Application crashes or exceptions are often clues to malicious activity on a system. The Application log contains this data. Especially interesting categories of crashes or unexpected operation include those found in Dr. Watson, MsiInstaller, Volume Shadow Service (VSS), Windows Error Reporting (WER), and the Enhanced Mitigation Experience (EMET). System crashes and applications hanging commonly occur when unauthorized or malicious software runs on a system. The event IDs listed below in the Application log are ones currently being examined by Helix Enterprise rules.
Number of occurrences in rules | Eventid | Event source or category |
|---|---|---|
5 | 11707 | MsiInstaller |
1 | 4097 | DrWatson |
1 | 2 | EMET |
1 | 1 | EMET |
1 | 1033 | MsiInstaller |
1 | 8194 | VSS |
1 | 1001 | Windows Error Reporting |