Skip to content
Sign In
Telemetry

win:security 5124

A security setting was updated on the OCSP Responder Service.

Log source
Windows Security event log
Host type
Windows (workstation, member server, domain controller)
Tier, host type
Recommended
Techniques
0
Rules depending on it
none

Why this tier

Microsoft Appendix L High

By role

RoleTierBasis
Windows workstationRecommendedMicrosoft Appendix L High
Windows member serverRecommendedMicrosoft Appendix L High
Windows domain controllerRecommendedMicrosoft Appendix L High
Windows web server (IIS), internet-facingRecommendedMicrosoft Appendix L High

Techniques it helps detect

No ATT&CK analytic names this event. Its standing comes from the standards and rules below.

Rules that depend on it

No vendor rule names this event or source directly.

Standards and guidance naming it

RequirementRelationBasis
Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices)Names this eventpotential criticality High: A security setting was updated on the OCSP Responder Service.

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.