Windows System event log

License or service

Windows OS

What is free

Always on

What costs

Nothing

Notes

Built-in channels

Vendor page

https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection

As read on

2026-11-01

A vendor statement as read on the date shown; the cost class is the durable part.

• T1011 Exfiltration Over Other Network Medium
• T1011.001 Exfiltration Over Bluetooth
• T1014 Rootkit
• T1025 Data from Removable Media
• T1029 Scheduled Transfer
• T1036 Masquerading
• T1036.004 Masquerade Task or Service
• T1037.001 Logon Script (Windows)
• T1037.003 Network Logon Script
• T1040 Network Sniffing
• T1052 Exfiltration Over Physical Medium
• T1052.001 Exfiltration over USB
• T1056.001 Keylogging
• T1091 Replication Through Removable Media
• T1092 Communication Through Removable Media
• T1195.003 Compromise Hardware Supply Chain
• T1197 BITS Jobs
• T1200 Hardware Additions
• T1205.002 Socket Filters
• T1210 Exploitation of Remote Services
• T1219 Remote Access Tools
• T1219.003 Remote Access Hardware
• T1489 Service Stop
• T1490 Inhibit System Recovery
• T1499 Endpoint Denial of Service
• T1499.004 Application or System Exploitation
• T1505.004 IIS Components
• T1556.001 Domain Controller Authentication
• T1557.003 DHCP Spoofing
• T1563.002 RDP Hijacking
• T1564.006 Run Virtual Instance
• T1574.010 Services File Permissions Weakness
• T1574.011 Services Registry Permissions Weakness
• T1674 Input Injection
• T1685 Disable or Modify Tools
• T1685.001 Disable or Modify Windows Event Log
• T1685.003 Modify or Spoof Tool UI
• T1686.003 Windows Host Firewall
• T1687 Exploitation for Defense Impairment