WinEvtLog: Security: AUDIT_FAILURE(4673): Microsoft-Windows-Security-Auditing: (no user) in oSSEC logs

[namobud...@gmail.com]

I was wondering what the event:

WinEvtLog: Security: AUDIT_FAILURE(4673): Microsoft-Windows-Security-Auditing: (no user)

means. In the past it was determined to be a non-attack event in my environment, but I wondering what it means.

[Rodrigo Montoro(Sp0oKeR)]

Not sure about no user but probably that's why it alerted as FAILURE, but here good details about this eventid (and others) https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4673

Other informations were provided with alert ?

Regards,

--

---
You received this message because you are subscribed to the Google Groups "ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Rodrigo Montoro (Sp0oKeR)
http://spookerlabs.blogspot.com
http://www.twitter.com/spookerlabs
http://www.linkedin.com/in/spooker