USB ACTIVITY AUDIT POLICY PASSWORD

LP_Windows Multiple Password Changed by User.LP_Windows Suspicious Creation of User Accounts.LP_Windows Group Policy Object Deletion.LP_Windows Failed Login Attempt using Locked Out Account.LP_Windows Member Added or Removed from Group by Admin.

LP_Windows GPO Linked Unlinked for the Domain.

LP_Windows Multiple Account Password Changes by User.

LP_Windows Permission Change on Home Folder.

LP_Windows User Account Created or Removed.

LP_Windows Possible Successful PtH Lateral Movement followed by Audit Log Clear.

LP_Windows Failed Login Attempt Using Service Account.

LP_Windows Possible Failed Lateral Movement using Pass the Hash.

LP_Windows CryptoAPI Spoofing Vulnerability Detected.

LP_Windows Excessive Amount of Files Copied to Removable Device.

LP_Windows Multiple Failed Attempts against a Single Account.

LP_Windows Data Copied to Removable Device.

LP_Windows Delegation of Control Change in Domain.

LP_Windows User Account Change to End with Dollar Sign.

LP_Windows Account Creation followed by Group Add.

LP_Windows Group Policy Object WMI Filter Changed.

LP_Windows unBlock Inheritance on Domain.

LP_Windows Possible Ransomware Detection.

LP_Windows Failed Interactive User Logins Detected.

LP_Windows User Removed from Domain Enterprise Admin.

LP_Windows Permission Change on Critical Folder.

LP_Windows Successful Brute Force Attack from Same Source.

LP_Windows Revocation of User Privileges Detected.

LP_Windows User Added to Domain Enterprise Admin.

LP_Windows Authentication Policy Change.

LP_Windows Failed Login Attempts using Disabled Account.

LP_Windows Block Inheritance on OU and Domain.

LP_Windows unBlock Inheritance on OU and Domain.

LP_Windows Successful Remote Interactive Login.

USB ACTIVITY AUDIT POLICY WINDOWS

LP_Windows Authentication on Windows DC.

LP_Windows Removable Storage Disconnected.

LP_Windows Kerberos Service Ticket Request.

LP_Windows Security ACL on File Modified.

LP_Windows Failed Login Followed by Lockout Event.

LP_Windows Critical File Access followed by Cloud App Usage.

LP_Windows User Account was Created with a Dollar Sign.

LP_Windows User Added or Remove from Group.

LP_Windows Kerberos Pre-authentication failed.LP_Windows User Removed from Administrator Group.LP_Windows Registry Key Permission Change.

LP_Windows Failed Login Attempt using an Expired Account.

LP_Windows Successful Brute Force Attack from Same User.

LP_Windows Delegation of Authority Change in OU.

LP_Windows User Added to Administrator Group.

LP_Windows Possible Successful Lateral Movement using Pass the Hash.

LP_Windows Unusual User Access to an Object.

LP_Windows Group Policy Object Creation.

Usb activity audit policy