted to a log by default)
- Host type
- Windows (workstation, member server, domain controller)
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- Sigma 15
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Recommended | |
| Windows member server | Recommended | |
| Windows domain controller | Recommended | |
| Windows web server (IIS), internet-facing | Recommended |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Sigma 15
- Access To .Reg/.Hive Files By Uncommon Applications by frack113
- Access To Browser Credential Files By Uncommon Applications by frack113, X__Junior (Nextron Systems)
- Access To Chromium Browsers Sensitive Files By Uncommon Applications by X__Junior (Nextron Systems)
- Access To Crypto Currency Wallets By Uncommon Applications by X__Junior (Nextron Systems)
- Access To Potentially Sensitive Sysvol Files By Uncommon Applications by frack113
- Access To Sysvol Policies Share By Uncommon Process by frack113
- Access To Windows Credential History File By Uncommon Applications by Nasreddine Bencherchali (Nextron Systems)
- Access To Windows DPAPI Master Keys By Uncommon Applications by Nasreddine Bencherchali (Nextron Systems)
- Access To Windows Outlook Mail Files By Uncommon Applications by frack113
- Credential Manager Access By Uncommon Applications by Nasreddine Bencherchali (Nextron Systems)
- Microsoft Teams Sensitive File Access By Uncommon Applications by @SerkinValery
- Non-DLL Extension File Renamed With DLL Extension by frack113
- Suspicious Appended Extension by frack113
- Suspicious File Access to Browser Credential Storage by frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore
- Unattend.XML File Access Attempt by frack113