win:application
Windows Application event log
Channel: Application
- Host type
- Windows (workstation, member server, domain controller)
- Cost class
- Included
- Techniques
- 22
- Rules listed
- 41
- Events
- 34
Licensing
- License or service
- Windows OS
- What is free
- Always on
- What costs
- Nothing
- Notes
- Built-in channels
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Techniques
- T1027.005 Indicator Removal from Tools
- T1027.011 Fileless Storage
- T1072 Software Deployment Tools
- T1114 Email Collection
- T1133 External Remote Services
- T1137 Office Application Startup
- T1137.003 Outlook Forms
- T1137.004 Outlook Home Page
- T1137.005 Outlook Rules
- T1137.006 Add-ins
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1491 Defacement
- T1499 Endpoint Denial of Service
- T1499.002 Service Exhaustion Flood
- T1499.003 Application Exhaustion Flood
- T1499.004 Application or System Exploitation
- T1505 Server Software Component
- T1505.001 SQL Stored Procedures
- T1505.002 Transport Agent
- T1547.010 Port Monitors
Rules
Splunk 7
- Windows Event Triggered Image File Execution Options Injection
- Windows IIS Components Module Failed to Load
- Windows SQL Server Configuration Option Hunt
- Windows SQL Server Critical Procedures Enabled
- Windows SQL Server Extended Procedure DLL Loading Hunt
- Windows SQL Server Startup Procedure
- Windows SQL Server xp_cmdshell Config Change
Sigma 32
- Application Uninstalled by frack113
- Atera Agent Installation by Bhabesh Raj
- Audit CVE Event by Florian Roth (Nextron Systems), Zach Mathis
- Backup Catalog Deleted by Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)
- CVE-2020-0688 Exploitation via Eventlog by Florian Roth (Nextron Systems), wagga
- CVE-2023-40477 Potential Exploitation - WinRAR Application Crash by Nasreddine Bencherchali (Nextron Systems)
- CVE-2024-49113 Exploitation Attempt - LDAP Nightmare by Samuel Monsempes
- Dump Ntds.dit To Suspicious Location by Nasreddine Bencherchali (Nextron Systems)
- Exploitation Activity of CVE-2025-59287 - WSUS Deserialization by Swachchhanda Shrawan Poudel (Nextron Systems)
- LPE InstallerFileTakeOver PoC CVE-2021-41379 by Florian Roth (Nextron Systems)
- LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089 by Swachchhanda Shrawan Poudel (Nextron Systems)
- LSASS Process Crashed - Application by Nasreddine Bencherchali (Nextron Systems)
- MSI Installation From Suspicious Locations by Nasreddine Bencherchali (Nextron Systems)
- MSI Installation From Web by Stamatis Chatzimangou
- MSMQ Corrupted Packet Encountered by Nasreddine Bencherchali (Nextron Systems)
- MSSQL Add Account To Sysadmin Role by Nasreddine Bencherchali (Nextron Systems)
- MSSQL Destructive Query by Daniel Degasperi '@d4ns4n_'
- MSSQL Disable Audit Settings by Nasreddine Bencherchali (Nextron Systems)
- MSSQL Extended Stored Procedure Backdoor Maggie by Denis Szadkowski, DIRT / DCSO CyTec
- MSSQL SPProcoption Set by Nasreddine Bencherchali (Nextron Systems)
- MSSQL Server Failed Logon by Nasreddine Bencherchali (Nextron Systems), j4son
- MSSQL Server Failed Logon From External Network by j4son
- MSSQL XPCmdshell Option Change by Nasreddine Bencherchali (Nextron Systems)
- MSSQL XPCmdshell Suspicious Execution by Nasreddine Bencherchali (Nextron Systems)
- Microsoft Malware Protection Engine Crash by Florian Roth (Nextron Systems)
- Microsoft Malware Protection Engine Crash - WER by Florian Roth (Nextron Systems)
- Ntdsutil Abuse by Nasreddine Bencherchali (Nextron Systems)
- Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE by Cybex
- Relevant Anti-Virus Signature Keywords In Application Log by Florian Roth (Nextron Systems), Arnim Rupp
- Remote Access Tool - ScreenConnect Command Execution by Ali Alwashali
- Remote Access Tool - ScreenConnect File Transfer by Ali Alwashali
- Restricted Software Access By SRP by frack113
Events
Minimum (1)
- 1000App Crash