{"id":7948,"date":"2026-07-29T14:04:17","date_gmt":"2026-07-29T12:04:17","guid":{"rendered":"https:\/\/logmanager.com\/?page_id=7948"},"modified":"2026-07-29T15:25:07","modified_gmt":"2026-07-29T13:25:07","slug":"windows-event-id-vyhledavac","status":"publish","type":"page","link":"https:\/\/logmanager.com\/cs\/windows-event-id-vyhledavac\/","title":{"rendered":"Windows Event ID Vyhled\u00e1va\u010d"},"content":{"rendered":"\n<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<style>\n:root{--lm-accent:rgb(15,15,215);--lm-bg:#f5f5f5;--lm-text:#041c35;--lm-muted:#6b7280;--lm-line:#e5e7eb;--lm-info:#0f0fd7;--lm-warn:#b45309;--lm-crit:#b91c1c}\n*{box-sizing:border-box}.lm-estimator{font-family:Inter,system-ui,-apple-system,BlinkMacSystemFont,\"Segoe UI\",sans-serif;padding:64px 16px 80px;background:var(--lm-bg);color:var(--lm-text)}\n.lm-inner{max-width:1200px;margin:0 auto}.lm-header{text-align:center;margin-bottom:28px}.lm-eyebrow{font-size:.875rem;font-weight:700;text-transform:uppercase;color:var(--lm-accent);margin-bottom:8px}.lm-title{font-family:Sora,sans-serif;font-size:clamp(1.75rem,4vw,3rem);line-height:1.12;margin:0 0 16px}.lm-subtitle{max-width:820px;margin:0 auto;font-size:1.05rem;line-height:1.65}\n.lm-search-card{background:#fff;border-radius:28px;padding:22px 24px;box-shadow:0 18px 45px rgba(15,23,42,.08);margin-bottom:22px}\n.lm-search-row{display:flex;gap:12px;flex-wrap:wrap}\n.lm-search-input-wrap{flex:1 1 320px;position:relative}\n#lm-search{width:100%;border:1px solid var(--lm-line);border-radius:999px;padding:14px 18px;font-size:15px;outline:0}\n#lm-search:focus{border-color:var(--lm-accent);box-shadow:0 0 0 2px rgba(15,15,215,.12)}\n.lm-log-select{border:1px solid var(--lm-line);border-radius:999px;padding:14px 34px 14px 18px;font-size:14px;background:#fff url(\"data:image\/svg+xml;charset=UTF-8,%3Csvg xmlns='http:\/\/www.w3.org\/2000\/svg' viewBox='0 0 20 20'%3E%3Cpath fill='%236b7280' d='M5.5 7.5l4.5 4.5 4.5-4.5z'\/%3E%3C\/svg%3E\") no-repeat right 12px center;-webkit-appearance:none;appearance:none;cursor:pointer}\n.lm-chips{display:flex;flex-wrap:wrap;gap:8px;margin-top:14px}\n.lm-chip{border:1px solid var(--lm-line);background:#fff;border-radius:999px;padding:7px 14px;font-size:12.5px;font-weight:600;cursor:pointer;color:#3f4650}\n.lm-chip.is-active{background:var(--lm-accent);border-color:var(--lm-accent);color:#fff}\n.lm-meta-row{display:flex;justify-content:space-between;align-items:center;margin:18px 0 10px;flex-wrap:wrap;gap:10px}\n.lm-count{font-size:13px;color:var(--lm-muted)}\n.lm-btn{display:inline-flex;justify-content:center;align-items:center;border:0;border-radius:999px;padding:10px 18px;background:var(--lm-accent);color:#fff;font-weight:700;cursor:pointer;box-shadow:0 12px 30px rgba(15,15,215,.3);font-size:13px}\n.lm-btn:hover{transform:translateY(-1px)}\n.lm-results{display:flex;flex-direction:column;gap:12px}\n.lm-card{background:#fff;border-radius:22px;padding:20px 22px;box-shadow:0 10px 30px rgba(15,23,42,.06);display:grid;grid-template-columns:96px 1fr;gap:18px}\n.lm-id-col{display:flex;flex-direction:column;align-items:center;gap:8px}\n.lm-id{font-family:Sora,sans-serif;font-size:1.6rem;font-weight:800;color:var(--lm-accent)}\n.lm-sev{font-size:10.5px;font-weight:700;text-transform:uppercase;letter-spacing:.04em;padding:3px 9px;border-radius:999px}\n.lm-sev-info{background:rgba(15,15,215,.1);color:var(--lm-info)}\n.lm-sev-warn{background:rgba(180,83,9,.12);color:var(--lm-warn)}\n.lm-sev-crit{background:rgba(185,28,28,.12);color:var(--lm-crit)}\n.lm-body h4{margin:0 0 4px;font-size:1.02rem}\n.lm-tags{display:flex;gap:6px;flex-wrap:wrap;margin-bottom:8px}\n.lm-tag{font-size:11px;color:var(--lm-muted);background:#f9fafb;border:1px solid var(--lm-line);border-radius:999px;padding:2px 9px}\n.lm-desc{font-size:13.5px;line-height:1.6;margin:0 0 8px}\n.lm-risk-label{font-size:11px;font-weight:700;text-transform:uppercase;color:#9ca3af;margin:2px 0 4px}\n.lm-risk{font-size:13px;line-height:1.55;margin:0 0 8px;padding:9px 12px;border-radius:12px;background:rgba(15,15,215,.05);border:1px solid rgba(15,15,215,.1);color:#2b3648}\n.lm-causes{font-size:12.5px;line-height:1.55;color:#4b5563;margin:0;padding-left:18px}\n.lm-causes li{margin-bottom:2px}\n.lm-causes-label{font-size:11px;font-weight:700;text-transform:uppercase;color:#9ca3af;margin:8px 0 4px}\n.lm-footnote{max-width:900px;margin:26px auto 0;font-size:11px;color:#8a919d;line-height:1.6;text-align:center}\n@media(max-width:620px){.lm-estimator{padding:44px 12px 60px}.lm-search-card{padding:18px}.lm-card{grid-template-columns:1fr;text-align:left}.lm-id-col{flex-direction:row;justify-content:flex-start}}\n<\/style>\n\n\n<section class=\"lm-estimator\" id=\"lm-eventid-lookup\">\n<div class=\"lm-inner\">\n<header class=\"lm-header\"><div class=\"lm-eyebrow\">Vyhled\u00e1v\u00e1n\u00ed Event ID Windows<\/div><h1 class=\"lm-title\">N\u00e1stroj pro vyhled\u00e1v\u00e1n\u00ed Windows Event ID<\/h1><p class=\"lm-subtitle\">Vyhledejte Event ID z log\u016f Security, System, Application, Active Directory, DNS\/DHCP serveru, Sysmonu a PowerShellu podle \u010d\u00edsla nebo kl\u00ed\u010dov\u00e9ho slova. Z\u00edsk\u00e1te srozumiteln\u00e9 vysv\u011btlen\u00ed, pro\u010d na dan\u00e9 ud\u00e1losti z\u00e1le\u017e\u00ed z pohledu monitoringu, a co ji obvykle zp\u016fsobuje.<\/p><p class=\"lm-subtitle\" style=\"margin-top:8px;font-size:.85rem;color:var(--lm-muted)\">Windows loguje tis\u00edce r\u016fzn\u00fdch Event ID nap\u0159\u00ed\u010d mnoha komponentami. Toto nen\u00ed \u00fapln\u00fd katalog. Jde o vybranou referen\u010dn\u00ed sadu ID, kter\u00e1 se nej\u010dast\u011bji vyhled\u00e1vaj\u00ed a vyu\u017e\u00edvaj\u00ed p\u0159i bezpe\u010dnostn\u00edm a IT monitoringu.<\/p><\/header>\n\n<div class=\"lm-search-card\">\n<div class=\"lm-search-row\">\n<div class=\"lm-search-input-wrap\"><input id=\"lm-search\" type=\"text\" placeholder=\"Hledejte podle Event ID nebo kl\u00ed\u010dov\u00e9ho slova, nap\u0159. 4625, p\u0159ihl\u00e1\u0161en\u00ed, p\u00e1d slu\u017eby, firewall\u2026\" autocomplete=\"off\"><\/div>\n<select id=\"lm-log-filter\" class=\"lm-log-select\">\n<option value=\"all\">V\u0161echny logy<\/option>\n<option value=\"Security\">Log Security<\/option>\n<option value=\"System\">Log System<\/option>\n<option value=\"Application\">Log Application<\/option>\n<option value=\"PowerShell\">PowerShell logy<\/option>\n<option value=\"Sysmon\">Sysmon<\/option>\n<option value=\"DNS Server\">DNS server<\/option>\n<option value=\"DHCP Server\">DHCP server<\/option>\n<\/select>\n<\/div>\n<div class=\"lm-chips\" id=\"lm-chips\"><\/div>\n<\/div>\n\n<div class=\"lm-meta-row\">\n<div class=\"lm-count\" id=\"lm-count\"><\/div>\n<\/div>\n\n<div class=\"lm-results\" id=\"lm-results\"><\/div>\n\n<p class=\"lm-footnote\">Popisy, hodnocen\u00ed z\u00e1va\u017enosti a bezpe\u010dnostn\u00ed v\u00fdznam na t\u00e9to str\u00e1nce jsou p\u016fvodn\u00ed shrnut\u00ed napsan\u00e1 pro rychlou orientaci, nikoli reprodukce ofici\u00e1ln\u00ed dokumentace Microsoftu. Pokr\u00fdvaj\u00ed b\u011b\u017en\u011b se vyskytuj\u00edc\u00ed ID z log\u016f Security, System a Application ve Windows Server a Windows 10\/11, ud\u00e1losti d\u016fv\u011bryhodn\u00fdch vztah\u016f a Active Directory, auditn\u00ed logov\u00e1n\u00ed DNS a DHCP serveru, Sysmon a PowerShell logov\u00e1n\u00ed \u2013 nikoli \u00fapln\u011b v\u0161echna Event ID, kter\u00e1 tyto komponenty mohou kdy vygenerovat. Polo\u017eky DHCP serveru odkazuj\u00ed na k\u00f3dy auditn\u00edho logu zapisovan\u00e9 do jeho vlastn\u00edho CSV souboru, nikoli na standardn\u00ed ID Event Vieweru. P\u0159esn\u00e1 ID, pole a chov\u00e1n\u00ed se mohou li\u0161it podle verze syst\u00e9mu, z\u00e1sad auditu a verze poskytovatele. Pro autoritativn\u00ed podrobnosti k jednotliv\u00fdm pol\u00edm se pod\u00edvejte na ofici\u00e1ln\u00ed dokumentaci Windows Security od Microsoftu.<\/p>\n<\/div>\n<\/section>\n<script>\n(function(){\n'use strict';\n\/\/ Ka\u017ed\u00e1 polo\u017eka: [id, log, kategorie, n\u00e1zev, popis, z\u00e1va\u017enost('info'|'warn'|'crit'), p\u0159\u00ed\u010diny[], bezpe\u010dnostn\u00ed_v\u00fdznam]\nconst DATA=[\n[4624,\"Security\",\"P\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed\",\"\u00da\u010det se \u00fasp\u011b\u0161n\u011b p\u0159ihl\u00e1sil\",\"Zaznamen\u00e1v\u00e1 se poka\u017ed\u00e9, kdy\u017e se libovoln\u00fd \u00fa\u010det \u2013 u\u017eivatelsk\u00fd i syst\u00e9mov\u00fd \u2013 \u00fasp\u011b\u0161n\u011b p\u0159ihl\u00e1s\u00ed. Kl\u00ed\u010dov\u00e9 je pole Typ p\u0159ihl\u00e1\u0161en\u00ed: 2 znamen\u00e1 interaktivn\u00ed p\u0159ihl\u00e1\u0161en\u00ed u konzole, 3 s\u00ed\u0165ov\u00e9 p\u0159ihl\u00e1\u0161en\u00ed (nap\u0159. SMB), 4 d\u00e1vkov\u00e9, 5 p\u0159ihl\u00e1\u0161en\u00ed slu\u017eby, 7 odem\u010den\u00ed, 10 vzd\u00e1len\u00e9 interaktivn\u00ed (RDP) a 11 p\u0159ihl\u00e1\u0161en\u00ed pomoc\u00ed ulo\u017een\u00fdch (cached) p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f.\",\"info\",[\"B\u011b\u017en\u00e1 denn\u00ed aktivita u\u017eivatel\u016f a slu\u017eeb\",\"Vzd\u00e1len\u00e9 p\u0159ihl\u00e1\u0161en\u00ed p\u0159es RDP nebo vzd\u00e1len\u00e1 spr\u00e1va (typ 10)\",\"Spou\u0161t\u011bn\u00ed napl\u00e1novan\u00fdch \u00faloh nebo slu\u017eeb (typ 4\/5)\"],\"Samo o sob\u011b jde o b\u011b\u017en\u00fd \u0161um, ale typ p\u0159ihl\u00e1\u0161en\u00ed v kombinaci se zdrojovou IP adresou a \u010dasem je kl\u00ed\u010dov\u00fd pro odhalen\u00ed podez\u0159el\u00e9ho p\u0159\u00edstupu \u2013 nap\u0159\u00edklad p\u0159ihl\u00e1\u0161en\u00ed typu 10 (RDP) z nezn\u00e1m\u00e9 extern\u00ed adresy, nebo servisn\u00ed \u00fa\u010det, kter\u00fd se najednou p\u0159ihl\u00e1s\u00ed interaktivn\u011b.\"],\n[4625,\"Security\",\"P\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed\",\"\u00da\u010det se nepoda\u0159ilo p\u0159ihl\u00e1sit\",\"Zaznamen\u00e1v\u00e1 se p\u0159i ka\u017ed\u00e9m odm\u00edtnut\u00e9m pokusu o p\u0159ihl\u00e1\u0161en\u00ed. K\u00f3dy Status\/Sub Status vysv\u011btluj\u00ed d\u016fvod (\u0161patn\u00e9 heslo, zak\u00e1zan\u00fd \u00fa\u010det, vypr\u0161el\u00e9 heslo, omezen\u00ed p\u0159ihla\u0161ovac\u00edch hodin apod.). Vysok\u00fd po\u010det t\u011bchto ud\u00e1lost\u00ed z jednoho zdroje je typick\u00fdm projevem \u00fatoku hrubou silou nebo password spraying.\",\"warn\",[\"P\u0159eklep v p\u0159ihla\u0161ovac\u00edch \u00fadaj\u00edch\",\"\u00datok hrubou silou nebo password spraying\",\"Zak\u00e1zan\u00fd, uzam\u010den\u00fd nebo vypr\u0161el\u00fd \u00fa\u010det\"],\"Velk\u00e9 mno\u017estv\u00ed ud\u00e1lost\u00ed 4625 proti jednomu nebo v\u00edce \u00fa\u010dt\u016fm je hlavn\u00edm sign\u00e1lem \u00fatoku hrubou silou nebo password spraying; rozpt\u00fdlen\u00e1 selh\u00e1n\u00ed nap\u0159\u00ed\u010d mnoha \u00fa\u010dty s m\u00e1lo pokusy na ka\u017ed\u00fd z nich je typick\u00fd vzorec spraying \u00fatoku, kter\u00fd obch\u00e1z\u00ed jednoduch\u00e9 z\u00e1mky na z\u00e1klad\u011b po\u010dtu pokus\u016f.\"],\n[4634,\"Security\",\"P\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed\",\"\u00da\u010det byl odhl\u00e1\u0161en\",\"Ozna\u010duje konec relace p\u0159ihl\u00e1\u0161en\u00ed; ve spojen\u00ed s odpov\u00eddaj\u00edc\u00ed ud\u00e1lost\u00ed 4624 lze spo\u010d\u00edtat d\u00e9lku trv\u00e1n\u00ed relace.\",\"info\",[\"B\u011b\u017en\u00e9 ukon\u010den\u00ed relace\",\"Odhl\u00e1\u0161en\u00ed u\u017eivatele nebo dokon\u010den\u00ed napl\u00e1novan\u00e9 \u00falohy\"],\"N\u00edzk\u00fd bezpe\u010dnostn\u00ed v\u00fdznam samo o sob\u011b; hlavn\u011b u\u017eite\u010dn\u00e9 pro sestaven\u00ed \u010dasov\u00e9 osy relac\u00ed spolu s ud\u00e1lostmi 4624 a 4648.\"],\n[4647,\"Security\",\"P\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed\",\"U\u017eivatel se s\u00e1m odhl\u00e1sil\",\"Zaznamen\u00e1v\u00e1 se, kdy\u017e se u\u017eivatel v\u00fdslovn\u011b odhl\u00e1s\u00ed, na rozd\u00edl od situace, kdy relace jednodu\u0161e vypr\u0161\u00ed nebo je ukon\u010dena.\",\"info\",[\"B\u011b\u017en\u00e9 odhl\u00e1\u0161en\u00ed u\u017eivatele\"],\"N\u00edzk\u00fd bezpe\u010dnostn\u00ed v\u00fdznam samo o sob\u011b; pom\u00e1h\u00e1 odli\u0161it z\u00e1m\u011brn\u00e9 odhl\u00e1\u0161en\u00ed od relace, kter\u00e1 byla ukon\u010dena n\u00e1siln\u011b nebo vypr\u0161ela.\"],\n[4648,\"Security\",\"P\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed\",\"P\u0159ihl\u00e1\u0161en\u00ed pomoc\u00ed explicitn\u011b zadan\u00fdch p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f\",\"Spou\u0161t\u00ed se, kdy\u017e proces pou\u017eije jin\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje, ne\u017e pod kter\u00fdmi s\u00e1m b\u011b\u017e\u00ed \u2013 typicky RunAs, napl\u00e1novan\u00e1 \u00faloha s ulo\u017een\u00fdmi \u00fadaji, nebo n\u00e1stroje pou\u017e\u00edvan\u00e9 p\u0159i later\u00e1ln\u00edm pohybu \u00fato\u010dn\u00edka. \u010casto jde o jeden z prvn\u00edch indik\u00e1tor\u016f opakovan\u00e9ho pou\u017eit\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f na v\u00edce stroj\u00edch.\",\"warn\",[\"Legitimn\u00ed pou\u017eit\u00ed RunAs \/ administr\u00e1torsk\u00e1 \u010dinnost\",\"Napl\u00e1novan\u00e9 \u00falohy s ulo\u017een\u00fdmi p\u0159ihla\u0161ovac\u00edmi \u00fadaji\",\"Later\u00e1ln\u00ed pohyb pomoc\u00ed odcizen\u00fdch p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f\"],\"Jeden z nejjasn\u011bj\u0161\u00edch indik\u00e1tor\u016f later\u00e1ln\u00edho pohybu v cel\u00e9m logu \u2013 \u00fato\u010dn\u00edci b\u011b\u017en\u011b pou\u017e\u00edvaj\u00ed odcizen\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje pomoc\u00ed n\u00e1stroj\u016f jako PsExec nebo WMI, aby se k dal\u0161\u00edm stroj\u016fm p\u0159ihl\u00e1sili pod jin\u00fdm \u00fa\u010dtem, ne\u017e pod kter\u00fdm jsou aktu\u00e1ln\u011b p\u0159ihl\u00e1\u0161eni.\"],\n[4672,\"Security\",\"P\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed\",\"Nov\u00e9 p\u0159ihl\u00e1\u0161en\u00ed z\u00edskalo speci\u00e1ln\u00ed opr\u00e1vn\u011bn\u00ed\",\"Znamen\u00e1, \u017ee relace p\u0159ihl\u00e1\u0161en\u00ed z\u00edskala administr\u00e1torsk\u00e1 nebo syst\u00e9mov\u00e1 opr\u00e1vn\u011bn\u00ed (nap\u0159. SeDebugPrivilege). Spolehliv\u00fd ukazatel privilegovan\u00fdch relac\u00ed, kter\u00fd stoj\u00ed za to d\u00e1t do souvislosti s t\u00edm, co dan\u00e1 relace d\u011blala d\u00e1l.\",\"warn\",[\"Legitimn\u00ed p\u0159ihl\u00e1\u0161en\u00ed administr\u00e1tora\",\"Eskalace opr\u00e1vn\u011bn\u00ed po kompromitaci \u00fa\u010dtu\"],\"Ozna\u010duje ka\u017edou relaci, kter\u00e1 m\u00e1 administr\u00e1torsk\u00e1 nebo syst\u00e9mov\u00e1 opr\u00e1vn\u011bn\u00ed; neo\u010dek\u00e1van\u00e9 ud\u00e1losti 4672 u \u00fa\u010dt\u016f, kter\u00e9 by privilegovan\u00e9 b\u00fdt nem\u011bly, jsou siln\u00fdm indik\u00e1torem eskalace opr\u00e1vn\u011bn\u00ed nebo zneu\u017eit\u00ed tokenu.\"],\n[4778,\"Security\",\"P\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed\",\"Relace byla znovu p\u0159ipojena ke stanici Windows\",\"Typicky jde o obnoven\u00ed RDP relace po p\u0159eru\u0161en\u00ed spojen\u00ed, nikoli o nov\u00e9 p\u0159ihl\u00e1\u0161en\u00ed.\",\"info\",[\"B\u011b\u017en\u00e9 znovup\u0159ipojen\u00ed RDP\",\"P\u0159evzet\u00ed relace, pokud zdroj znovup\u0159ipojen\u00ed neodpov\u00edd\u00e1 o\u010dek\u00e1v\u00e1n\u00ed\"],\"Stoj\u00ed za to porovnat zdroj znovup\u0159ipojen\u00ed s p\u016fvodn\u00ed relac\u00ed \u2013 RDP relace, kter\u00e1 se znovu p\u0159ipoj\u00ed z jin\u00e9ho, neo\u010dek\u00e1van\u00e9ho m\u00edsta, m\u016f\u017ee znamenat p\u0159evzet\u00ed relace \u00fato\u010dn\u00edkem.\"],\n[4779,\"Security\",\"P\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed\",\"Relace byla odpojena od stanice Windows\",\"Typicky p\u0159echod RDP relace do odpojen\u00e9ho, ale st\u00e1le b\u011b\u017e\u00edc\u00edho stavu.\",\"info\",[\"B\u011b\u017en\u00e9 odpojen\u00ed RDP (u\u017eivatel zav\u0159el klienta bez odhl\u00e1\u0161en\u00ed)\"],\"N\u00edzk\u00fd sign\u00e1l s\u00e1m o sob\u011b; u\u017eite\u010dn\u00fd kontext pro \u010dasovou osu RDP relac\u00ed.\"],\n[4800,\"Security\",\"P\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed\",\"Pracovn\u00ed stanice byla uzam\u010dena\",\"Relace byla uzam\u010dena, bu\u010f u\u017eivatelem, nebo z\u00e1sadou (\u010dasov\u00fd limit uzam\u010den\u00ed obrazovky).\",\"info\",[\"U\u017eivatel uzamkl svou relaci\",\"Z\u00e1sada \u010dasov\u00e9ho limitu ne\u010dinnosti\"],\"N\u00edzk\u00fd bezpe\u010dnostn\u00ed v\u00fdznam; slou\u017e\u00ed hlavn\u011b k sestaven\u00ed \u010dasov\u00e9 osy p\u0159\u00edtomnosti u\u017eivatele.\"],\n[4801,\"Security\",\"P\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed\",\"Pracovn\u00ed stanice byla odem\u010dena\",\"Relace byla odem\u010dena pot\u00e9, co byla uzam\u010dena.\",\"info\",[\"U\u017eivatel se vr\u00e1til a odemkl svou relaci\"],\"N\u00edzk\u00fd bezpe\u010dnostn\u00ed v\u00fdznam; m\u016f\u017ee pomoci potvrdit, zda byl v dan\u00fd okam\u017eik aktivn\u00ed fyzick\u00fd u\u017eivatel, nebo sp\u00ed\u0161e vzd\u00e1len\u00e1 relace.\"],\n[4802,\"Security\",\"P\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed\",\"Byl spu\u0161t\u011bn spo\u0159i\u010d obrazovky\",\"Spo\u0159i\u010d obrazovky se aktivoval po vypr\u0161en\u00ed \u010dasov\u00e9ho limitu ne\u010dinnosti.\",\"info\",[\"Dosa\u017een\u00ed \u010dasov\u00e9ho limitu ne\u010dinnosti\"],\"N\u00edzk\u00fd bezpe\u010dnostn\u00ed v\u00fdznam; drobn\u00fd podp\u016frn\u00fd sign\u00e1l pro anal\u00fdzu doby ne\u010dinnosti.\"],\n[4803,\"Security\",\"P\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed\",\"Spo\u0159i\u010d obrazovky byl ukon\u010den\",\"U\u017eivatel se vr\u00e1til a ukon\u010dil spo\u0159i\u010d obrazovky.\",\"info\",[\"Obnoven\u00ed aktivity u\u017eivatele\"],\"N\u00edzk\u00fd bezpe\u010dnostn\u00ed v\u00fdznam; podp\u016frn\u00fd sign\u00e1l pro \u010dasovou osu p\u0159\u00edtomnosti u\u017eivatele.\"],\n[4964,\"Security\",\"P\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed\",\"Nov\u00e9mu p\u0159ihl\u00e1\u0161en\u00ed byly p\u0159i\u0159azeny speci\u00e1ln\u00ed skupiny\",\"Zaznamen\u00e1v\u00e1 se, kdy\u017e \u010dlenstv\u00ed p\u0159ihl\u00e1\u0161en\u00e9ho \u00fa\u010dtu ve skupin\u00e1ch odpov\u00edd\u00e1 definovan\u00e9mu seznamu 'speci\u00e1ln\u00edch skupin' pou\u017eit\u00e9mu pro zv\u00fd\u0161en\u00fd audit (b\u011b\u017en\u011b se pou\u017e\u00edv\u00e1 k ozna\u010den\u00ed p\u0159ihl\u00e1\u0161en\u00ed s administr\u00e1torsk\u00fdmi pr\u00e1vy).\",\"warn\",[\"P\u0159ihl\u00e1\u0161en\u00ed \u00fa\u010dtu, kter\u00fd je \u010dlenem sledovan\u00e9 privilegovan\u00e9 skupiny\"],\"P\u0159\u00edmo ur\u010deno pro bezpe\u010dnostn\u00ed monitoring \u2013 nastavte si do seznamu 'speci\u00e1ln\u00edch skupin' va\u0161e privilegovan\u00e9 skupiny (Domain Admins, Enterprise Admins apod.), aby se ka\u017ed\u00e9 p\u0159ihl\u00e1\u0161en\u00ed jejich \u010dlena automaticky ozna\u010dilo.\"],\n[4720,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Byl vytvo\u0159en u\u017eivatelsk\u00fd \u00fa\u010det\",\"Byl vytvo\u0159en nov\u00fd lok\u00e1ln\u00ed nebo dom\u00e9nov\u00fd u\u017eivatelsk\u00fd \u00fa\u010det \u2013 v\u017edy stoj\u00ed za to ov\u011b\u0159it, \u017ee \u0161lo o o\u010dek\u00e1vanou akci, zejm\u00e9na mimo standardn\u00ed okno zm\u011bn.\",\"warn\",[\"Legitimn\u00ed onboarding \/ zakl\u00e1d\u00e1n\u00ed \u00fa\u010dt\u016f\",\"Podvr\u017een\u00fd nebo zadn\u00ed \u00fa\u010det vytvo\u0159en\u00fd po kompromitaci\"],\"\u00dato\u010dn\u00edci, kte\u0159\u00ed z\u00edskaj\u00ed administr\u00e1torsk\u00fd p\u0159\u00edstup, si \u010dasto vytvo\u0159\u00ed nov\u00fd \u00fa\u010det jako zadn\u00ed vr\u00e1tka, kter\u00e1 p\u0159e\u017eij\u00ed reset hesla u kompromitovan\u00e9ho \u00fa\u010dtu; jak\u00e1koli ud\u00e1lost 4720 mimo zn\u00e1m\u00fd proces onboardingu zaslou\u017e\u00ed prov\u011b\u0159en\u00ed.\"],\n[4722,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"U\u017eivatelsk\u00fd \u00fa\u010det byl povolen\",\"D\u0159\u00edve zak\u00e1zan\u00fd \u00fa\u010det byl znovu povolen.\",\"warn\",[\"Legitimn\u00ed reaktivace\",\"Reaktivace neaktivn\u00edho nebo kompromitovan\u00e9ho \u00fa\u010dtu\"],\"Op\u011btovn\u00e9 povolen\u00ed neaktivn\u00edho nebo d\u0159\u00edve zak\u00e1zan\u00e9ho \u00fa\u010dtu je b\u011b\u017en\u00fd zp\u016fsob, jak znovu aktivovat sp\u00edc\u00ed zadn\u00ed vr\u00e1tka nebo \u00fa\u010det, u kter\u00e9ho se myslelo, \u017ee je ji\u017e zne\u0161kodn\u011bn.\"],\n[4723,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Pokus o zm\u011bnu vlastn\u00edho hesla\",\"Pokus o samoobslu\u017enou zm\u011bnu hesla (detail o \u00fasp\u011bchu \u010di selh\u00e1n\u00ed je sou\u010d\u00e1st\u00ed ud\u00e1losti).\",\"info\",[\"B\u011b\u017en\u00e1 rotace hesla\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; n\u00e1r\u016fst t\u011bchto ud\u00e1lost\u00ed nap\u0159\u00ed\u010d mnoha \u00fa\u010dty v kr\u00e1tk\u00e9m \u010dasov\u00e9m okn\u011b m\u016f\u017ee znamenat kampa\u0148 typu credential stuffing nebo password spraying, kter\u00e1 se z\u00e1rove\u0148 pokou\u0161\u00ed o reset hesel.\"],\n[4724,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Pokus o reset hesla \u00fa\u010dtu\",\"N\u011bkdo jin\u00fd (administr\u00e1tor nebo helpdesk n\u00e1stroj) resetoval heslo \u00fa\u010dtu, m\u00edsto aby si ho u\u017eivatel zm\u011bnil s\u00e1m.\",\"warn\",[\"Legitimn\u00ed reset hesla p\u0159es helpdesk\",\"P\u0159\u00edprava na p\u0159evzet\u00ed \u00fa\u010dtu\"],\"Reset hesla proveden\u00fd n\u011bk\u00fdm jin\u00fdm ne\u017e vlastn\u00edkem \u00fa\u010dtu je kl\u00ed\u010dov\u00fd krok p\u0159i p\u0159eb\u00edr\u00e1n\u00ed \u00fa\u010dt\u016f (nap\u0159. reset p\u0159es soci\u00e1ln\u011b in\u017een\u00fdrsky zmanipulovan\u00fd helpdesk), tak\u017ee neo\u010dek\u00e1van\u00e9 ud\u00e1losti 4724 u privilegovan\u00fdch \u00fa\u010dt\u016f maj\u00ed vysokou prioritu k prov\u011b\u0159en\u00ed.\"],\n[4725,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"U\u017eivatelsk\u00fd \u00fa\u010det byl zak\u00e1z\u00e1n\",\"\u00da\u010det zak\u00e1zal administr\u00e1tor nebo automatizovan\u00fd proces.\",\"info\",[\"Offboarding zam\u011bstnance\",\"Bezpe\u010dnostn\u00ed reakce na podez\u0159elou kompromitaci\"],\"N\u00edzk\u00e9 a\u017e st\u0159edn\u00ed riziko samo o sob\u011b; vlna z\u00e1kaz\u016f mimo okno zm\u011bn m\u016f\u017ee znamenat destruktivn\u00ed nebo ru\u0161ivou akci po kompromitaci.\"],\n[4726,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"U\u017eivatelsk\u00fd \u00fa\u010det byl smaz\u00e1n\",\"\u00da\u010det byl trvale odstran\u011bn.\",\"warn\",[\"\u00daklid p\u0159i offboardingu\",\"\u00dato\u010dn\u00edk zahlazuje stopy po smaz\u00e1n\u00ed \u00fa\u010dtu, kter\u00fd s\u00e1m vytvo\u0159il\"],\"Smaz\u00e1n\u00ed \u00fa\u010dtu, kter\u00fd si vytvo\u0159il \u00fato\u010dn\u00edk, je b\u011b\u017en\u00fd zp\u016fsob, jak odstranit d\u016fkazy pot\u00e9, co si zajistil jinou formu perzistence; stoj\u00ed tak\u00e9 za to ov\u011b\u0159it, \u017ee \u0161lo o schv\u00e1lenou change \u017e\u00e1dost.\"],\n[4727,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Byla vytvo\u0159ena glob\u00e1ln\u00ed skupina zabezpe\u010den\u00ed\",\"Byla vytvo\u0159ena nov\u00e1 glob\u00e1ln\u00ed skupina dom\u00e9ny.\",\"info\",[\"B\u011b\u017en\u00e1 administrace AD\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; stoj\u00ed za prov\u011b\u0159en\u00ed, pokud nov\u00e1 skupina n\u00e1sledn\u011b z\u00edsk\u00e1 \u0161irok\u00e1 opr\u00e1vn\u011bn\u00ed.\"],\n[4728,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Do glob\u00e1ln\u00ed skupiny zabezpe\u010den\u00ed byl p\u0159id\u00e1n \u010dlen\",\"Zm\u011bna \u010dlenstv\u00ed v glob\u00e1ln\u00ed skupin\u011b \u2013 zvl\u00e1\u0161\u0165 prov\u011b\u0159te p\u0159id\u00e1n\u00ed do privilegovan\u00fdch skupin.\",\"warn\",[\"B\u011b\u017en\u00e9 p\u0159id\u011blen\u00ed p\u0159\u00edstupu\",\"Neopr\u00e1vn\u011bn\u00e1 eskalace opr\u00e1vn\u011bn\u00ed\"],\"P\u0159id\u00e1n\u00ed do skupin s dom\u00e9nov\u00fdm privilegovan\u00fdm opr\u00e1vn\u011bn\u00edm (nap\u0159. Domain Admins) pat\u0159\u00ed mezi nejcenn\u011bj\u0161\u00ed ud\u00e1losti k alertov\u00e1n\u00ed pro odhalen\u00ed eskalace opr\u00e1vn\u011bn\u00ed.\"],\n[4729,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"\u010clen byl odebr\u00e1n z glob\u00e1ln\u00ed skupiny zabezpe\u010den\u00ed\",\"\u010clenstv\u00ed v glob\u00e1ln\u00ed skupin\u011b bylo odebr\u00e1no.\",\"info\",[\"B\u011b\u017en\u00e9 odebr\u00e1n\u00ed p\u0159\u00edstupu\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; u\u017eite\u010dn\u00e9 pro potvrzen\u00ed legitimn\u00edho offboardingu.\"],\n[4730,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Glob\u00e1ln\u00ed skupina zabezpe\u010den\u00ed byla smaz\u00e1na\",\"Glob\u00e1ln\u00ed skupina byla z dom\u00e9ny odstran\u011bna.\",\"info\",[\"Pl\u00e1novan\u00fd \u00faklid v AD\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b, i kdy\u017e smaz\u00e1n\u00ed skupiny s bezpe\u010dnostn\u011b relevantn\u00edmi opr\u00e1vn\u011bn\u00edmi m\u016f\u017ee m\u00edt dopad na n\u00e1sledn\u00fd p\u0159\u00edstup, kter\u00fd stoj\u00ed za prov\u011b\u0159en\u00ed.\"],\n[4731,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Byla vytvo\u0159ena lok\u00e1ln\u00ed skupina zabezpe\u010den\u00ed\",\"Na \u010dlensk\u00e9m serveru nebo pracovn\u00ed stanici byla vytvo\u0159ena nov\u00e1 lok\u00e1ln\u00ed skupina.\",\"info\",[\"B\u011b\u017en\u00e1 lok\u00e1ln\u00ed administrace\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; prov\u011b\u0159te, pokud nov\u00e1 skupina z\u00edsk\u00e1 administr\u00e1torsk\u00e1 pr\u00e1va na dan\u00e9m stroji.\"],\n[4732,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Do lok\u00e1ln\u00ed skupiny zabezpe\u010den\u00ed byl p\u0159id\u00e1n \u010dlen\",\"Zm\u011bna \u010dlenstv\u00ed v lok\u00e1ln\u00ed skupin\u011b \u2013 p\u0159id\u00e1n\u00ed do lok\u00e1ln\u00ed skupiny Administrators je zvl\u00e1\u0161\u0165 vysoce sign\u00e1lov\u00e1 ud\u00e1lost.\",\"warn\",[\"Legitimn\u00ed ud\u011blen\u00ed lok\u00e1ln\u00edch administr\u00e1torsk\u00fdch pr\u00e1v\",\"Eskalace lok\u00e1ln\u00edch opr\u00e1vn\u011bn\u00ed na koncov\u00e9m za\u0159\u00edzen\u00ed\"],\"P\u0159id\u00e1n\u00ed do lok\u00e1ln\u00ed skupiny Administrators na jak\u00e9mkoli koncov\u00e9m za\u0159\u00edzen\u00ed je klasick\u00fd indik\u00e1tor lok\u00e1ln\u00ed eskalace opr\u00e1vn\u011bn\u00ed, obzvl\u00e1\u0161t\u011b pokud ho provede neadministr\u00e1torsk\u00fd \u00fa\u010det nebo pokud poch\u00e1z\u00ed ze vzd\u00e1len\u00e9 relace.\"],\n[4733,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"\u010clen byl odebr\u00e1n z lok\u00e1ln\u00ed skupiny zabezpe\u010den\u00ed\",\"\u010clenstv\u00ed v lok\u00e1ln\u00ed skupin\u011b bylo odebr\u00e1no.\",\"info\",[\"B\u011b\u017en\u00fd \u00faklid p\u0159\u00edstupov\u00fdch pr\u00e1v\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; u\u017eite\u010dn\u00e9 pro potvrzen\u00ed legitimn\u00edch zm\u011bn p\u0159\u00edstupu.\"],\n[4734,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Lok\u00e1ln\u00ed skupina zabezpe\u010den\u00ed byla smaz\u00e1na\",\"Lok\u00e1ln\u00ed skupina byla odstran\u011bna.\",\"info\",[\"Pl\u00e1novan\u00e1 lok\u00e1ln\u00ed administrace\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[4735,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Lok\u00e1ln\u00ed skupina zabezpe\u010den\u00ed byla zm\u011bn\u011bna\",\"Byly zm\u011bn\u011bny atributy lok\u00e1ln\u00ed skupiny (nikoli \u010dlenstv\u00ed).\",\"info\",[\"Administrativn\u00ed zm\u011bna nastaven\u00ed skupiny\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; prov\u011b\u0159te zm\u011bny u skupin s vy\u0161\u0161\u00edmi lok\u00e1ln\u00edmi opr\u00e1vn\u011bn\u00edmi.\"],\n[4737,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Glob\u00e1ln\u00ed skupina zabezpe\u010den\u00ed byla zm\u011bn\u011bna\",\"Byly zm\u011bn\u011bny atributy glob\u00e1ln\u00ed skupiny.\",\"info\",[\"Administrativn\u00ed zm\u011bna nastaven\u00ed skupiny\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; prov\u011b\u0159te zm\u011bny u skupin s dom\u00e9nov\u011b vy\u0161\u0161\u00edmi opr\u00e1vn\u011bn\u00edmi.\"],\n[4738,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"U\u017eivatelsk\u00fd \u00fa\u010det byl zm\u011bn\u011bn\",\"Pokr\u00fdv\u00e1 \u0161irokou \u0161k\u00e1lu zm\u011bn atribut\u016f \u2013 p\u0159\u00edznaky, datum expirace, povolen\u00e9 pracovn\u00ed stanice pro p\u0159ihl\u00e1\u0161en\u00ed apod. Pro kontext je t\u0159eba d\u00e1t do souvislosti se seznamem zm\u011bn\u011bn\u00fdch atribut\u016f v ud\u00e1losti.\",\"warn\",[\"B\u011b\u017en\u00e1 \u00fadr\u017eba \u00fa\u010dtu\",\"\u00dato\u010dn\u00edk oslabuje omezen\u00ed \u00fa\u010dtu (nap\u0159. vypnut\u00ed expirace hesla)\"],\"\u00dato\u010dn\u00edci ob\u010das m\u011bn\u00ed p\u0159\u00edznaky \u00fa\u010dtu, aby vypnuli expiraci hesla, odstranili omezen\u00ed p\u0159ihla\u0161ov\u00e1n\u00ed nebo vymazali p\u0159\u00edznak 'citliv\u00fd \u00fa\u010det' pro snaz\u0161\u00ed dlouhodob\u00e9 zneu\u017eit\u00ed \u2013 seznam zm\u011bn\u011bn\u00fdch atribut\u016f v ud\u00e1losti je proto d\u016fle\u017eit\u00e9 prov\u011b\u0159it.\"],\n[4740,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"U\u017eivatelsk\u00fd \u00fa\u010det byl uzam\u010den\",\"\u00da\u010det byl uzam\u010den po p\u0159ekro\u010den\u00ed prahu ne\u00fasp\u011b\u0161n\u00fdch p\u0159ihl\u00e1\u0161en\u00ed.\",\"warn\",[\"Legitimn\u00ed opakovan\u00fd p\u0159eklep hesla u\u017eivatelem\",\"\u00datok hrubou silou proti \u00fa\u010dtu\"],\"Vlna uzam\u010den\u00ed \u00fa\u010dt\u016f nap\u0159\u00ed\u010d prost\u0159ed\u00edm, zejm\u00e9na \u010dasov\u011b slad\u011bn\u00e1, \u010dasto znamen\u00e1 automatizovan\u00fd n\u00e1stroj hrub\u00e9 s\u00edly nebo password spraying testuj\u00edc\u00ed mnoho \u00fa\u010dt\u016f.\"],\n[4741,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Byl vytvo\u0159en \u00fa\u010det po\u010d\u00edta\u010de\",\"K dom\u00e9n\u011b se p\u0159ipojil nov\u00fd \u00fa\u010det za\u0159\u00edzen\u00ed.\",\"info\",[\"Legitimn\u00ed za\u0159azen\u00ed za\u0159\u00edzen\u00ed \/ p\u0159ipojen\u00ed k dom\u00e9n\u011b\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; neo\u010dek\u00e1van\u00e1 p\u0159ipojen\u00ed za\u0159\u00edzen\u00ed mimo change management mohou znamenat podvr\u017een\u00e1 za\u0159\u00edzen\u00ed p\u0159ipojovan\u00e1 k dom\u00e9n\u011b.\"],\n[4742,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"\u00da\u010det po\u010d\u00edta\u010de byl zm\u011bn\u011bn\",\"Byly upraveny atributy \u00fa\u010dtu za\u0159\u00edzen\u00ed.\",\"info\",[\"B\u011b\u017en\u00e1 spr\u00e1va za\u0159\u00edzen\u00ed\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[4743,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"\u00da\u010det po\u010d\u00edta\u010de byl smaz\u00e1n\",\"\u00da\u010det za\u0159\u00edzen\u00ed byl z dom\u00e9ny odstran\u011bn.\",\"info\",[\"Pl\u00e1novan\u00e9 vy\u0159azen\u00ed za\u0159\u00edzen\u00ed\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[4756,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Do univerz\u00e1ln\u00ed skupiny zabezpe\u010den\u00ed byl p\u0159id\u00e1n \u010dlen\",\"Zm\u011bna \u010dlenstv\u00ed v univerz\u00e1ln\u00ed skupin\u011b \u2013 relevantn\u00ed ve v\u00edceom\u00e9nov\u00fdch lesech.\",\"warn\",[\"B\u011b\u017en\u00e9 p\u0159id\u011blen\u00ed p\u0159\u00edstupu\",\"Eskalace opr\u00e1vn\u011bn\u00ed nap\u0159\u00ed\u010d dom\u00e9nami\"],\"P\u0159id\u00e1n\u00ed do lesov\u00fdch privilegovan\u00fdch skupin (nap\u0159. Enterprise Admins) je vysoce cenn\u00e9 pro alertov\u00e1n\u00ed, proto\u017ee \u010dlenstv\u00ed v univerz\u00e1ln\u00ed skupin\u011b plat\u00ed v cel\u00e9m lese.\"],\n[4757,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"\u010clen byl odebr\u00e1n z univerz\u00e1ln\u00ed skupiny zabezpe\u010den\u00ed\",\"\u010clenstv\u00ed v univerz\u00e1ln\u00ed skupin\u011b bylo odebr\u00e1no.\",\"info\",[\"B\u011b\u017en\u00fd \u00faklid p\u0159\u00edstupov\u00fdch pr\u00e1v\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[4767,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"U\u017eivatelsk\u00fd \u00fa\u010det byl odem\u010den\",\"D\u0159\u00edve uzam\u010den\u00fd \u00fa\u010det byl odem\u010den, typicky administr\u00e1torem.\",\"info\",[\"Helpdesk odemyk\u00e1 legitimn\u00edho u\u017eivatele\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; ov\u011b\u0159te, \u017ee odem\u010den\u00ed provedla autorizovan\u00e1 helpdesk\/administr\u00e1torsk\u00e1 akce, nikoli s\u00e1m \u00fa\u010det obch\u00e1zej\u00edc\u00ed mechanismus uzam\u010den\u00ed.\"],\n[4780,\"Security\",\"Spr\u00e1va \u00fa\u010dt\u016f\",\"Byl nastaven ACL na \u00fa\u010dtech, kter\u00e9 jsou \u010dleny administr\u00e1torsk\u00fdch skupin\",\"Zaznamen\u00e1v\u00e1 se, kdy\u017e Windows resetuje bezpe\u010dnostn\u00ed deskriptor u \u00fa\u010dt\u016f n\u00e1le\u017eej\u00edc\u00edch do privilegovan\u00fdch skupin.\",\"info\",[\"Automatick\u00e9 vynucen\u00ed AdminSDHolder v Active Directory\"],\"B\u011b\u017en\u011b jde o automatickou \u00fadr\u017ebu AD (AdminSDHolder); zm\u00ednku si zaslou\u017e\u00ed hlavn\u011b proto, \u017ee neobvykle \u010dast\u00e9 v\u00fdskyty mohou znamenat opakovan\u00e9 z\u00e1sahy do opr\u00e1vn\u011bn\u00ed chr\u00e1n\u011bn\u00fdch \u00fa\u010dt\u016f.\"],\n[4768,\"Security\",\"Kerberos a NTLM\",\"Byl vy\u017e\u00e1d\u00e1n Kerberos autentiza\u010dn\u00ed tiket (TGT)\",\"Zaznamen\u00e1v\u00e1 se na \u0159adi\u010di dom\u00e9ny, kdy\u017e u\u017eivatel nebo slu\u017eba po\u017e\u00e1d\u00e1 o po\u010d\u00e1te\u010dn\u00ed Kerberos tiket \u2013 v podstat\u011b jde o pohled na p\u0159ihl\u00e1\u0161en\u00ed z pozice \u0159adi\u010de dom\u00e9ny.\",\"info\",[\"B\u011b\u017en\u00e9 p\u0159ihl\u00e1\u0161en\u00ed do dom\u00e9ny\",\"Po\u017eadavky na neexistuj\u00edc\u00ed nebo zak\u00e1zan\u00fd \u00fa\u010det (stoj\u00ed za prov\u011b\u0159en\u00ed)\"],\"Po\u017eadavky v\u00e1zan\u00e9 na neexistuj\u00edc\u00ed nebo zak\u00e1zan\u00e9 \u00fa\u010dty, nebo n\u00e1hl\u00fd n\u00e1r\u016fst po\u017eadavk\u016f z jednoho zdroje, mohou znamenat v\u00fd\u010det \u00fa\u010dt\u016f (enumeraci) nebo pokus o hrubou s\u00edlu proti Kerberos pre-autentizaci.\"],\n[4769,\"Security\",\"Kerberos a NTLM\",\"Byl vy\u017e\u00e1d\u00e1n Kerberos servisn\u00ed tiket\",\"Zaznamen\u00e1v\u00e1 se poka\u017ed\u00e9, kdy\u017e klient po\u017eaduje p\u0159\u00edstup ke konkr\u00e9tn\u00ed slu\u017eb\u011b. U\u017eite\u010dn\u00e1 stopa pro sledov\u00e1n\u00ed, ke kter\u00fdm zdroj\u016fm se \u00fa\u010det p\u0159ihla\u0161oval, a kl\u00ed\u010dov\u00e1 pro odhalen\u00ed Kerberoastingu (neobvykl\u00fd objem po\u017eadavk\u016f na tikety pro servisn\u00ed \u00fa\u010dty).\",\"warn\",[\"B\u011b\u017en\u00fd p\u0159\u00edstup k souborov\u00e9mu sd\u00edlen\u00ed, SQL instanci nebo jin\u00e9 slu\u017eb\u011b autentizovan\u00e9 p\u0159es Kerberos\",\"Rekognoskace (Kerberoasting)\"],\"Neobvykle vysok\u00fd objem po\u017eadavk\u016f na servisn\u00ed tikety pro \u00fa\u010dty s nastaven\u00fdm Service Principal Name (SPN), zejm\u00e9na p\u0159i pou\u017eit\u00ed slab\u00e9ho (RC4) \u0161ifrov\u00e1n\u00ed, je typick\u00fdm projevem Kerberoastingu \u2013 \u00fatoku offline l\u00e1m\u00e1n\u00ed hesel proti servisn\u00edm \u00fa\u010dt\u016fm.\"],\n[4770,\"Security\",\"Kerberos a NTLM\",\"Kerberos servisn\u00ed tiket byl obnoven\",\"Existuj\u00edc\u00ed tiket byl obnoven, m\u00edsto aby byl vyd\u00e1n \u00fapln\u011b nov\u00fd.\",\"info\",[\"B\u011b\u017en\u00e1 spr\u00e1va \u017eivotn\u00edho cyklu tiket\u016f\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[4771,\"Security\",\"Kerberos a NTLM\",\"Kerberos pre-autentizace selhala\",\"Obvykle znamen\u00e1, \u017ee bylo zad\u00e1no \u0161patn\u00e9 heslo b\u011bhem Kerberos autentizace; opakovan\u00e1 selh\u00e1n\u00ed u jednoho \u00fa\u010dtu nazna\u010duj\u00ed \u00fatok hrubou silou.\",\"warn\",[\"U\u017eivatel si spletl heslo\",\"\u00datok hrubou silou proti konkr\u00e9tn\u00edmu \u00fa\u010dtu\"],\"Opakovan\u00e1 selh\u00e1n\u00ed pre-autentizace u jednoho \u00fa\u010dtu jsou siln\u00fdm indik\u00e1torem \u00fatoku hrubou silou; rozpt\u00fdlen\u00e1 selh\u00e1n\u00ed nap\u0159\u00ed\u010d mnoha \u00fa\u010dty z jednoho zdroje nazna\u010duj\u00ed password spraying.\"],\n[4772,\"Security\",\"Kerberos a NTLM\",\"Po\u017eadavek na Kerberos autentiza\u010dn\u00ed tiket selhal\",\"Samotn\u00fd po\u017eadavek na TGT selhal z jin\u00e9ho d\u016fvodu ne\u017e \u0161patn\u00e9 heslo (nap\u0159. rozd\u00edl v syst\u00e9mov\u00e9m \u010dase, neshoda typu \u0161ifrov\u00e1n\u00ed).\",\"warn\",[\"Probl\u00e9m se synchronizac\u00ed \u010dasu mezi klientem a \u0159adi\u010dem dom\u00e9ny\",\"\u0160patn\u011b nastaven\u00e9 nebo nekompatibiln\u00ed \u0161ifrov\u00e1n\u00ed\"],\"Obvykle ne\u0161kodn\u00e9 (rozd\u00edl v \u010dase, neshoda \u0161ifrov\u00e1n\u00ed), ale ve v\u011bt\u0161\u00edm mno\u017estv\u00ed stoj\u00ed za prov\u011b\u0159en\u00ed jako zn\u00e1mka n\u00e1stroje testuj\u00edc\u00edho konfiguraci Kerberosu.\"],\n[4773,\"Security\",\"Kerberos a NTLM\",\"Po\u017eadavek na Kerberos servisn\u00ed tiket selhal\",\"Po\u017eadavek na servisn\u00ed tiket byl odm\u00edtnut.\",\"warn\",[\"P\u0159\u00edstup ke slu\u017eb\u011b, ke kter\u00e9 \u00fa\u010det nem\u00e1 opr\u00e1vn\u011bn\u00ed\",\"Pokusy o manipulaci s tikety\"],\"M\u016f\u017ee znamenat rekognoskaci v\u016f\u010di slu\u017eb\u00e1m, ke kter\u00fdm po\u017eaduj\u00edc\u00ed \u00fa\u010det nem\u00e1 opr\u00e1vn\u011bn\u00ed.\"],\n[4776,\"Security\",\"Kerberos a NTLM\",\"\u0158adi\u010d dom\u00e9ny se pokusil ov\u011b\u0159it p\u0159ihla\u0161ovac\u00ed \u00fadaje (NTLM)\",\"Zaznamen\u00e1v\u00e1 se, kdy\u017e se k autentizaci pou\u017eije NTLM m\u00edsto Kerberosu \u2013 b\u011b\u017en\u00e9 u lok\u00e1ln\u00edch p\u0159ihl\u00e1\u0161en\u00ed, star\u0161\u00edch aplikac\u00ed nebo p\u0159ihl\u00e1\u0161en\u00ed podle IP adresy.\",\"info\",[\"Autentizace star\u0161\u00ed aplikace\",\"P\u0159ihl\u00e1\u0161en\u00ed obch\u00e1zej\u00edc\u00ed Kerberos (stoj\u00ed za prov\u011b\u0159en\u00ed ve zabezpe\u010den\u00e9m prost\u0159ed\u00ed)\"],\"Proto\u017ee je NTLM autentizace slab\u0161\u00ed ne\u017e Kerberos a nem\u00e1 stejnou \u00farove\u0148 ochrany, n\u00e1r\u016fst NTLM p\u0159ihl\u00e1\u0161en\u00ed v jinak Kerberos-prioritn\u00edm prost\u0159ed\u00ed m\u016f\u017ee znamenat downgrade \u00fatok nebo pokus o NTLM relay.\"],\n[4777,\"Security\",\"Kerberos a NTLM\",\"\u0158adi\u010di dom\u00e9ny se nepoda\u0159ilo ov\u011b\u0159it p\u0159ihla\u0161ovac\u00ed \u00fadaje\",\"Ov\u011b\u0159en\u00ed NTLM p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f selhalo.\",\"warn\",[\"\u0160patn\u00e9 heslo p\u0159i NTLM p\u0159ihl\u00e1\u0161en\u00ed\",\"Pokusy typu credential stuffing\"],\"Opakovan\u00e1 selh\u00e1n\u00ed ov\u011b\u0159en\u00ed NTLM proti jednomu \u00fa\u010dtu jsou indik\u00e1torem \u00fatoku hrubou silou nebo credential stuffingu.\"],\n[4673,\"Security\",\"Pou\u017eit\u00ed opr\u00e1vn\u011bn\u00ed\",\"Byla zavol\u00e1na privilegovan\u00e1 slu\u017eba\",\"Bylo zavol\u00e1no API vy\u017eaduj\u00edc\u00ed citliv\u00e9 opr\u00e1vn\u011bn\u00ed (nap\u0159. opr\u00e1vn\u011bn\u00ed k z\u00e1lohov\u00e1n\u00ed nebo debugov\u00e1n\u00ed).\",\"warn\",[\"Legitimn\u00ed z\u00e1lohovac\u00ed nebo syst\u00e9mov\u00e9 n\u00e1stroje\",\"Zneu\u017eit\u00ed opr\u00e1vn\u011bn\u00ed malwarem nebo \u00fato\u010dn\u00edkem\"],\"Proto\u017ee opr\u00e1vn\u011bn\u00ed jako SeDebugPrivilege lze pou\u017e\u00edt ke \u010dten\u00ed pam\u011bti jin\u00fdch proces\u016f (v\u010detn\u011b LSASS pro kr\u00e1de\u017e p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f), neo\u010dek\u00e1van\u00e9 pou\u017eit\u00ed t\u00e9to ud\u00e1losti nezabezpe\u010dovac\u00edm n\u00e1strojem stoj\u00ed za prov\u011b\u0159en\u00ed.\"],\n[4674,\"Security\",\"Pou\u017eit\u00ed opr\u00e1vn\u011bn\u00ed\",\"Byla provedena operace na privilegovan\u00e9m objektu\",\"P\u0159\u00edstup k citliv\u00e9mu objektu vy\u017eaduj\u00edc\u00ed zv\u00fd\u0161en\u00e1 opr\u00e1vn\u011bn\u00ed.\",\"warn\",[\"Administrativn\u00ed \u00fadr\u017eba\",\"Pokus o manipulaci s chr\u00e1n\u011bn\u00fdm objektem\"],\"Znamen\u00e1 p\u0159\u00edstup k citliv\u00e9mu objektu se zv\u00fd\u0161en\u00fdmi opr\u00e1vn\u011bn\u00edmi; prov\u011b\u0159te v kombinaci s t\u00edm, o jak\u00fd objekt \u0161lo a kdo o p\u0159\u00edstup \u017e\u00e1dal.\"],\n[4688,\"Security\",\"Sledov\u00e1n\u00ed proces\u016f\",\"Byl vytvo\u0159en nov\u00fd proces\",\"Spou\u0161t\u00ed se p\u0159i ka\u017ed\u00e9m startu procesu. Se zapnut\u00fdm auditov\u00e1n\u00edm p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku p\u0159es Group Policy se st\u00e1v\u00e1 jednou z v\u016fbec nejcenn\u011bj\u0161\u00edch ud\u00e1lost\u00ed pro odhalen\u00ed \u0161kodliv\u00fdch skript\u016f, living-off-the-land technik a neobvykl\u00fdch \u0159et\u011bzc\u016f rodi\u010d\u2013potomek u proces\u016f.\",\"warn\",[\"B\u011b\u017en\u00e9 spou\u0161t\u011bn\u00ed aplikac\u00ed a skript\u016f\",\"Spu\u0161t\u011bn\u00ed malwaru nebo \u00fato\u010dn\u00edkov\u00fdch n\u00e1stroj\u016f\"],\"P\u00e1te\u0159 detekce na koncov\u00fdch bodech p\u0159i pou\u017eit\u00ed nativn\u00edho logov\u00e1n\u00ed Windows \u2013 p\u0159\u00edkazov\u00fd \u0159\u00e1dek odhal\u00ed living-off-the-land techniky (zak\u00f3dovan\u00fd PowerShell, LOLBins jako certutil nebo rundll32), a neobvykl\u00e9 vztahy rodi\u010d\u2013potomek (nap\u0159. Office spou\u0161t\u011bj\u00edc\u00ed cmd.exe) pat\u0159\u00ed mezi nejspolehliv\u011bj\u0161\u00ed zn\u00e1mky spu\u0161t\u011bn\u00ed phishingov\u00e9 payloadu.\"],\n[4689,\"Security\",\"Sledov\u00e1n\u00ed proces\u016f\",\"Proces skon\u010dil\",\"Ozna\u010duje ukon\u010den\u00ed procesu; u\u017eite\u010dn\u00e9 pro sestaven\u00ed d\u00e9lky trv\u00e1n\u00ed procesu ve spojen\u00ed s ud\u00e1lost\u00ed 4688.\",\"info\",[\"B\u011b\u017en\u00e9 dokon\u010den\u00ed procesu\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; podp\u016frn\u00fd detail pro anal\u00fdzu \u017eivotn\u00edho cyklu proces\u016f.\"],\n[4696,\"Security\",\"Sledov\u00e1n\u00ed proces\u016f\",\"Procesu byl p\u0159i\u0159azen prim\u00e1rn\u00ed token\",\"Zaznamen\u00e1v\u00e1 se, kdy\u017e je proces spu\u0161t\u011bn s jin\u00fdm bezpe\u010dnostn\u00edm tokenem, ne\u017e m\u00e1 jeho rodi\u010d, \u010dasto p\u0159es RunAs nebo napl\u00e1novan\u00e9 \u00falohy.\",\"warn\",[\"Legitimn\u00ed impersonace pro napl\u00e1novan\u00e9 \u00falohy\",\"Manipulace s tokenem za \u00fa\u010delem eskalace opr\u00e1vn\u011bn\u00ed\"],\"Manipulace s tokenem je zdokumentovan\u00e1 technika eskalace opr\u00e1vn\u011bn\u00ed a impersonace, tak\u017ee neo\u010dek\u00e1van\u00e9 ud\u00e1losti 4696 mimo kontext napl\u00e1novan\u00fdch \u00faloh nebo RunAs zaslou\u017e\u00ed prov\u011b\u0159en\u00ed.\"],\n[4698,\"Security\",\"Napl\u00e1novan\u00e9 \u00falohy\",\"Byla vytvo\u0159ena napl\u00e1novan\u00e1 \u00faloha\",\"Byla zaregistrov\u00e1na nov\u00e1 \u00faloha pl\u00e1nova\u010de \u00faloh. \u00dato\u010dn\u00edci b\u011b\u017en\u011b pou\u017e\u00edvaj\u00ed napl\u00e1novan\u00e9 \u00falohy jako mechanismus perzistence, tak\u017ee neo\u010dek\u00e1van\u00e1 vytvo\u0159en\u00ed zaslou\u017e\u00ed pozornost.\",\"warn\",[\"Legitimn\u00ed automatizace nebo \u00fadr\u017ebov\u00e1 \u00faloha\",\"Mechanismus perzistence zaveden\u00fd \u00fato\u010dn\u00edkem\"],\"Napl\u00e1novan\u00e9 \u00falohy pat\u0159\u00ed mezi nej\u010dast\u011bj\u0161\u00ed mechanismy perzistence p\u0159i re\u00e1ln\u00fdch \u00fatoc\u00edch; nov\u00e1 \u00faloha spou\u0161t\u011bj\u00edc\u00ed skript, stahuj\u00edc\u00ed payload nebo b\u011b\u017e\u00edc\u00ed pod SYSTEM mimo change management m\u00e1 vysokou prioritu k pro\u0161et\u0159en\u00ed.\"],\n[4699,\"Security\",\"Napl\u00e1novan\u00e9 \u00falohy\",\"Napl\u00e1novan\u00e1 \u00faloha byla smaz\u00e1na\",\"Existuj\u00edc\u00ed napl\u00e1novan\u00e1 \u00faloha byla odstran\u011bna.\",\"info\",[\"B\u011b\u017en\u00fd \u00faklid\",\"\u00dato\u010dn\u00edk zahlazuje stopy\"],\"M\u016f\u017ee znamenat, \u017ee \u00fato\u010dn\u00edk po spln\u011bn\u00ed \u00fa\u010delu smazal \u00falohu, zejm\u00e9na pokud n\u00e1sleduje kr\u00e1tce po odpov\u00eddaj\u00edc\u00ed ud\u00e1losti 4698.\"],\n[4700,\"Security\",\"Napl\u00e1novan\u00e9 \u00falohy\",\"Napl\u00e1novan\u00e1 \u00faloha byla povolena\",\"Zak\u00e1zan\u00e1 \u00faloha byla znovu povolena.\",\"info\",[\"Reaktivace neaktivn\u00edho mechanismu perzistence\"],\"Op\u011btovn\u00e9 povolen\u00ed d\u0159\u00edve zak\u00e1zan\u00e9 \u00falohy m\u016f\u017ee znamenat reaktivaci sp\u00edc\u00edho mechanismu perzistence.\"],\n[4701,\"Security\",\"Napl\u00e1novan\u00e9 \u00falohy\",\"Napl\u00e1novan\u00e1 \u00faloha byla zak\u00e1z\u00e1na\",\"\u00daloha byla vypnuta, ani\u017e by byla smaz\u00e1na.\",\"info\",[\"B\u011b\u017en\u00e1 administrace\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[4702,\"Security\",\"Napl\u00e1novan\u00e9 \u00falohy\",\"Napl\u00e1novan\u00e1 \u00faloha byla aktualizov\u00e1na\",\"Byla zm\u011bn\u011bna konfigurace nebo spou\u0161t\u011b\u010d existuj\u00edc\u00ed \u00falohy.\",\"warn\",[\"Legitimn\u00ed \u00fadr\u017eba\",\"\u00dato\u010dn\u00edk upravuje existuj\u00edc\u00ed \u00falohu, aby spou\u0161t\u011bla \u0161kodliv\u00fd k\u00f3d\"],\"\u00daprava existuj\u00edc\u00ed, d\u016fv\u011bryhodn\u00e9 \u00falohy tak, aby spou\u0161t\u011bla dal\u0161\u00ed nebo jin\u00e9 p\u0159\u00edkazy, je nen\u00e1padn\u011bj\u0161\u00ed technika perzistence ne\u017e vytvo\u0159en\u00ed zcela nov\u00e9 \u00falohy, proto\u017ee nevyvol\u00e1 novou ud\u00e1lost 4698.\"],\n[4656,\"Security\",\"P\u0159\u00edstup k objekt\u016fm a soubor\u016fm\",\"Byl vy\u017e\u00e1d\u00e1n handle k objektu\",\"Zaznamen\u00e1v\u00e1 se, kdy\u017e proces po\u017e\u00e1d\u00e1 o p\u0159\u00edstup k souboru, kl\u00ed\u010di registru nebo jin\u00e9mu zabezpe\u010diteln\u00e9mu objektu, je\u0161t\u011b p\u0159ed samotn\u00fdm \u010dten\u00edm nebo z\u00e1pisem. Vysok\u00fd objem; obvykle se filtruje na konkr\u00e9tn\u00ed citliv\u00e9 objekty.\",\"info\",[\"B\u011b\u017en\u00fd p\u0159\u00edstup k soubor\u016fm\/registru p\u0159i aktivn\u00ed z\u00e1sad\u011b auditu\"],\"N\u00edzk\u00fd sign\u00e1l izolovan\u011b vzhledem k objemu; hodnotu z\u00edsk\u00e1v\u00e1, pokud je zam\u011b\u0159en na konkr\u00e9tn\u00ed citliv\u00e9 soubory, sd\u00edlen\u00e9 slo\u017eky nebo kl\u00ed\u010de registru prost\u0159ednictv\u00edm SACL.\"],\n[4657,\"Security\",\"P\u0159\u00edstup k objekt\u016fm a soubor\u016fm\",\"Hodnota registru byla zm\u011bn\u011bna\",\"Byla zm\u011bn\u011bna sledovan\u00e1 hodnota registru \u2013 u\u017eite\u010dn\u00e9 pro sledov\u00e1n\u00ed kl\u00ed\u010d\u016f perzistence (kl\u00ed\u010de Run apod.).\",\"warn\",[\"Legitimn\u00ed konfigurace softwaru\",\"Zav\u00e1d\u011bn\u00ed perzistence p\u0159es registr\"],\"Kl\u00ed\u010dov\u00e9 pro odhalen\u00ed perzistence p\u0159es registr (kl\u00ed\u010de Run\/RunOnce, zm\u011bny ImagePath slu\u017eby apod.), pokud je zam\u011b\u0159eno na kl\u00ed\u010de, kter\u00e9 \u00fato\u010dn\u00edci b\u011b\u017en\u011b zneu\u017e\u00edvaj\u00ed.\"],\n[4658,\"Security\",\"P\u0159\u00edstup k objekt\u016fm a soubor\u016fm\",\"Handle k objektu byl uzav\u0159en\",\"Ve spojen\u00ed s ud\u00e1lost\u00ed 4656 ohrani\u010duje dobu, po kterou byl objekt otev\u0159en\u00fd.\",\"info\",[\"B\u011b\u017en\u00fd \u017eivotn\u00ed cyklus objektu\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; podp\u016frn\u00fd detail pro \u010dasov\u00e9 osy k ud\u00e1losti 4656.\"],\n[4660,\"Security\",\"P\u0159\u00edstup k objekt\u016fm a soubor\u016fm\",\"Objekt byl smaz\u00e1n\",\"Byl smaz\u00e1n sledovan\u00fd soubor, slo\u017eka nebo objekt.\",\"warn\",[\"B\u011b\u017en\u00e1 spr\u00e1va soubor\u016f\",\"Destrukce dat nebo odstran\u011bn\u00ed d\u016fkaz\u016f\"],\"Smaz\u00e1n\u00ed sledovan\u00fdch soubor\u016f m\u016f\u017ee znamenat destrukci dat, aktivitu ransomwaru nebo odstran\u011bn\u00ed d\u016fkaz\u016f, v z\u00e1vislosti na tom, co bylo smaz\u00e1no.\"],\n[4663,\"Security\",\"P\u0159\u00edstup k objekt\u016fm a soubor\u016fm\",\"Byl proveden pokus o p\u0159\u00edstup k objektu\",\"Zaznamen\u00e1v\u00e1 konkr\u00e9tn\u00ed typ p\u0159\u00edstupu (\u010dten\u00ed\/z\u00e1pis\/smaz\u00e1n\u00ed) k auditovan\u00e9mu souboru, slo\u017ece nebo kl\u00ed\u010di registru \u2013 kl\u00ed\u010dov\u00e1 ud\u00e1lost pro sledov\u00e1n\u00ed p\u0159\u00edstupu k citliv\u00fdm dat\u016fm.\",\"warn\",[\"Legitimn\u00ed p\u0159\u00edstup ke sledovan\u00e9mu souborov\u00e9mu sd\u00edlen\u00ed\",\"Neopr\u00e1vn\u011bn\u00fd p\u0159\u00edstup k citliv\u00fdm dat\u016fm\"],\"Hlavn\u00ed ud\u00e1lost pro odhalen\u00ed neopr\u00e1vn\u011bn\u00e9ho p\u0159\u00edstupu k citliv\u00fdm soubor\u016fm a slo\u017ek\u00e1m, pokud je na dan\u00fdch datech nakonfigurov\u00e1no auditov\u00e1n\u00ed p\u0159\u00edstupu k souborov\u00e9mu syst\u00e9mu (SACL).\"],\n[4670,\"Security\",\"P\u0159\u00edstup k objekt\u016fm a soubor\u016fm\",\"Byla zm\u011bn\u011bna opr\u00e1vn\u011bn\u00ed na objektu\",\"Bylo upraveno ACL\/DACL objektu.\",\"warn\",[\"Legitimn\u00ed spr\u00e1va opr\u00e1vn\u011bn\u00ed\",\"\u00dato\u010dn\u00edk roz\u0161i\u0159uje p\u0159\u00edstup k souboru nebo slo\u017ece\"],\"Roz\u0161\u00ed\u0159en\u00ed opr\u00e1vn\u011bn\u00ed na citliv\u00e9m souboru, slo\u017ece nebo kl\u00ed\u010di registru je b\u011b\u017en\u00fd krok k tomu, aby byla data p\u0159\u00edstupn\u00e1 pro pozd\u011bj\u0161\u00ed exfiltraci, nebo aby se v nich uchytil perzistentn\u00ed artefakt dostupn\u00fd i pro \u00fa\u010det s ni\u017e\u0161\u00edmi opr\u00e1vn\u011bn\u00edmi.\"],\n[5140,\"Security\",\"P\u0159\u00edstup k objekt\u016fm a soubor\u016fm\",\"Byl proveden p\u0159\u00edstup k s\u00ed\u0165ov\u00e9mu sd\u00edlen\u00e9mu objektu\",\"Zaznamen\u00e1v\u00e1 se p\u0159i p\u0159\u00edstupu ke sd\u00edlen\u00e9 slo\u017ece po s\u00edti.\",\"info\",[\"B\u011b\u017en\u00e9 pou\u017eit\u00ed souborov\u00e9ho sd\u00edlen\u00ed\",\"Rekognoskace nebo p\u0159\u00edprava dat p\u0159ed exfiltrac\u00ed\"],\"Z\u00e1kladn\u00ed aktivita p\u0159\u00edstupu ke sd\u00edlen\u00ed; neobvykl\u00e9 vzorce p\u0159\u00edstupu (mimo pracovn\u00ed dobu, nezn\u00e1m\u00e9 \u00fa\u010dty, neobvykle rozs\u00e1hl\u00e9 proch\u00e1zen\u00ed) mohou znamenat rekognoskaci p\u0159ed shroma\u017e\u010fov\u00e1n\u00edm dat.\"],\n[5142,\"Security\",\"P\u0159\u00edstup k objekt\u016fm a soubor\u016fm\",\"Byl p\u0159id\u00e1n s\u00ed\u0165ov\u00fd sd\u00edlen\u00fd objekt\",\"Bylo vytvo\u0159eno nov\u00e9 s\u00ed\u0165ov\u00e9 sd\u00edlen\u00ed.\",\"warn\",[\"Legitimn\u00ed z\u0159\u00edzen\u00ed sd\u00edlen\u00ed\",\"\u00dato\u010dn\u00edk p\u0159ipravuje m\u00edsto pro shroma\u017e\u010fov\u00e1n\u00ed nebo exfiltraci dat\"],\"Nov\u00e1 sd\u00edlen\u00ed vytvo\u0159en\u00e1 mimo change management mohou znamenat, \u017ee si \u00fato\u010dn\u00edk p\u0159ipravuje m\u00edsto pro shrom\u00e1\u017ed\u011bn\u00ed nebo exfiltraci dat.\"],\n[5143,\"Security\",\"P\u0159\u00edstup k objekt\u016fm a soubor\u016fm\",\"S\u00ed\u0165ov\u00fd sd\u00edlen\u00fd objekt byl zm\u011bn\u011bn\",\"Bylo zm\u011bn\u011bno nastaven\u00ed existuj\u00edc\u00edho sd\u00edlen\u00ed.\",\"info\",[\"B\u011b\u017en\u00e1 spr\u00e1va sd\u00edlen\u00ed\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; prov\u011b\u0159te, zda nedo\u0161lo k roz\u0161\u00ed\u0159en\u00ed opr\u00e1vn\u011bn\u00ed.\"],\n[5144,\"Security\",\"P\u0159\u00edstup k objekt\u016fm a soubor\u016fm\",\"S\u00ed\u0165ov\u00fd sd\u00edlen\u00fd objekt byl smaz\u00e1n\",\"S\u00ed\u0165ov\u00e9 sd\u00edlen\u00ed bylo odstran\u011bno.\",\"info\",[\"B\u011b\u017en\u00e1 spr\u00e1va sd\u00edlen\u00ed\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[5145,\"Security\",\"P\u0159\u00edstup k objekt\u016fm a soubor\u016fm\",\"Bylo zkontrolov\u00e1no opr\u00e1vn\u011bn\u00ed p\u0159\u00edstupu k s\u00ed\u0165ov\u00e9mu sd\u00edlen\u00ed\",\"Zaznamen\u00e1v\u00e1 se pro ka\u017ed\u00fd soubor, ke kter\u00e9mu bylo p\u0159istupov\u00e1no na sd\u00edlen\u00ed, a zaznamen\u00e1v\u00e1, zda byl \u017e\u00e1daj\u00edc\u00edmu \u00fa\u010dtu p\u0159\u00edstup povolen, nebo odep\u0159en \u2013 velmi vysok\u00fd objem, obvykle se zap\u00edn\u00e1 selektivn\u011b.\",\"info\",[\"B\u011b\u017en\u00e1 aktivita na souborov\u00e9m sd\u00edlen\u00ed, u\u017eite\u010dn\u00e1 pro podrobn\u00e9 forenzn\u00ed \u010dasov\u00e9 osy\"],\"Velmi vysok\u00fd objem, ale ve spojen\u00ed s ud\u00e1lost\u00ed 5140 poskytuje d\u016fkaz na \u00farovni jednotliv\u00fdch soubor\u016f o tom, co bylo ze sd\u00edlen\u00ed skute\u010dn\u011b p\u0159e\u010dteno \u2013 u\u017eite\u010dn\u00e9 pro vymezen\u00ed rozsahu \u00faniku dat.\"],\n[4715,\"Security\",\"Z\u00e1sady a audit\",\"Byla zm\u011bn\u011bna z\u00e1sada auditu na objektu\",\"Bylo upraveno SACL (nastaven\u00ed auditu) na konkr\u00e9tn\u00edm objektu.\",\"warn\",[\"Legitimn\u00ed lad\u011bn\u00ed auditu\",\"\u00dato\u010dn\u00edk vyp\u00edn\u00e1 audit na c\u00edlov\u00e9m objektu\"],\"Vypnut\u00ed auditov\u00e1n\u00ed na konkr\u00e9tn\u00edm citliv\u00e9m objektu je c\u00edlen\u00e1 metoda, jak se pro \u00fato\u010dn\u00edka st\u00e1t na dan\u00e9m zdroji neviditeln\u00fdm, zat\u00edmco zbytek logov\u00e1n\u00ed z\u016fst\u00e1v\u00e1 beze zm\u011bny.\"],\n[4719,\"Security\",\"Z\u00e1sady a audit\",\"Byla zm\u011bn\u011bna syst\u00e9mov\u00e1 z\u00e1sada auditu\",\"Byla upravena dom\u00e9nov\u00e1 nebo strojov\u00e1 z\u00e1sada auditu jako celek \u2013 vysoce hodnotn\u00e1 ud\u00e1lost, proto\u017ee m\u016f\u017ee uml\u010det cel\u00e9 kategorie budouc\u00edch detekc\u00ed.\",\"crit\",[\"Legitimn\u00ed lad\u011bn\u00ed z\u00e1sad administr\u00e1torem\",\"\u00dato\u010dn\u00edk vyp\u00edn\u00e1 bezpe\u010dnostn\u00ed audit, aby z\u016fstal nepov\u0161imnut\"],\"Jedna z nejz\u00e1va\u017en\u011bj\u0161\u00edch ud\u00e1lost\u00ed v cel\u00e9m seznamu \u2013 zm\u011bna zde m\u016f\u017ee uml\u010det cel\u00e9 kategorie budouc\u00edch detekc\u00ed, proto by m\u011bla b\u00fdt p\u0159\u00edsn\u011b omezena a v\u017edy vyvol\u00e1vat alert.\"],\n[4739,\"Security\",\"Z\u00e1sady a audit\",\"Byla zm\u011bn\u011bna dom\u00e9nov\u00e1 z\u00e1sada\",\"Byla upravena celodom\u00e9nov\u00e1 nastaven\u00ed z\u00e1sad (nap\u0159. hesla nebo uzamyk\u00e1n\u00ed \u00fa\u010dt\u016f).\",\"warn\",[\"Pl\u00e1novan\u00e1 aktualizace z\u00e1sad\",\"Oslaben\u00ed z\u00e1sad hesla\/uzamyk\u00e1n\u00ed, aby se usnadnil \u00fatok hrubou silou\"],\"Oslaben\u00ed komplexity hesla, minim\u00e1ln\u00ed d\u00e9lky nebo prahu pro uzam\u010den\u00ed \u00fa\u010dtu p\u0159\u00edmo zvy\u0161uje vystaven\u00ed dom\u00e9ny \u00fatok\u016fm hrubou silou a password spraying.\"],\n[4907,\"Security\",\"Z\u00e1sady a audit\",\"Byla zm\u011bn\u011bna nastaven\u00ed auditu objektu\",\"Byla upravena nastaven\u00ed auditu na \u00farovni objektu (podobn\u00e9 4715, \u0161ir\u0161\u00ed rozsah typ\u016f objekt\u016f).\",\"warn\",[\"Legitimn\u00ed zm\u011bna konfigurace auditu\"],\"Podobn\u00e9 riziko jako u 4715 \u2013 \u00fato\u010dn\u00edk vyp\u00edn\u00e1 audit na objektu, aby s n\u00edm mohl pracovat, ani\u017e by zanechal stopu.\"],\n[1102,\"Security\",\"Z\u00e1sady a audit\",\"Log auditu byl vymaz\u00e1n\",\"Log Security byl ru\u010dn\u011b vymaz\u00e1n. Jedna z nejcenn\u011bj\u0161\u00edch ud\u00e1lost\u00ed v cel\u00e9m seznamu \u2013 legitimn\u00ed d\u016fvody jsou vz\u00e1cn\u00e9 a jde o b\u011b\u017en\u00fd krok k zahlazen\u00ed stop po \u00fatoku.\",\"crit\",[\"Pl\u00e1novan\u00e1 \u00fadr\u017eba logu (vz\u00e1cn\u00e1 a m\u011bla by b\u00fdt zdokumentovan\u00e1)\",\"\u00dato\u010dn\u00edk ma\u017ee d\u016fkazy o sv\u00e9 \u010dinnosti\"],\"Pat\u0159\u00ed mezi nejsiln\u011bj\u0161\u00ed indik\u00e1tory \u0161kodliv\u00e9 aktivity v logov\u00e1n\u00ed Windows v\u016fbec: legitimn\u00ed d\u016fvody k ru\u010dn\u00edmu vymaz\u00e1n\u00ed logu Security jsou vz\u00e1cn\u00e9 a jde o dob\u0159e zn\u00e1m\u00fd krok, kter\u00fdm \u00fato\u010dn\u00edci ma\u017eou d\u016fkazy po dosa\u017een\u00ed sv\u00e9ho c\u00edle.\"],\n[1104,\"Security\",\"Z\u00e1sady a audit\",\"Log Security je pln\u00fd\",\"Log Security dos\u00e1hl sv\u00e9 maxim\u00e1ln\u00ed velikosti a v z\u00e1vislosti na nastaven\u00ed retence m\u016f\u017ee za\u010d\u00edt p\u0159episovat star\u0161\u00ed ud\u00e1losti nebo p\u0159estat logovat.\",\"warn\",[\"Velikost logu nastaven\u00e1 p\u0159\u00edli\u0161 n\u00edzko vzhledem k objemu ud\u00e1lost\u00ed\",\"N\u00e1por ud\u00e1lost\u00ed, p\u0159\u00edpadn\u011b zp\u016fsoben\u00fd \u00fatokem, rychle zapl\u0148uj\u00edc\u00ed log\"],\"M\u016f\u017ee j\u00edt o zcela ne\u0161kodnou p\u0159\u00ed\u010dinu (podhodnocen\u00e1 velikost logu), ale pokud se shoduje s n\u00e1hl\u00fdm n\u00e1r\u016fstem aktivity, m\u016f\u017ee j\u00edt o \u00fato\u010dn\u00edka, kter\u00fd zaplavuje log, aby p\u0159es p\u0159epis vytla\u010dil star\u0161\u00ed d\u016fkazy.\"],\n[1105,\"Security\",\"Z\u00e1sady a audit\",\"Log ud\u00e1lost\u00ed byl automaticky archivov\u00e1n\",\"Slu\u017eba event logu provedla napl\u00e1novan\u00e9 z\u00e1lohov\u00e1n\u00ed\/rotaci souboru logu.\",\"info\",[\"B\u011b\u017en\u00e1 rotace logu\"],\"N\u00edzk\u00fd bezpe\u010dnostn\u00ed v\u00fdznam; rutinn\u00ed \u00fadr\u017eba logu.\"],\n[1108,\"Security\",\"Z\u00e1sady a audit\",\"Slu\u017eba logov\u00e1n\u00ed ud\u00e1lost\u00ed narazila na chybu\",\"Samotn\u00e1 slu\u017eba Windows Event Log narazila na intern\u00ed chybu p\u0159i zpracov\u00e1n\u00ed ud\u00e1lost\u00ed.\",\"warn\",[\"Nedostatek diskov\u00e9ho prostoru nebo zdroj\u016f pro logovac\u00ed subsyst\u00e9m\",\"Po\u0161kozen\u00ed logu\"],\"Stoj\u00ed za pro\u0161et\u0159en\u00ed, pokud vede k v\u00fdpadku v pokryt\u00ed logov\u00e1n\u00edm, proto\u017ee p\u0159\u00edpadnou mezeru by mohl \u00fato\u010dn\u00edk vyu\u017e\u00edt.\"],\n[5136,\"Security\",\"Directory Service a GPO\",\"Objekt Directory Service byl zm\u011bn\u011bn\",\"Byl zm\u011bn\u011bn objekt Active Directory (v\u010detn\u011b objekt\u016f z\u00e1sad skupiny) \u2013 pro zji\u0161t\u011bn\u00ed, co se skute\u010dn\u011b zm\u011bnilo, zkontrolujte v ud\u00e1losti t\u0159\u00eddu objektu a atribut.\",\"warn\",[\"B\u011b\u017en\u00e1 administrace AD nebo GPO\",\"\u0160kodliv\u00e1 manipulace s GPO (nap\u0159. nasazen\u00ed napl\u00e1novan\u00e9 \u00falohy nebo skriptu na mnoho po\u010d\u00edta\u010d\u016f)\"],\"GPO jsou mocn\u00fdm n\u00e1strojem pro later\u00e1ln\u00ed pohyb a perzistenci \u2013 upraven\u00e1 GPO m\u016f\u017ee na v\u0161echny po\u010d\u00edta\u010de ve sv\u00e9m rozsahu nasadit \u0161kodlivou napl\u00e1novanou \u00falohu, skript nebo polo\u017eku spou\u0161t\u011bn\u00ed, tak\u017ee neo\u010dek\u00e1van\u00e9 zm\u011bny GPO zaslou\u017e\u00ed okam\u017eit\u00e9 pro\u0161et\u0159en\u00ed.\"],\n[5137,\"Security\",\"Directory Service a GPO\",\"Objekt Directory Service byl vytvo\u0159en\",\"Byl vytvo\u0159en nov\u00fd objekt AD.\",\"info\",[\"B\u011b\u017en\u00e9 zakl\u00e1d\u00e1n\u00ed v AD\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; prov\u011b\u0159te nov\u00e9 objekty s bezpe\u010dnostn\u011b relevantn\u00edmi t\u0159\u00eddami (nap\u0159. nov\u00e9 GPO, d\u016fv\u011bry).\"],\n[5138,\"Security\",\"Directory Service a GPO\",\"Objekt Directory Service byl obnoven ze smaz\u00e1n\u00ed\",\"D\u0159\u00edve smazan\u00fd objekt AD byl obnoven z ko\u0161e\/tombstone.\",\"info\",[\"Legitimn\u00ed obnoven\u00ed objektu\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; m\u016f\u017ee b\u00fdt relevantn\u00ed pro forenzn\u00ed \u010dasovou osu, pokud byl obnoven\u00fd objekt p\u0159edt\u00edm smaz\u00e1n se \u0161kodliv\u00fdm \u00famyslem.\"],\n[5139,\"Security\",\"Directory Service a GPO\",\"Objekt Directory Service byl p\u0159esunut\",\"Objekt AD byl p\u0159esunut do jin\u00e9ho kontejneru nebo OU.\",\"info\",[\"B\u011b\u017en\u00e1 reorganizace AD\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; p\u0159esun objektu do m\u00e9n\u011b omezen\u00e9 OU m\u016f\u017ee nez\u00e1m\u011brn\u011b uvolnit aplikovanou z\u00e1sadu skupiny nebo delegov\u00e1n\u00ed.\"],\n[5141,\"Security\",\"Directory Service a GPO\",\"Objekt Directory Service byl smaz\u00e1n\",\"Byl smaz\u00e1n objekt AD.\",\"warn\",[\"B\u011b\u017en\u00fd \u00faklid\",\"Smaz\u00e1n\u00ed bezpe\u010dnostn\u011b relevantn\u00edho objektu, jako je GPO nebo d\u016fv\u011bra\"],\"Smaz\u00e1n\u00ed GPO, d\u016fv\u011bry nebo jin\u00e9ho bezpe\u010dnostn\u011b relevantn\u00edho objektu AD m\u016f\u017ee naru\u0161it bezpe\u010dnostn\u00ed kontroly nebo znamenat, \u017ee \u00fato\u010dn\u00edk ma\u017ee d\u016fkazy p\u0159edchoz\u00ed manipulace.\"],\n[4662,\"Security\",\"Directory Service a GPO\",\"Na objektu Active Directory byla provedena operace\",\"Zaznamen\u00e1v\u00e1 konkr\u00e9tn\u00ed operaci proti vlastnostem objektu AD, v\u010detn\u011b p\u0159\u00edstupov\u00fdch pr\u00e1v souvisej\u00edc\u00edch s replikac\u00ed \u2013 ud\u00e1lost nej\u010dast\u011bji spojovan\u00e1 s odhalen\u00edm kr\u00e1de\u017ee p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f technikou DCSync, pokud se p\u0159istupovan\u00e9 vlastnosti t\u00fdkaj\u00ed replikace.\",\"crit\",[\"B\u011b\u017en\u00e1 replikace AD mezi \u0159adi\u010di dom\u00e9ny\",\"Kr\u00e1de\u017e p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f technikou DCSync z jin\u00e9ho ne\u017e \u0159adi\u010de dom\u00e9ny\"],\"Pokud p\u0159istupovan\u00e9 vlastnosti zahrnuj\u00ed replika\u010dn\u00ed opr\u00e1vn\u011bn\u00ed a \u017eadatelem nen\u00ed \u0159adi\u010d dom\u00e9ny, jde o jeden z nejjasn\u011bj\u0161\u00edch dostupn\u00fdch sign\u00e1l\u016f \u00fatoku DCSync, kter\u00fd z AD extrahuje hashe hesel.\"],\n[4706,\"Security\",\"Directory Service a GPO\",\"Byla vytvo\u0159ena nov\u00e1 d\u016fv\u011bra k dom\u00e9n\u011b\",\"Zaznamen\u00e1v\u00e1 se na \u0159adi\u010di dom\u00e9ny poka\u017ed\u00e9, kdy\u017e je zalo\u017een nov\u00fd meziodm\u00e9nov\u00fd nebo mezilesn\u00ed vztah d\u016fv\u011bry.\",\"warn\",[\"Pl\u00e1novan\u00e9 zaveden\u00ed d\u016fv\u011bry mezi dom\u00e9nami\/lesy\",\"\u00dato\u010dn\u00edk zakl\u00e1d\u00e1 podvr\u017eenou d\u016fv\u011bru pro perzistenci nebo p\u0159\u00edstup\"],\"Neo\u010dek\u00e1van\u00e1 d\u016fv\u011bra m\u016f\u017ee otev\u0159\u00edt cestu k autentizaci z jin\u00e9 dom\u00e9ny\/lesa do t\u00e9 va\u0161\u00ed; \u00fato\u010dn\u00edci s pr\u00e1vy domain admin pou\u017e\u00edvali podvr\u017een\u00e9 d\u016fv\u011bry, aby si udr\u017eeli dlouhodob\u00fd p\u0159\u00edstup i po sanaci p\u016fvodn\u00edho vstupn\u00edho bodu.\"],\n[4707,\"Security\",\"Directory Service a GPO\",\"D\u016fv\u011bra k dom\u00e9n\u011b byla odebr\u00e1na\",\"Existuj\u00edc\u00ed vztah d\u016fv\u011bry k dom\u00e9n\u011b byl smaz\u00e1n.\",\"warn\",[\"Pl\u00e1novan\u00e9 ukon\u010den\u00ed d\u016fv\u011bry\",\"P\u0159eru\u0161en\u00ed cest autentizace, a\u0165 u\u017e z\u00e1m\u011brn\u00e9, nebo \u0161kodliv\u00e9\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b, i kdy\u017e neo\u010dek\u00e1van\u00e9 odebr\u00e1n\u00ed m\u016f\u017ee naru\u0161it zam\u00fd\u0161len\u00fd mezidom\u00e9nov\u00fd p\u0159\u00edstup; ob\u010das se pou\u017e\u00edv\u00e1 i k zahlazen\u00ed stop pot\u00e9, co byla podvr\u017een\u00e1 d\u016fv\u011bra zalo\u017eena a zneu\u017eita.\"],\n[4716,\"Security\",\"Directory Service a GPO\",\"Byly zm\u011bn\u011bny informace o d\u016fv\u011bryhodn\u00e9 dom\u00e9n\u011b\",\"Byla zm\u011bn\u011bna konfigurace existuj\u00edc\u00ed d\u016fv\u011bry k dom\u00e9n\u011b (nap\u0159. sm\u011br, atributy).\",\"warn\",[\"Legitimn\u00ed p\u0159ekonfigurace d\u016fv\u011bry\",\"Oslaben\u00ed bezpe\u010dnostn\u00edch nastaven\u00ed d\u016fv\u011bry (nap\u0159. obejit\u00ed filtrov\u00e1n\u00ed SID)\"],\"Zm\u011bny atribut\u016f d\u016fv\u011bry (nap\u0159. vypnut\u00ed filtrov\u00e1n\u00ed SID nebo karant\u00e9ny) mohou oslabit bezpe\u010dnostn\u00ed hranici mezi dom\u00e9nami a umo\u017enit eskalaci opr\u00e1vn\u011bn\u00ed p\u0159es d\u016fv\u011bru pomoc\u00ed SID history.\"],\n[4713,\"Security\",\"Directory Service a GPO\",\"Byla zm\u011bn\u011bna z\u00e1sada Kerberosu\",\"Byla upravena celodom\u00e9nov\u00e1 nastaven\u00ed z\u00e1sad Kerberos tiket\u016f (\u017eivotnost, obnovov\u00e1n\u00ed apod.).\",\"warn\",[\"Pl\u00e1novan\u00e9 lad\u011bn\u00ed z\u00e1sad\",\"Prodlou\u017een\u00ed \u017eivotnosti tiket\u016f pro snaz\u0161\u00ed perzistenci s odcizen\u00fdmi tikety\"],\"Prodlou\u017een\u00ed maxim\u00e1ln\u00ed \u017eivotnosti tiket\u016f umo\u017e\u0148uje \u00fato\u010dn\u00edkovi d\u00e9le pou\u017e\u00edvat odcizen\u00e9 Kerberos tikety (nap\u0159. p\u0159i technice Pass-the-Ticket), tak\u017ee neo\u010dek\u00e1van\u00e9 zm\u011bny zde stoj\u00ed za prov\u011b\u0159en\u00ed.\"],\n[4765,\"Security\",\"Directory Service a GPO\",\"\u00da\u010dtu byla p\u0159id\u00e1na SID History\",\"\u00da\u010dtu byla p\u0159id\u00e1na hodnota SID History \u2013 legitimn\u00ed p\u0159i migraci dom\u00e9n, ale z\u00e1rove\u0148 dob\u0159e zn\u00e1m\u00e1 technika propa\u0161ov\u00e1n\u00ed dal\u0161\u00edho \u010dlenstv\u00ed ve skupin\u00e1ch (\u00fatok 'SID history injection').\",\"crit\",[\"Legitimn\u00ed n\u00e1stroje pro migraci dom\u00e9n (nap\u0159. ADMT)\",\"SID history injection pou\u017eit\u00e1 k ud\u011blen\u00ed skryt\u00e9ho privilegovan\u00e9ho p\u0159\u00edstupu\"],\"U\u010debnicov\u00e1 technika propa\u0161ov\u00e1n\u00ed skryt\u00e9ho privilegovan\u00e9ho \u010dlenstv\u00ed ve skupin\u00e1ch (\u00fatok SID history injection); mimo aktivn\u00ed, zdokumentovanou migraci dom\u00e9ny zaslou\u017e\u00ed tato ud\u00e1lost okam\u017eit\u00e9 pro\u0161et\u0159en\u00ed.\"],\n[4766,\"Security\",\"Directory Service a GPO\",\"Pokus o p\u0159id\u00e1n\u00ed SID History k \u00fa\u010dtu selhal\",\"Byl proveden pokus o p\u0159id\u00e1n\u00ed SID History, ale byl odm\u00edtnut.\",\"warn\",[\"Ne\u00fasp\u011b\u0161n\u00e1 migra\u010dn\u00ed operace\",\"Zablokovan\u00fd pokus o SID history injection\"],\"I ne\u00fasp\u011b\u0161n\u00fd pokus znamen\u00e1, \u017ee se n\u011bkdo pokusil o techniku SID history injection, a m\u011bl by b\u00fdt pro\u0161et\u0159en, i kdy\u017e se nepovedl.\"],\n[4794,\"Security\",\"Directory Service a GPO\",\"Byl proveden pokus o nastaven\u00ed hesla administr\u00e1tora Directory Services Restore Mode\",\"Zaznamen\u00e1v\u00e1 se, kdy\u017e je na \u0159adi\u010di dom\u00e9ny nastaveno nebo zm\u011bn\u011bno lok\u00e1ln\u00ed heslo administr\u00e1tora DSRM \u2013 toto heslo poskytuje plnou kontrolu nad AD, pokud se kdy vstoup\u00ed do re\u017eimu DSRM.\",\"crit\",[\"Pl\u00e1novan\u00e1 rotace hesla DSRM (doporu\u010den\u00e1 bezpe\u010dnostn\u00ed praxe)\",\"\u00dato\u010dn\u00edk nastavuje zn\u00e1m\u00e9 heslo DSRM jako zadn\u00ed vr\u00e1tka\"],\"Heslo DSRM poskytuje pln\u00fd p\u0159\u00edstup na \u00farovni lok\u00e1ln\u00edho administr\u00e1tora k \u0159adi\u010di dom\u00e9ny mimo b\u011b\u017enou autentizaci AD; \u00fato\u010dn\u00edk, kter\u00fd nastav\u00ed zn\u00e1m\u00e9 heslo DSRM, ho m\u016f\u017ee pou\u017e\u00edt jako trval\u00e1 zadn\u00ed vr\u00e1tka do dom\u00e9ny.\"],\n[4946,\"Security\",\"Firewall\",\"Do seznamu v\u00fdjimek br\u00e1ny Windows Firewall bylo p\u0159id\u00e1no pravidlo\",\"Do lok\u00e1ln\u00edho firewallu bylo p\u0159id\u00e1no nov\u00e9 povoluj\u00edc\u00ed pravidlo.\",\"warn\",[\"Legitimn\u00ed instalace aplikace vy\u017eaduj\u00edc\u00ed otev\u0159en\u00ed portu\",\"\u00dato\u010dn\u00edk otev\u00edr\u00e1 port pro vzd\u00e1len\u00fd p\u0159\u00edstup nebo exfiltraci\"],\"\u00dato\u010dn\u00edci b\u011b\u017en\u011b otev\u00edraj\u00ed port nebo p\u0159id\u00e1vaj\u00ed v\u00fdjimku, aby umo\u017enili n\u00e1stroje pro vzd\u00e1len\u00fd p\u0159\u00edstup nebo komunikaci s C2, tak\u017ee p\u0159id\u00e1n\u00ed pravidel mimo zn\u00e1m\u00e9 instalace softwaru stoj\u00ed za prov\u011b\u0159en\u00ed.\"],\n[4947,\"Security\",\"Firewall\",\"V seznamu v\u00fdjimek br\u00e1ny Windows Firewall bylo zm\u011bn\u011bno pravidlo\",\"Bylo zm\u011bn\u011bno existuj\u00edc\u00ed pravidlo firewallu.\",\"warn\",[\"Legitimn\u00ed lad\u011bn\u00ed pravidla\",\"\u00daprava umo\u017e\u0148uj\u00edc\u00ed \u0161kodliv\u00fd provoz\"],\"\u00daprava existuj\u00edc\u00edho d\u016fv\u011bryhodn\u00e9ho pravidla tak, aby povolovalo \u0161ir\u0161\u00ed provoz, je nen\u00e1padn\u011bj\u0161\u00ed zp\u016fsob otev\u0159en\u00ed p\u0159\u00edstupu ne\u017e vytvo\u0159en\u00ed zjevn\u011b nov\u00e9ho pravidla.\"],\n[4948,\"Security\",\"Firewall\",\"Ze seznamu v\u00fdjimek br\u00e1ny Windows Firewall bylo smaz\u00e1no pravidlo\",\"Pravidlo firewallu bylo odstran\u011bno.\",\"warn\",[\"Legitimn\u00ed \u00faklid\",\"Odstran\u011bn\u00ed blokuj\u00edc\u00edho pravidla za \u00fa\u010delem propu\u0161t\u011bn\u00ed \u0161kodliv\u00e9ho provozu\"],\"Odstran\u011bn\u00ed pravidla, kter\u00e9 blokovalo provoz, m\u016f\u017ee uvolnit cestu pro \u0161kodlivou s\u00ed\u0165ovou aktivitu.\"],\n[4950,\"Security\",\"Firewall\",\"Bylo zm\u011bn\u011bno nastaven\u00ed br\u00e1ny Windows Firewall\",\"Bylo upraveno nastaven\u00ed firewallov\u00e9ho profilu (nikoli konkr\u00e9tn\u00ed pravidlo).\",\"warn\",[\"Legitimn\u00ed zm\u011bna konfigurace\",\"Oslaben\u00ed \u00farovn\u011b ochrany firewallu\"],\"\u00dapln\u00e9 vypnut\u00ed firewallov\u00e9ho profilu nebo uvoln\u011bn\u00ed v\u00fdchoz\u00edho blokuj\u00edc\u00edho chov\u00e1n\u00ed odstra\u0148uje jednu vrstvu s\u00ed\u0165ov\u00e9 obrany na dan\u00e9m stroji.\"],\n[4954,\"Security\",\"Firewall\",\"Byla zm\u011bn\u011bna nastaven\u00ed Group Policy pro Windows Firewall\",\"Byla zm\u011bn\u011bna z\u00e1sada firewallu \u0159\u00edzen\u00e1 GPO pro dan\u00fd stroj.\",\"warn\",[\"Pl\u00e1novan\u00e1 aktualizace GPO\",\"Neopr\u00e1vn\u011bn\u00e1 zm\u011bna z\u00e1sad ru\u0161\u00edc\u00ed ochranu firewallu\"],\"Zm\u011bna na \u00farovni GPO ovlivn\u00ed najednou v\u0161echny po\u010d\u00edta\u010de ve sv\u00e9m rozsahu, tak\u017ee neautorizovan\u00e9 zm\u011bny zde maj\u00ed mnohem v\u011bt\u0161\u00ed dopad ne\u017e zm\u011bna pravidla na jednom stroji.\"],\n[400,\"PowerShell\",\"PowerShell\",\"Byla spu\u0161t\u011bna nov\u00e1 relace PowerShell enginu\",\"Ozna\u010duje za\u010d\u00e1tek hostitelsk\u00e9 relace PowerShellu (konzole, ISE nebo skript volaj\u00edc\u00ed engine).\",\"info\",[\"B\u011b\u017en\u00e1 administrativn\u00ed nebo skriptovan\u00e1 aktivita\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; PowerShell se neust\u00e1le pou\u017e\u00edv\u00e1 k legitimn\u00ed spr\u00e1v\u011b, tak\u017ee tato ud\u00e1lost hlavn\u011b poskytuje kontext relace pro cenn\u011bj\u0161\u00ed ud\u00e1losti 4103\/4104.\"],\n[403,\"PowerShell\",\"PowerShell\",\"Relace PowerShell enginu byla ukon\u010dena\",\"Ozna\u010duje konec hostitelsk\u00e9 relace PowerShellu.\",\"info\",[\"B\u011b\u017en\u00e9 dokon\u010den\u00ed relace\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[4103,\"PowerShell\",\"PowerShell\",\"Logov\u00e1n\u00ed modul\u016f PowerShell zaznamenalo spu\u0161t\u011bn\u00ed pipeline\",\"Zachycuje parametry a detaily proveden\u00ed pipeline pro cmdlety v logovan\u00fdch modulech.\",\"warn\",[\"B\u011b\u017en\u00e1 administrace p\u0159es PowerShell\",\"\u0160kodliv\u00e1 aktivita v PowerShellu vyu\u017e\u00edvaj\u00edc\u00ed logovan\u00e9 moduly\"],\"U\u017eite\u010dn\u00e9 pro rekonstrukci toho, jak\u00e9 cmdlety a parametry byly b\u011bhem relace pou\u017eity, v\u010detn\u011b t\u011bch spojen\u00fdch s p\u0159\u00edstupem k p\u0159ihla\u0161ovac\u00edm \u00fadaj\u016fm, pr\u016fzkumem prost\u0159ed\u00ed nebo later\u00e1ln\u00edm pohybem.\"],\n[4104,\"PowerShell\",\"PowerShell\",\"Logov\u00e1n\u00ed blok\u016f skript\u016f PowerShell zachytilo spu\u0161t\u011bn\u00fd k\u00f3d\",\"Zaznamen\u00e1v\u00e1 skute\u010dn\u00fd, deobfuskovan\u00fd obsah skriptu, kter\u00fd PowerShell spustil \u2013 jedna z v\u016fbec nejcenn\u011bj\u0161\u00edch ud\u00e1lost\u00ed pro odhalen\u00ed \u0161kodliv\u00e9ho nebo zamaskovan\u00e9ho PowerShellu, v\u010detn\u011b bezsouborov\u00e9ho malwaru.\",\"crit\",[\"Legitimn\u00ed skripty a automatizace\",\"Zamaskovan\u00fd nebo \u0161kodliv\u00fd PowerShell payload\"],\"Proto\u017ee se loguje skute\u010dn\u00fd, deobfuskovan\u00fd obsah skriptu, tato ud\u00e1lost obch\u00e1z\u00ed v\u011bt\u0161inu obfuska\u010dn\u00edch a k\u00f3dovac\u00edch trik\u016f pou\u017e\u00edvan\u00fdch k zamaskov\u00e1n\u00ed \u0161kodliv\u00e9ho PowerShellu \u2013 \u010dasto jde o v\u016fbec neju\u017eite\u010dn\u011bj\u0161\u00ed ud\u00e1lost pro identifikaci bezsouborov\u00e9ho malwaru a \u00fato\u010dn\u00fdch PowerShell framework\u016f.\"],\n[4105,\"PowerShell\",\"PowerShell\",\"Byl spu\u0161t\u011bn p\u0159\u00edkaz PowerShell\",\"Ozna\u010duje za\u010d\u00e1tek prov\u00e1d\u011bn\u00ed konkr\u00e9tn\u00edho p\u0159\u00edkazu v r\u00e1mci logovan\u00e9 relace.\",\"info\",[\"B\u011b\u017en\u00e9 spu\u0161t\u011bn\u00ed p\u0159\u00edkazu\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; podp\u016frn\u00fd detail pro \u010dasov\u00e9 osy na \u00farovni p\u0159\u00edkaz\u016f.\"],\n[4106,\"PowerShell\",\"PowerShell\",\"P\u0159\u00edkaz PowerShell byl dokon\u010den\",\"Ozna\u010duje konec prov\u00e1d\u011bn\u00ed konkr\u00e9tn\u00edho p\u0159\u00edkazu.\",\"info\",[\"B\u011b\u017en\u00e9 spu\u0161t\u011bn\u00ed p\u0159\u00edkazu\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[6005,\"System\",\"Spou\u0161t\u011bn\u00ed a vyp\u00edn\u00e1n\u00ed\",\"Slu\u017eba Event Log byla spu\u0161t\u011bna\",\"Zaznamen\u00e1v\u00e1 se p\u0159i ka\u017ed\u00e9m spu\u0161t\u011bn\u00ed syst\u00e9mu, proto\u017ee slu\u017eba Event Log pat\u0159\u00ed mezi prvn\u00ed spou\u0161t\u011bn\u00e9 slu\u017eby. Spolehliv\u00fd ukazatel toho, \u017ee syst\u00e9m nab\u011bhl.\",\"info\",[\"B\u011b\u017en\u00e9 spu\u0161t\u011bn\u00ed syst\u00e9mu\"],\"N\u00edzk\u00fd bezpe\u010dnostn\u00ed v\u00fdznam; poskytuje spolehliv\u00fd ukazatel 'syst\u00e9m nab\u011bhl' u\u017eite\u010dn\u00fd pro rekonstrukci \u010dasov\u00e9 osy.\"],\n[6006,\"System\",\"Spou\u0161t\u011bn\u00ed a vyp\u00edn\u00e1n\u00ed\",\"Slu\u017eba Event Log byla zastavena\",\"Zaznamen\u00e1v\u00e1 se p\u0159i \u010dist\u00e9m, \u0159\u00e1dn\u00e9m vypnut\u00ed nebo restartu syst\u00e9mu.\",\"info\",[\"B\u011b\u017en\u00e9 vypnut\u00ed nebo restart syst\u00e9mu\"],\"Neo\u010dek\u00e1van\u00e1 ud\u00e1lost 6006 mimo b\u011b\u017en\u00e9 okno vypnut\u00ed\/restartu m\u016f\u017ee znamenat pokus o p\u0159eru\u0161en\u00ed logov\u00e1n\u00ed, i kdy\u017e norm\u00e1ln\u00ed vypnut\u00ed je mnohem \u010dast\u011bj\u0161\u00ed p\u0159\u00ed\u010dinou.\"],\n[6008,\"System\",\"Spou\u0161t\u011bn\u00ed a vyp\u00edn\u00e1n\u00ed\",\"P\u0159edchoz\u00ed vypnut\u00ed syst\u00e9mu bylo neo\u010dek\u00e1van\u00e9\",\"Windows p\u0159i startu zjistily, \u017ee p\u0159edchoz\u00ed vypnut\u00ed nebylo \u010dist\u00e9 \u2013 nep\u0159edch\u00e1zela mu odpov\u00eddaj\u00edc\u00ed ud\u00e1lost 6006. \u010casto se objevuje spolu s Kernel-Power ud\u00e1lost\u00ed 41.\",\"warn\",[\"V\u00fdpadek nap\u00e1jen\u00ed\",\"Zamrznut\u00ed syst\u00e9mu nebo p\u00e1d\",\"Podr\u017een\u00ed tla\u010d\u00edtka nap\u00e1jen\u00ed\"],\"Obvykle jde o probl\u00e9m s hardwarem nebo nap\u00e1jen\u00edm, ale na serveru m\u016f\u017ee j\u00edt i o p\u00e1d zp\u016fsoben\u00fd pokusem o zneu\u017eit\u00ed zranitelnosti nebo nestabiln\u00edm malwarem; stoj\u00ed za to porovnat s p\u0159\u00edpadn\u00fdmi ud\u00e1lostmi 1001 (Bug Check) ve stejn\u00e9m \u010dase.\"],\n[6013,\"System\",\"Spou\u0161t\u011bn\u00ed a vyp\u00edn\u00e1n\u00ed\",\"Byla zaznamen\u00e1na doba b\u011bhu syst\u00e9mu\",\"Periodick\u00e1 informativn\u00ed ud\u00e1lost oznamuj\u00edc\u00ed, jak dlouho je syst\u00e9m spu\u0161t\u011bn.\",\"info\",[\"Rutinn\u00ed hl\u00e1\u0161en\u00ed doby b\u011bhu\"],\"N\u00edzk\u00fd bezpe\u010dnostn\u00ed v\u00fdznam.\"],\n[41,\"System\",\"Spou\u0161t\u011bn\u00ed a vyp\u00edn\u00e1n\u00ed\",\"Syst\u00e9m se restartoval bez \u010dist\u00e9ho vypnut\u00ed (Kernel-Power)\",\"Zaznamen\u00e1v\u00e1 ho poskytovatel kernel power, kdy\u017e se syst\u00e9m restartuje bez prob\u011bhnut\u00ed norm\u00e1ln\u00ed sekvence vypnut\u00ed \u2013 klasick\u00fd indik\u00e1tor '\u0161pinav\u00e9ho restartu', \u010dasto se objevuj\u00edc\u00ed spolu s ud\u00e1lost\u00ed 6008.\",\"warn\",[\"V\u00fdpadek nap\u00e1jec\u00edho zdroje nebo elekt\u0159iny\",\"P\u00e1d syst\u00e9mu nebo tvrd\u00e9 zamrznut\u00ed\",\"Ru\u010dn\u00ed tvrd\u00fd restart\"],\"Stejn\u00e9 \u00favahy jako u 6008 \u2013 jde hlavn\u011b o sign\u00e1l spolehlivosti hardwaru\/nap\u00e1jen\u00ed, ale stoj\u00ed za kontrolu, zda se vzorec p\u00e1d\u016f neshoduje s jinou podez\u0159elou aktivitou.\"],\n[1074,\"System\",\"Spou\u0161t\u011bn\u00ed a vyp\u00edn\u00e1n\u00ed\",\"Vypnut\u00ed nebo restart byl iniciov\u00e1n u\u017eivatelem nebo aplikac\u00ed\",\"Zaznamen\u00e1v\u00e1, kdo nebo co po\u017e\u00e1dalo o vypnut\u00ed\/restart a uveden\u00fd d\u016fvod, pokud byl zad\u00e1n (nap\u0159. Windows Update, akce u\u017eivatele nebo vzd\u00e1len\u00fd po\u017eadavek).\",\"info\",[\"Pl\u00e1novan\u00fd restart kv\u016fli \u00fadr\u017eb\u011b nebo aktualizac\u00edm\",\"Restart iniciovan\u00fd u\u017eivatelem\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; neo\u010dek\u00e1van\u00fd restart mimo servisn\u00ed okno stoj\u00ed za ov\u011b\u0159en\u00ed, kdo nebo co ho vyvolal.\"],\n[1076,\"System\",\"Spou\u0161t\u011bn\u00ed a vyp\u00edn\u00e1n\u00ed\",\"Byl zaznamen\u00e1n d\u016fvod p\u0159edchoz\u00edho neo\u010dek\u00e1van\u00e9ho vypnut\u00ed\",\"Umo\u017e\u0148uje u\u017eivateli nebo procesu dodate\u010dn\u011b doplnit\/potvrdit k\u00f3d d\u016fvodu pro d\u0159\u00edv\u011bj\u0161\u00ed ne\u010dist\u00e9 vypnut\u00ed.\",\"info\",[\"N\u00e1sledn\u00e9 zdokumentov\u00e1n\u00ed po neo\u010dek\u00e1van\u00e9m vypnut\u00ed\"],\"N\u00edzk\u00fd bezpe\u010dnostn\u00ed v\u00fdznam; dokumenta\u010dn\u00ed ud\u00e1lost.\"],\n[109,\"System\",\"Spou\u0161t\u011bn\u00ed a vyp\u00edn\u00e1n\u00ed\",\"Do\u0161lo ke zm\u011bn\u011b stavu nap\u00e1jen\u00ed syst\u00e9mu\",\"Zaznamen\u00e1v\u00e1 se v souvislosti se sp\u00e1nkem, hibernac\u00ed, obnoven\u00edm nebo podobn\u00fdmi zm\u011bnami stavu nap\u00e1jen\u00ed \u0159\u00edzen\u00fdmi j\u00e1drem.\",\"info\",[\"B\u011b\u017en\u00fd cyklus sp\u00e1nku\/probuzen\u00ed na notebooc\u00edch a pracovn\u00edch stanic\u00edch\"],\"N\u00edzk\u00fd bezpe\u010dnostn\u00ed v\u00fdznam.\"],\n[1001,\"System\",\"Spou\u0161t\u011bn\u00ed a vyp\u00edn\u00e1n\u00ed\",\"Byla zaznamen\u00e1na chyba Bug Check (chyba Stop \/ BSOD)\",\"Zachycuje k\u00f3d zastaven\u00ed a parametry po p\u00e1du na \u00farovni j\u00e1dra, je\u0161t\u011b p\u0159ed n\u00e1sledn\u00fdm restartem.\",\"crit\",[\"Vadn\u00fd nebo nekompatibiln\u00ed ovlada\u010d\",\"Selh\u00e1vaj\u00edc\u00ed hardware (RAM, \u00falo\u017ei\u0161t\u011b, GPU)\",\"Chyba softwaru na \u00farovni j\u00e1dra\"],\"V\u011bt\u0161ina p\u00e1d\u016f jsou chyby ovlada\u010d\u016f nebo hardwaru, ale n\u011bkter\u00e9 ve\u0159ejn\u011b zn\u00e1m\u00e9 exploity (zejm\u00e9na zranitelnosti na \u00farovni j\u00e1dra) se projevuj\u00ed p\u00e1dem b\u011bhem pokusu o zneu\u017eit\u00ed, tak\u017ee opakuj\u00edc\u00ed se vzorec p\u00e1d\u016f na stejn\u00e9m stroji nebo ovlada\u010di stoj\u00ed za bli\u017e\u0161\u00ed prov\u011b\u0159en\u00ed.\"],\n[7000,\"System\",\"Slu\u017eby\",\"Slu\u017ebu se nepoda\u0159ilo spustit kv\u016fli selh\u00e1n\u00ed p\u0159ihl\u00e1\u0161en\u00ed\",\"Slu\u017eba se nepoda\u0159ilo spustit, proto\u017ee se \u00fa\u010det, pod kter\u00fdm b\u011b\u017e\u00ed, nepoda\u0159ilo autentizovat.\",\"warn\",[\"Vypr\u0161el\u00e9 nebo zm\u011bn\u011bn\u00e9 heslo servisn\u00edho \u00fa\u010dtu\",\"\u0160patn\u011b nakonfigurovan\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje slu\u017eby\"],\"M\u016f\u017ee j\u00edt o legitimn\u00ed probl\u00e9m s p\u0159ihla\u0161ovac\u00edmi \u00fadaji \u010di heslem, ale stejn\u011b by to vypadalo, kdyby malware zas\u00e1hl do p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f servisn\u00edho \u00fa\u010dtu, nebo kdyby byl servisn\u00ed \u00fa\u010det bezpe\u010dnostn\u00edho produktu z\u00e1m\u011brn\u011b sabotov\u00e1n.\"],\n[7001,\"System\",\"Slu\u017eby\",\"Slu\u017ebu se nepoda\u0159ilo spustit kv\u016fli selh\u00e1n\u00ed z\u00e1visl\u00e9 slu\u017eby\",\"Po\u017eadovan\u00e1 z\u00e1visl\u00e1 slu\u017eba neb\u011b\u017eela, tak\u017ee se ani tato slu\u017eba nemohla spustit.\",\"warn\",[\"Zak\u00e1zan\u00e1 nebo zhavarovan\u00e1 p\u0159edpokladov\u00e1 slu\u017eba\",\"\u0160patn\u00e9 nastaven\u00ed po\u0159ad\u00ed spou\u0161t\u011bn\u00ed \/ z\u00e1vislost\u00ed\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b, ale pokud jde o bezpe\u010dnostn\u011b relevantn\u00ed slu\u017ebu (nap\u0159. antivirus), jej\u00ed\u017e spu\u0161t\u011bn\u00ed zablokovala zak\u00e1zan\u00e1 z\u00e1vislost, stoj\u00ed to za prov\u011b\u0159en\u00ed.\"],\n[7009,\"System\",\"Slu\u017eby\",\"Slu\u017eba v\u010das neodpov\u011bd\u011bla (timeout p\u0159i spou\u0161t\u011bn\u00ed)\",\"Service Control Manager p\u0159estal \u010dekat, a\u017e slu\u017eba ozn\u00e1m\u00ed, \u017ee se spustila.\",\"warn\",[\"Pomalu startuj\u00edc\u00ed slu\u017eba p\u0159i vysok\u00e9 z\u00e1t\u011b\u017ei\",\"Zaseknut\u00e1 nebo mrtv\u011b uv\u00edzl\u00e1 slu\u017eba\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[7011,\"System\",\"Slu\u017eby\",\"Vypr\u0161el \u010dasov\u00fd limit p\u0159i \u010dek\u00e1n\u00ed na odpov\u011b\u010f transakce od slu\u017eby\",\"SCM odeslal \u0159\u00eddic\u00ed po\u017eadavek (nap\u0159. zastaven\u00ed) a nedostal v\u010dasnou odpov\u011b\u010f.\",\"warn\",[\"Neodpov\u00eddaj\u00edc\u00ed nebo p\u0159et\u00ed\u017een\u00e1 slu\u017eba\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[7022,\"System\",\"Slu\u017eby\",\"Slu\u017eba zamrzla p\u0159i spou\u0161t\u011bn\u00ed\",\"Proces spou\u0161t\u011bn\u00ed slu\u017eby se nekone\u010dn\u011b zasekl.\",\"warn\",[\"Deadlock nebo konflikt o zdroje b\u011bhem inicializace\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b, i kdy\u017e opakuj\u00edc\u00ed se zaseknut\u00ed u bezpe\u010dnostn\u011b relevantn\u00ed slu\u017eby stoj\u00ed za pro\u0161et\u0159en\u00ed.\"],\n[7023,\"System\",\"Slu\u017eby\",\"Slu\u017eba skon\u010dila s chybou\",\"Slu\u017eba se zastavila a vr\u00e1tila k\u00f3d chyby Windows.\",\"warn\",[\"Chyba nebo neo\u0161et\u0159en\u00e1 v\u00fdjimka ve slu\u017eb\u011b\",\"Chyb\u011bj\u00edc\u00ed soubory nebo \u0161patn\u00e1 konfigurace\"],\"Stoj\u00ed za prov\u011b\u0159en\u00ed, pokud je dot\u010den\u00e1 slu\u017eba bezpe\u010dnostn\u011b relevantn\u00ed (antivirus, EDR agent, log forwarder), proto\u017ee jej\u00ed nedostupnost vytv\u00e1\u0159\u00ed mezeru v monitoringu.\"],\n[7024,\"System\",\"Slu\u017eby\",\"Slu\u017eba skon\u010dila se specifickou chybou slu\u017eby\",\"Slu\u017eba se zastavila a vr\u00e1tila k\u00f3d chyby definovan\u00fd samotnou slu\u017ebou, nikoli obecnou chybou Windows.\",\"warn\",[\"Aplika\u010dn\u011b specifick\u00e1 chybov\u00e1 podm\u00ednka\"],\"Stejn\u00e1 \u00favaha jako u 7023 \u2013 ov\u011b\u0159te, zda dot\u010den\u00e1 slu\u017eba nen\u00ed sou\u010d\u00e1st\u00ed va\u0161\u00ed bezpe\u010dnostn\u00ed infrastruktury.\"],\n[7026,\"System\",\"Slu\u017eby\",\"Ovlada\u010de spou\u0161t\u011bn\u00e9 p\u0159i zav\u00e1d\u011bn\u00ed syst\u00e9mu nebo syst\u00e9mov\u00e9m startu se nepoda\u0159ilo na\u010d\u00edst\",\"Jeden nebo v\u00edce n\u00edzko\u00farov\u0148ov\u00fdch ovlada\u010d\u016f vy\u017eadovan\u00fdch p\u0159i startu se nena\u010detl.\",\"warn\",[\"Po\u0161kozen\u00fd nebo chyb\u011bj\u00edc\u00ed ovlada\u010d\",\"Ovlada\u010d zak\u00e1zan\u00fd nebo nekompatibiln\u00ed s aktu\u00e1ln\u00ed verz\u00ed syst\u00e9mu\"],\"Pokud dot\u010den\u00fd ovlada\u010d pat\u0159\u00ed k bezpe\u010dnostn\u00edmu softwaru (antivirus, EDR, \u0161ifrov\u00e1n\u00ed disku), jeho nena\u010dten\u00ed m\u016f\u017ee nechat koncov\u00e9 za\u0159\u00edzen\u00ed nechr\u00e1n\u011bn\u00e9 hned od startu.\"],\n[7031,\"System\",\"Slu\u017eby\",\"Slu\u017eba neo\u010dek\u00e1van\u011b skon\u010dila a byla provedena zotavovac\u00ed akce\",\"Slu\u017eba spadla a Windows provedly nakonfigurovanou zotavovac\u00ed akci (nap\u0159. automatick\u00fd restart).\",\"warn\",[\"Softwarov\u00e1 chyba zp\u016fsobuj\u00edc\u00ed p\u00e1d\",\"Vy\u010derp\u00e1n\u00ed zdroj\u016f\"],\"Opakovan\u00e9 p\u00e1dy stejn\u00e9 slu\u017eby, zejm\u00e9na bezpe\u010dnostn\u00edho n\u00e1stroje, mohou znamenat z\u00e1m\u011brn\u00e9 zasahov\u00e1n\u00ed (nap\u0159. malware, kter\u00fd shazuje proces antiviru), sp\u00ed\u0161e ne\u017e oby\u010dejnou chybu.\"],\n[7034,\"System\",\"Slu\u017eby\",\"Slu\u017eba neo\u010dek\u00e1van\u011b skon\u010dila\",\"Proces slu\u017eby spadl bez varov\u00e1n\u00ed; ud\u00e1lost obvykle obsahuje po\u010det ned\u00e1vn\u00fdch p\u00e1d\u016f dan\u00e9 slu\u017eby.\",\"warn\",[\"Chyba nebo neo\u0161et\u0159en\u00e1 v\u00fdjimka ve slu\u017eb\u011b\",\"Malware zasahuj\u00edc\u00ed do legitimn\u00ed slu\u017eby\"],\"Havaruj\u00edc\u00ed bezpe\u010dnostn\u00ed nebo logovac\u00ed slu\u017eba je zn\u00e1m\u00e1 technika, jak \u00fato\u010dn\u00edk vy\u0159ad\u00ed obranu; p\u0159i hodnocen\u00ed z\u00e1le\u017e\u00ed jak na frekvenci, tak na tom, o jakou slu\u017ebu \u0161lo.\"],\n[7035,\"System\",\"Slu\u017eby\",\"\u0158\u00eddic\u00ed p\u0159\u00edkaz start\/stop byl \u00fasp\u011b\u0161n\u011b odesl\u00e1n slu\u017eb\u011b\",\"Potvrzuje, \u017ee Service Control Manager \u00fasp\u011b\u0161n\u011b doru\u010dil po\u017eadavek na spu\u0161t\u011bn\u00ed nebo zastaven\u00ed; nepotvrzuje, \u017ee slu\u017eba dokon\u010dila start\/zastaven\u00ed.\",\"info\",[\"B\u011b\u017en\u00e1 spr\u00e1va slu\u017eeb\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b, i kdy\u017e neo\u010dek\u00e1van\u00fd po\u017eadavek na zastaven\u00ed odeslan\u00fd bezpe\u010dnostn\u00ed slu\u017eb\u011b stoj\u00ed za pro\u0161et\u0159en\u00ed.\"],\n[7036,\"System\",\"Slu\u017eby\",\"Slu\u017eba p\u0159e\u0161la do stavu spu\u0161t\u011bno nebo zastaveno\",\"Jedna z nejobjemn\u011bj\u0161\u00edch ud\u00e1lost\u00ed v logu System \u2013 zaznamen\u00e1v\u00e1 se p\u0159i ka\u017ed\u00e9m p\u0159echodu stavu jak\u00e9koli slu\u017eby. U\u017eite\u010dn\u00e1 jako v\u00fdchoz\u00ed z\u00e1kladna, m\u00e9n\u011b u\u017eite\u010dn\u00e1 izolovan\u011b.\",\"info\",[\"B\u011b\u017en\u00e1 aktivita \u017eivotn\u00edho cyklu slu\u017eby\"],\"Velmi vysok\u00fd objem a n\u00edzk\u00fd sign\u00e1l samo o sob\u011b, ale z\u00e1sadn\u00ed pro potvrzen\u00ed, zda nebyla neo\u010dek\u00e1van\u011b zastavena bezpe\u010dnostn\u011b relevantn\u00ed slu\u017eba (antivirus, log forwarder, EDR agent).\"],\n[7040,\"System\",\"Slu\u017eby\",\"Byl zm\u011bn\u011bn typ spu\u0161t\u011bn\u00ed slu\u017eby\",\"Byl upraven nakonfigurovan\u00fd typ spu\u0161t\u011bn\u00ed slu\u017eby (Automaticky, Ru\u010dn\u011b, Zak\u00e1z\u00e1no).\",\"warn\",[\"Legitimn\u00ed zm\u011bna konfigurace slu\u017eby\",\"\u00dato\u010dn\u00edk vyp\u00edn\u00e1 bezpe\u010dnostn\u00ed software nebo znovu povoluje sp\u00edc\u00ed zadn\u00ed slu\u017ebu\"],\"Nastaven\u00ed typu spu\u0161t\u011bn\u00ed bezpe\u010dnostn\u00ed slu\u017eby na Zak\u00e1z\u00e1no, nebo zm\u011bna sp\u00edc\u00ed\/zadn\u00ed slu\u017eby na Automaticky, je b\u011b\u017en\u00e1 technika oslaben\u00ed obrany nebo zaji\u0161t\u011bn\u00ed, \u017ee perzistence p\u0159e\u017eije restart.\"],\n[7045,\"System\",\"Slu\u017eby\",\"Do syst\u00e9mu byla nainstalov\u00e1na nov\u00e1 slu\u017eba\",\"Spou\u0161t\u00ed se poka\u017ed\u00e9, kdy\u017e je zaregistrov\u00e1na nov\u00e1 slu\u017eba, a\u0165 u\u017e instal\u00e1torem, administr\u00e1torem, nebo malwarem. Velmi \u010dast\u00fd indik\u00e1tor perzistence a later\u00e1ln\u00edho pohybu, jedna z nejcenn\u011bj\u0161\u00edch ud\u00e1lost\u00ed logu System k alertov\u00e1n\u00ed.\",\"crit\",[\"Legitimn\u00ed instalace softwaru\",\"Mechanismus perzistence nainstalovan\u00fd \u00fato\u010dn\u00edkem\"],\"Jedna z nejcenn\u011bj\u0161\u00edch ud\u00e1lost\u00ed logu System pro odhalen\u00ed perzistence a later\u00e1ln\u00edho pohybu \u2013 n\u00e1stroje jako PsExec a mnoho post-exploita\u010dn\u00edch framework\u016f instaluj\u00ed slu\u017ebu pro vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du, a tato ud\u00e1lost se spust\u00ed poka\u017ed\u00e9 bez ohledu na to, zda \u0161lo o ne\u0161kodnou, nebo \u0161kodlivou instalaci.\"],\n[51,\"System\",\"Disk a hardware\",\"Do\u0161lo k chyb\u011b z\u00e1pisu na disk\",\"Ovlada\u010d disku ohl\u00e1sil selh\u00e1n\u00ed dokon\u010den\u00ed operace z\u00e1pisu.\",\"warn\",[\"Selh\u00e1vaj\u00edc\u00ed nebo degradovan\u00fd diskov\u00fd hardware\",\"Probl\u00e9my s kabel\u00e1\u017e\u00ed\/p\u0159ipojen\u00edm (u fyzick\u00fdch disk\u016f)\"],\"P\u0159edev\u0161\u00edm sign\u00e1l spolehlivosti; selh\u00e1vaj\u00edc\u00ed \u00falo\u017ei\u0161t\u011b m\u016f\u017ee zp\u016fsobit i ztr\u00e1tu dat, co\u017e komplikuje reakci na incident, pokud postihne uchov\u00e1v\u00e1n\u00ed log\u016f nebo d\u016fkaz\u016f.\"],\n[7,\"System\",\"Disk a hardware\",\"Za\u0159\u00edzen\u00ed nen\u00ed p\u0159ipraveno pro p\u0159\u00edstup\",\"\u010casn\u00fd projev toho, \u017ee \u00falo\u017en\u00e9 za\u0159\u00edzen\u00ed \u0159\u00e1dn\u011b nereaguje na I\/O po\u017eadavky.\",\"warn\",[\"Bl\u00ed\u017e\u00edc\u00ed se selh\u00e1n\u00ed disku\",\"Vym\u011bniteln\u00e9 m\u00e9dium nen\u00ed spr\u00e1vn\u011b vlo\u017eeno\/p\u0159ipojeno\"],\"P\u0159edev\u0161\u00edm sign\u00e1l spolehlivosti, i kdy\u017e n\u00e1hl\u00fd vzorec nap\u0159\u00ed\u010d mnoha za\u0159\u00edzen\u00edmi m\u016f\u017ee znamenat \u0161ir\u0161\u00ed probl\u00e9m s \u00falo\u017ei\u0161t\u011bm nebo konektivitou sp\u00ed\u0161e ne\u017e selh\u00e1n\u00ed jedin\u00e9ho disku.\"],\n[11,\"System\",\"Disk a hardware\",\"Ovlada\u010d zjistil chybu \u0159adi\u010de na za\u0159\u00edzen\u00ed\",\"\u0158adi\u010d \u00falo\u017ei\u0161t\u011b nebo za\u0159\u00edzen\u00ed ohl\u00e1sil chybu p\u0159i operaci.\",\"warn\",[\"Selh\u00e1vaj\u00edc\u00ed hardware\",\"Chyba ovlada\u010de nebo firmwaru\"],\"P\u0159edev\u0161\u00edm sign\u00e1l spolehlivosti pro probl\u00e9my s hardwarem\/ovlada\u010di.\"],\n[55,\"System\",\"Disk a hardware\",\"Bylo zji\u0161t\u011bno po\u0161kozen\u00ed souborov\u00e9ho syst\u00e9mu\",\"NTFS nebo ovlada\u010d souborov\u00e9ho syst\u00e9mu ohl\u00e1sil nekonzistenci na svazku, co\u017e \u010dasto vyvol\u00e1 kontrolu chkdsk p\u0159i dal\u0161\u00edm startu.\",\"crit\",[\"Ne\u010dist\u00e9 vypnut\u00ed uprost\u0159ed z\u00e1pisu\",\"Selh\u00e1vaj\u00edc\u00ed diskov\u00fd hardware\",\"Chyba souborov\u00e9ho syst\u00e9mu\"],\"Obvykle jde o probl\u00e9m spolehlivosti z ne\u010dist\u00e9ho vypnut\u00ed nebo selh\u00e1vaj\u00edc\u00edho disku, ale m\u016f\u017ee j\u00edt i o d\u016fsledek manipulace nebo p\u00e1du vyvolan\u00e9ho b\u011bhem \u00fatoku; porovnejte s ned\u00e1vn\u00fdmi neo\u010dek\u00e1van\u00fdmi vypnut\u00edmi nebo p\u00e1dy.\"],\n[129,\"System\",\"Disk a hardware\",\"\u00dalo\u017en\u00e9 za\u0159\u00edzen\u00ed neodpov\u011bd\u011blo v r\u00e1mci \u010dasov\u00e9ho limitu\",\"Adapt\u00e9r \u00falo\u017ei\u0161t\u011b resetoval za\u0159\u00edzen\u00ed pot\u00e9, co dostate\u010dn\u011b rychle nereagovalo.\",\"warn\",[\"P\u0159et\u00ed\u017een\u00e9 nebo selh\u00e1vaj\u00edc\u00ed \u00falo\u017ei\u0161t\u011b (b\u011b\u017en\u00e9 v prost\u0159ed\u00ed SAN\/iSCSI)\",\"Probl\u00e9my s firmwarem nebo ovlada\u010dem\"],\"P\u0159edev\u0161\u00edm v\u00fdkonnostn\u00ed\/spolehlivostn\u00ed sign\u00e1l pro infrastrukturu \u00falo\u017ei\u0161t\u011b.\"],\n[153,\"System\",\"Disk a hardware\",\"I\/O operace byly opakov\u00e1ny kv\u016fli pomal\u00e9 odezv\u011b za\u0159\u00edzen\u00ed\",\"Vrstva \u00falo\u017ei\u0161t\u011b opakovala po\u017eadavky, proto\u017ee za\u0159\u00edzen\u00ed reagovalo pomaleji, ne\u017e se o\u010dek\u00e1valo \u2013 sp\u00ed\u0161e \u010dasn\u00e9 varov\u00e1n\u00ed ne\u017e p\u0159\u00edm\u00e9 selh\u00e1n\u00ed.\",\"warn\",[\"Latence \u00falo\u017ei\u0161t\u011b pod z\u00e1t\u011b\u017e\u00ed\",\"\u010casn\u00fd indik\u00e1tor selh\u00e1vaj\u00edc\u00edho disku nebo p\u0159et\u00ed\u017een\u00e9ho SAN\"],\"P\u0159edev\u0161\u00edm v\u00fdkonnostn\u00ed sign\u00e1l; opakuj\u00edc\u00ed se retry jsou \u010dasn\u00e9 varov\u00e1n\u00ed p\u0159ed probl\u00e9mem s \u00falo\u017ei\u0161t\u011bm, kter\u00fd stoj\u00ed za \u0159e\u0161en\u00ed d\u0159\u00edv, ne\u017e se stane v\u00fdpadkem.\"],\n[219,\"System\",\"Disk a hardware\",\"Ovlada\u010d za\u0159\u00edzen\u00ed se nepoda\u0159ilo na\u010d\u00edst\",\"Windows se nepoda\u0159ilo na\u010d\u00edst ovlada\u010d p\u0159i\u0159azen\u00fd p\u0159ipojen\u00e9mu za\u0159\u00edzen\u00ed.\",\"warn\",[\"Chyb\u011bj\u00edc\u00ed, po\u0161kozen\u00fd nebo nekompatibiln\u00ed ovlada\u010d\"],\"Pokud je dot\u010den\u00e9 za\u0159\u00edzen\u00ed nebo ovlada\u010d sou\u010d\u00e1st\u00ed bezpe\u010dnostn\u00ed kontroly, jeho absence m\u016f\u017ee vytvo\u0159it mezeru v monitoringu nebo ochran\u011b.\"],\n[20,\"System\",\"S\u00ed\u0165\",\"DNS klientovi se nepoda\u0159ilo dynamicky zaregistrovat z\u00e1znam\",\"Stroj nemohl u nakonfigurovan\u00e9ho DNS serveru zaregistrovat nebo aktualizovat sv\u016fj DNS z\u00e1znam.\",\"warn\",[\"Nedostupn\u00fd nebo \u0161patn\u011b nakonfigurovan\u00fd DNS server\",\"Probl\u00e9m s opr\u00e1vn\u011bn\u00edm pro dynamick\u00e9 aktualizace\"],\"P\u0159edev\u0161\u00edm provozn\u00ed probl\u00e9m, i kdy\u017e m\u016f\u017ee j\u00edt i o \u00fato\u010dn\u00edka blokuj\u00edc\u00edho nebo naru\u0161uj\u00edc\u00edho dynamick\u00e9 DNS aktualizace za \u00fa\u010delem p\u0159esm\u011brov\u00e1n\u00ed provozu.\"],\n[1014,\"System\",\"S\u00ed\u0165\",\"DNS klientovi se nepoda\u0159ilo p\u0159elo\u017eit n\u00e1zev\",\"DNS dotaz selhal pot\u00e9, co se klient obr\u00e1til na nakonfigurovan\u00e9 DNS servery.\",\"warn\",[\"V\u00fdpadek nebo \u0161patn\u00e1 konfigurace DNS serveru\",\"Probl\u00e9m se s\u00ed\u0165ovou konektivitou\",\"Po\u017eadovan\u00fd n\u00e1zev opravdu neexistuje\"],\"Obvykle provozn\u00ed probl\u00e9m, ale trval\u00e1 selh\u00e1n\u00ed u konkr\u00e9tn\u00edch intern\u00edch n\u00e1zv\u016f mohou znamenat manipulaci s DNS nebo \u00fato\u010dn\u00edka naru\u0161uj\u00edc\u00edho p\u0159eklad n\u00e1zv\u016f jako sou\u010d\u00e1st \u0161ir\u0161\u00edho \u00fatoku.\"],\n[5719,\"System\",\"S\u00ed\u0165\",\"Nebyl nalezen \u017e\u00e1dn\u00fd \u0159adi\u010d dom\u00e9ny (NETLOGON)\",\"Stroj nemohl naj\u00edt \u0159adi\u010d dom\u00e9ny, v\u016f\u010di kter\u00e9mu by se autentizoval.\",\"warn\",[\"Probl\u00e9m se s\u00ed\u0165ovou konektivitou k dom\u00e9n\u011b\",\"\u0160patn\u00e1 konfigurace DNS br\u00e1n\u00edc\u00ed objeven\u00ed \u0159adi\u010de dom\u00e9ny\",\"V\u0161echny dostupn\u00e9 \u0159adi\u010de dom\u00e9ny nedostupn\u00e9\"],\"M\u016f\u017ee znamenat v\u00fdpadek s\u00edt\u011b, ale koordinovan\u00fd vzorec nap\u0159\u00ed\u010d mnoha stroji m\u016f\u017ee b\u00fdt i d\u016fsledkem stavu odm\u00edtnut\u00ed slu\u017eby (DoS) proti \u0159adi\u010d\u016fm dom\u00e9ny nebo DNS.\"],\n[36,\"System\",\"S\u00ed\u0165\",\"Slu\u017eba \u010dasu ztratila synchronizaci se sv\u00fdm zdrojem \u010dasu\",\"Windows Time service se nepoda\u0159ilo udr\u017eet synchronizaci hodin s nakonfigurovan\u00fdm zdrojem, co\u017e m\u016f\u017ee zp\u016fsobit i selh\u00e1n\u00ed Kerberos autentizace.\",\"warn\",[\"Nedostupn\u00fd nebo \u0161patn\u011b nakonfigurovan\u00fd zdroj NTP\",\"S\u00ed\u0165ov\u00e9 probl\u00e9my k zdroji \u010dasu\"],\"Krom\u011b provozn\u00edho dopadu naru\u0161uje v\u00fdrazn\u011bj\u0161\u00ed rozjet\u00ed hodin i Kerberos autentizaci (kter\u00e1 m\u00e1 p\u0159\u00edsnou toleranci na rozd\u00edl v \u010dase), tak\u017ee trval\u00e9 probl\u00e9my se synchronizac\u00ed mohou zp\u016fsobit v\u00fdpadky autentizace, kter\u00e9 vypadaj\u00ed jako \u00fatok.\"],\n[1000,\"Application\",\"P\u00e1dy aplikac\u00ed a instalace\",\"Aplikace spadla (Application Error)\",\"Zaznamen\u00e1v\u00e1 se poka\u017ed\u00e9, kdy\u017e spadne u\u017eivatelsk\u00e1 aplikace, s uveden\u00edm spadl\u00e9ho spustiteln\u00e9ho souboru a modulu. \u010casto se objevuje spolu s ud\u00e1lost\u00ed 1001 od Windows Error Reporting s dal\u0161\u00edmi diagnostick\u00fdmi detaily.\",\"warn\",[\"Chyba v aplikaci nebo v pluginu\/ovlada\u010di t\u0159et\u00ed strany, kter\u00fd pou\u017e\u00edv\u00e1\",\"Po\u0161kozen\u00e1 instalace nebo nekompatibiln\u00ed aktualizace\",\"Ob\u010das zn\u00e1mka pokusu o zneu\u017eit\u00ed zranitelnosti aplikace\"],\"V\u011bt\u0161ina p\u00e1d\u016f jsou oby\u010dejn\u00e9 chyby, ale opakuj\u00edc\u00ed se p\u00e1dy stejn\u00e9 aplikace, zejm\u00e9na aplikace dostupn\u00e9 z internetu, mohou znamenat aktivn\u00ed pokusy o zneu\u017eit\u00ed zranitelnosti v t\u00e9to aplikaci.\"],\n[1001,\"Application\",\"P\u00e1dy aplikac\u00ed a instalace\",\"Windows Error Reporting zachytilo detaily p\u00e1du\",\"Dodate\u010dn\u00e9 diagnostick\u00e9 informace vygenerovan\u00e9 Windows Error Reporting po p\u00e1du (\u010dasto spolu s ud\u00e1lost\u00ed 1000).\",\"info\",[\"Dopl\u0148kov\u00fd detail po p\u00e1du aplikace\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; dopl\u0148kov\u00fd diagnostick\u00fd detail k souvisej\u00edc\u00ed ud\u00e1losti 1000.\"],\n[1026,\"Application\",\"P\u00e1dy aplikac\u00ed a instalace\",\"Do\u0161lo k neo\u0161et\u0159en\u00e9 v\u00fdjimce b\u011bhov\u00e9ho prost\u0159ed\u00ed .NET\",\"Spravovan\u00e1 (.NET) aplikace vyhodila v\u00fdjimku, kterou nikde v k\u00f3du nezachytil \u017e\u00e1dn\u00fd handler.\",\"warn\",[\"Chyba v .NET aplikaci\",\"Chyb\u011bj\u00edc\u00ed nebo neodpov\u00eddaj\u00edc\u00ed z\u00e1vislost .NET runtime\"],\"Obvykle jde o chybu v k\u00f3du, ale opakuj\u00edc\u00ed se p\u00e1dy konkr\u00e9tn\u00ed spravovan\u00e9 aplikace mohou znamenat i pokusy o jej\u00ed zneu\u017eit\u00ed.\"],\n[1033,\"Application\",\"P\u00e1dy aplikac\u00ed a instalace\",\"Windows Installer dokon\u010dil instalaci produktu\",\"Standardn\u00ed ud\u00e1lost dokon\u010den\u00ed MSI instalace s uveden\u00edm n\u00e1zvu produktu.\",\"info\",[\"B\u011b\u017en\u00e1 instalace softwaru p\u0159es Windows Installer\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; u\u017eite\u010dn\u00e9 jako v\u00fdchoz\u00ed p\u0159ehled instalovan\u00e9ho softwaru, pro p\u0159\u00edpad, \u017ee by se zde objevil neautorizovan\u00fd nebo neschv\u00e1len\u00fd software.\"],\n[1034,\"Application\",\"P\u00e1dy aplikac\u00ed a instalace\",\"Windows Installer dokon\u010dil odebr\u00e1n\u00ed produktu\",\"Standardn\u00ed ud\u00e1lost dokon\u010den\u00ed MSI odinstalace.\",\"info\",[\"B\u011b\u017en\u00e9 odebr\u00e1n\u00ed softwaru p\u0159es Windows Installer\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[11707,\"Application\",\"P\u00e1dy aplikac\u00ed a instalace\",\"Instalace MSI byla \u00fasp\u011b\u0161n\u011b dokon\u010dena\",\"Star\u0161\u00ed k\u00f3d \u00fasp\u011bchu Windows Installeru (1707) namapovan\u00fd do logu Application p\u0159i\u010dten\u00edm 10 000 \u2013 dlouhodob\u011b pou\u017e\u00edvan\u00fd zp\u016fsob, jak zachytit nov\u011b instalovan\u00fd software na b\u00e1zi MSI.\",\"info\",[\"B\u011b\u017en\u00e1 instalace softwaru\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; u\u017eite\u010dn\u00e1 stopa legitimn\u00edch instalac\u00ed softwaru p\u0159es MSI, i kdy\u017e mnoho droppovac\u00edch n\u00e1stroj\u016f malwaru MSI nepou\u017e\u00edv\u00e1 a zde se neobjev\u00ed.\"],\n[11724,\"Application\",\"P\u00e1dy aplikac\u00ed a instalace\",\"Odebr\u00e1n\u00ed MSI bylo \u00fasp\u011b\u0161n\u011b dokon\u010deno\",\"Star\u0161\u00ed k\u00f3d \u00fasp\u011bchu odinstalace Windows Installeru (1724 + 10 000).\",\"info\",[\"B\u011b\u017en\u00e9 odebr\u00e1n\u00ed softwaru\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[10005,\"Application\",\"P\u00e1dy aplikac\u00ed a instalace\",\"Instalace Windows Installer se nepoda\u0159ilo dokon\u010dit\",\"Instalace na b\u00e1zi MSI se nepoda\u0159ilo \u00fasp\u011b\u0161n\u011b dokon\u010dit.\",\"warn\",[\"Chyba instala\u010dn\u00edho bal\u00ed\u010dku\",\"Nedostatek opr\u00e1vn\u011bn\u00ed nebo m\u00edsta na disku\",\"Konflikt s existuj\u00edc\u00ed instalac\u00ed\"],\"Obvykle ne\u0161kodn\u00e9, ale m\u016f\u017ee znamenat po\u0161kozenou nebo zablokovanou instalaci \u2013 stoj\u00ed za bli\u017e\u0161\u00ed pohled, pokud jde o ne\u00fasp\u011b\u0161n\u00e9 nasazen\u00ed bezpe\u010dnostn\u00edho softwaru.\"],\n[2,\"DNS Server\",\"DNS server\",\"Slu\u017eba DNS Server byla spu\u0161t\u011bna\",\"Zaznamen\u00e1v\u00e1 se p\u0159i spu\u0161t\u011bn\u00ed slu\u017eby Windows DNS Server.\",\"info\",[\"B\u011b\u017en\u00e9 spu\u0161t\u011bn\u00ed slu\u017eby \/ restart serveru\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; nastavuje \u010dasovou osu dostupnosti slu\u017eby.\"],\n[3,\"DNS Server\",\"DNS server\",\"Slu\u017eba DNS Server byla zastavena\",\"Zaznamen\u00e1v\u00e1 se p\u0159i zastaven\u00ed slu\u017eby Windows DNS Server.\",\"warn\",[\"Pl\u00e1novan\u00e1 \u00fadr\u017eba\",\"Neo\u010dek\u00e1van\u00e9 selh\u00e1n\u00ed slu\u017eby nebo \u00fato\u010dn\u00edk naru\u0161uj\u00edc\u00ed p\u0159eklad n\u00e1zv\u016f\"],\"Nepl\u00e1novan\u00fd v\u00fdpadek DNS m\u016f\u017ee b\u00fdt zneu\u017eit k naru\u0161en\u00ed p\u0159ekladu n\u00e1zv\u016f jako p\u0159edstupe\u0148 p\u0159esm\u011brov\u00e1n\u00ed provozu, nebo prost\u011b jde o probl\u00e9m dostupnosti \u2013 v obou p\u0159\u00edpadech si zaslou\u017e\u00ed pro\u0161et\u0159en\u00ed, pokud nebyl pl\u00e1novan\u00fd.\"],\n[4013,\"DNS Server\",\"DNS server\",\"DNS server se nepoda\u0159ilo p\u0159ipojit k Active Directory\",\"DNS server integrovan\u00fd s AD se nemohl p\u0159ipojit k adres\u00e1\u0159i, na kter\u00e9m z\u00e1vis\u00ed data z\u00f3ny, typicky p\u0159i startu p\u0159edt\u00edm, ne\u017e se pln\u011b nav\u00e1\u017ee s\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed.\",\"warn\",[\"\u0158adi\u010d dom\u00e9ny se restartuje d\u0159\u00edv, ne\u017e je p\u0159ipraven\u00e1 WAN linka\",\"Podkladov\u00e9 probl\u00e9my Active Directory nebo replikace\"],\"P\u0159edev\u0161\u00edm provozn\u00ed\/dostupnostn\u00ed probl\u00e9m spojen\u00fd s po\u0159ad\u00edm startu nebo konektivitou, ale trval\u00e1 selh\u00e1n\u00ed mohou poukazovat i na \u0161ir\u0161\u00ed probl\u00e9my s replikac\u00ed nebo konektivitou AD, kter\u00e9 stoj\u00ed za pro\u0161et\u0159en\u00ed.\"],\n[6527,\"DNS Server\",\"DNS server\",\"Z\u00f3na vypr\u0161ela d\u0159\u00edv, ne\u017e se poda\u0159ilo dokon\u010dit p\u0159enos nebo aktualizaci\",\"Interval obnovy sekund\u00e1rn\u00ed\/stub z\u00f3ny vypr\u0161el bez \u00fasp\u011b\u0161n\u00e9ho p\u0159enosu z hlavn\u00edho (master) serveru, tak\u017ee byla z\u00f3na vy\u0159azena z provozu.\",\"crit\",[\"Probl\u00e9my se s\u00ed\u0165ovou konektivitou k hlavn\u00edmu DNS serveru\",\"Nastaven\u00ed p\u0159enosu z\u00f3ny zablokovan\u00e9 firewallem nebo \u0161patn\u011b nakonfigurovan\u00e9\"],\"Pokud je zneu\u017eito z\u00e1m\u011brn\u011b (nap\u0159. blokov\u00e1n\u00edm p\u0159enos\u016f z\u00f3ny), m\u016f\u017ee \u00fato\u010dn\u00edk zp\u016fsobit, \u017ee sekund\u00e1rn\u00ed DNS server bude serv\u00edrovat zastaral\u00e1 nebo \u017e\u00e1dn\u00e1 data; \u010dast\u011bji jde o probl\u00e9m s konektivitou nebo konfigurac\u00ed.\"],\n[3150,\"DNS Server\",\"DNS server\",\"DNS server zapsal novou verzi z\u00f3ny do souboru\",\"Potvrzuje, \u017ee souborov\u00e1 z\u00f3na byla po aktualizaci \u00fasp\u011b\u0161n\u011b ulo\u017eena na disk.\",\"info\",[\"B\u011b\u017en\u00e1 aktivita aktualizace nebo p\u0159enosu z\u00f3ny\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; rutinn\u00ed potvrzen\u00ed \u00fasp\u011b\u0161n\u00e9 aktualizace z\u00f3ny.\"],\n[3151,\"DNS Server\",\"DNS server\",\"DNS serveru se nepoda\u0159ilo zapsat soubor z\u00f3ny\",\"Selhal z\u00e1pis souboru z\u00f3ny, nej\u010dast\u011bji proto, \u017ee je disk serveru pln\u00fd.\",\"crit\",[\"Vy\u010derp\u00e1n\u00ed diskov\u00e9ho prostoru na DNS serveru\",\"Probl\u00e9my s opr\u00e1vn\u011bn\u00edmi nebo cestou k souboru\"],\"P\u0159edev\u0161\u00edm provozn\u00ed\/kapacitn\u00ed probl\u00e9m, ale DNS server, kter\u00fd nedok\u00e1\u017ee ulo\u017eit data z\u00f3ny, z\u00e1rove\u0148 nem\u016f\u017ee spolehliv\u011b obsluhovat autoritativn\u00ed z\u00e1znamy, co\u017e m\u00e1 bezpe\u010dnostn\u00ed dopad na v\u0161e, co se na danou z\u00f3nu spol\u00e9h\u00e1.\"],\n[0,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: logov\u00e1n\u00ed bylo zah\u00e1jeno\",\"K\u00f3d auditn\u00edho logu DHCP serveru 00. Nejde o standardn\u00ed ID Event Vieweru \u2013 DHCP server si p\u00ed\u0161e vlastn\u00ed \u010d\u00edslovan\u00fd auditn\u00ed log do CSV souboru m\u00edsto do hlavn\u00edho logu Windows. Ozna\u010duje za\u010d\u00e1tek nov\u00e9ho souboru auditn\u00edho logu.\",\"info\",[\"B\u011b\u017en\u00e9 spu\u0161t\u011bn\u00ed slu\u017eby DHCP \/ rotace logu\"],\"N\u00edzk\u00fd bezpe\u010dnostn\u00ed v\u00fdznam; zna\u010dka \u017eivotn\u00edho cyklu slu\u017eby.\"],\n[1,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: logov\u00e1n\u00ed bylo zastaveno\",\"K\u00f3d auditn\u00edho logu DHCP serveru 01, zaznamen\u00e1v\u00e1 se p\u0159i zastaven\u00ed z\u00e1pisu do auditn\u00edho logu (nap\u0159. zastaven\u00ed slu\u017eby).\",\"warn\",[\"Pl\u00e1novan\u00e9 zastaven\u00ed slu\u017eby\",\"Neo\u010dek\u00e1van\u00e9 selh\u00e1n\u00ed slu\u017eby DHCP\"],\"Nepl\u00e1novan\u00e9 zastaven\u00ed p\u0159eru\u0161\u00ed p\u0159ehled auditu DHCP, a pokud se zastavila i samotn\u00e1 slu\u017eba DHCP, m\u016f\u017ee naru\u0161it p\u0159id\u011blov\u00e1n\u00ed adres v s\u00edti.\"],\n[2,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: logov\u00e1n\u00ed bylo pozastaveno (m\u00e1lo m\u00edsta na disku)\",\"K\u00f3d auditn\u00edho logu DHCP serveru 02 \u2013 server do\u010dasn\u011b p\u0159estal zapisovat auditn\u00ed z\u00e1znamy, proto\u017ee voln\u00e9 m\u00edsto na disku kleslo pod nastavenou hranici.\",\"warn\",[\"Vy\u010derp\u00e1n\u00ed diskov\u00e9ho prostoru na DHCP serveru\"],\"Vytv\u00e1\u0159\u00ed mezeru v pokryt\u00ed auditu DHCP \u2013 ve\u0161ker\u00e1 aktivita zap\u016fj\u010den\u00ed adres b\u011bhem pozastaven\u00ed nebude zaznamen\u00e1na, co\u017e vad\u00ed, pokud pozd\u011bji pot\u0159ebujete zjistit, kter\u00e9 za\u0159\u00edzen\u00ed m\u011blo danou IP adresu.\"],\n[10,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: byla p\u0159id\u011blena nov\u00e1 IP adresa\",\"K\u00f3d auditn\u00edho logu DHCP serveru 10, nej\u010dast\u011bj\u0161\u00ed polo\u017eka v logu \u2013 klient \u00fasp\u011b\u0161n\u011b z\u00edskal nov\u00fd z\u00e1p\u016fj\u010dn\u00ed pron\u00e1jem (lease).\",\"info\",[\"B\u011b\u017en\u00e1 aktivita z\u00e1p\u016fj\u010dky DHCP u klienta\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; z\u00e1kladn\u00ed z\u00e1znam pro zji\u0161t\u011bn\u00ed, kter\u00e9 za\u0159\u00edzen\u00ed m\u011blo v dan\u00fd okam\u017eik konkr\u00e9tn\u00ed IP adresu, co\u017e je d\u016fle\u017eit\u00e9 pro p\u0159i\u0159azen\u00ed dal\u0161\u00ed zalogovan\u00e9 s\u00ed\u0165ov\u00e9 aktivity ke konkr\u00e9tn\u00edmu stroji.\"],\n[11,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: z\u00e1p\u016fj\u010dka byla obnovena\",\"K\u00f3d auditn\u00edho logu DHCP serveru 11 \u2013 klient obnovil svou existuj\u00edc\u00ed z\u00e1p\u016fj\u010dku.\",\"info\",[\"B\u011b\u017en\u00e9 obnoven\u00ed z\u00e1p\u016fj\u010dky klientem\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; podp\u016frn\u00fd detail pro mapov\u00e1n\u00ed z\u00e1p\u016fj\u010dka\u2013za\u0159\u00edzen\u00ed.\"],\n[12,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: z\u00e1p\u016fj\u010dka byla uvoln\u011bna\",\"K\u00f3d auditn\u00edho logu DHCP serveru 12 \u2013 klient v\u00fdslovn\u011b uvolnil svou z\u00e1p\u016fj\u010dku (nap\u0159. p\u0159es ipconfig \/release).\",\"info\",[\"B\u011b\u017en\u00e9 vypnut\u00ed klienta nebo ru\u010dn\u00ed uvoln\u011bn\u00ed\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[13,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: byl zji\u0161t\u011bn konflikt IP adres\",\"K\u00f3d auditn\u00edho logu DHCP serveru 13 \u2013 server zjistil, \u017ee je adresa ji\u017e na s\u00edti pou\u017e\u00edv\u00e1na, je\u0161t\u011b p\u0159ed t\u00edm, ne\u017e ji nab\u00eddl.\",\"warn\",[\"Staticky nakonfigurovan\u00e9 za\u0159\u00edzen\u00ed pou\u017e\u00edvaj\u00edc\u00ed adresu z rozsahu DHCP\",\"Chyba v konfiguraci duplicitn\u00ed adresy\"],\"M\u016f\u017ee znamenat podvr\u017een\u00e9 nebo \u0161patn\u011b nakonfigurovan\u00e9 za\u0159\u00edzen\u00ed, kter\u00e9 si natrvalo p\u0159isvojilo adresu ze spravovan\u00e9ho rozsahu, co\u017e se ob\u010das pou\u017e\u00edv\u00e1 k odposlechu provozu ur\u010den\u00e9ho legitimn\u00edmu stroji.\"],\n[14,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: byl vy\u010derp\u00e1n rozsah adres\",\"K\u00f3d auditn\u00edho logu DHCP serveru 14 \u2013 po\u017eadavek na z\u00e1p\u016fj\u010dku nebylo mo\u017en\u00e9 uspokojit, proto\u017ee rozsahu do\u0161ly dostupn\u00e9 adresy.\",\"warn\",[\"Rozsah nastaven\u00fd p\u0159\u00edli\u0161 mal\u00fd na po\u010det za\u0159\u00edzen\u00ed\",\"N\u00e1hl\u00fd n\u00e1r\u016fst nov\u00fdch za\u0159\u00edzen\u00ed (nebo \u00fatok typu DHCP starvation)\"],\"N\u00e1hl\u00e9, nevysv\u011btlen\u00e9 vy\u010derp\u00e1n\u00ed rozsahu adres m\u016f\u017ee znamenat \u00fatok DHCP starvation, kdy \u00fato\u010dn\u00edk zaplav\u00ed server fale\u0161n\u00fdmi po\u017eadavky, aby odep\u0159el slu\u017ebu legitimn\u00edm za\u0159\u00edzen\u00edm.\"],\n[15,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: z\u00e1p\u016fj\u010dka byla zam\u00edtnuta\",\"K\u00f3d auditn\u00edho logu DHCP serveru 15 \u2013 server v\u00fdslovn\u011b odm\u00edtl (NACK) po\u017eadavek klienta.\",\"warn\",[\"Klient \u017e\u00e1d\u00e1 o adresu mimo sv\u016fj povolen\u00fd rozsah\/rezervaci\",\"Klient se p\u0159esouv\u00e1 do pods\u00edt\u011b, ke kter\u00e9 nem\u00e1 opr\u00e1vn\u011bn\u00ed\"],\"M\u016f\u017ee znamenat za\u0159\u00edzen\u00ed pokou\u0161ej\u00edc\u00ed se z\u00edskat adresu mimo sv\u016fj autorizovan\u00fd rozsah nebo rezervaci, co\u017e m\u016f\u017ee b\u00fdt rekognoskace nebo pokus o obejit\u00ed s\u00ed\u0165ov\u00e9 segmentace.\"],\n[16,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: z\u00e1p\u016fj\u010dka byla smaz\u00e1na\",\"K\u00f3d auditn\u00edho logu DHCP serveru 16 \u2013 z\u00e1znam o z\u00e1p\u016fj\u010dce byl odstran\u011bn z datab\u00e1ze serveru.\",\"info\",[\"Administrativn\u00ed \u00faklid\",\"Reklamace vypr\u0161en\u00e9 z\u00e1p\u016fj\u010dky\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; administrativn\u00ed \u00faklid.\"],\n[17,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: z\u00e1p\u016fj\u010dce vypr\u0161ela platnost\",\"K\u00f3d auditn\u00edho logu DHCP serveru 17 \u2013 z\u00e1p\u016fj\u010dka klienta dos\u00e1hla data vypr\u0161en\u00ed bez obnoven\u00ed.\",\"info\",[\"Klient offline nebo odpojen\u00fd po vypr\u0161en\u00ed z\u00e1p\u016fj\u010dky\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b.\"],\n[55,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: server autorizov\u00e1n a obsluhuje klienty\",\"K\u00f3d auditn\u00edho logu DHCP serveru 55 \u2013 server potvrdil, \u017ee je autorizovan\u00fd v Active Directory, a za\u010dal obsluhovat klienty.\",\"info\",[\"B\u011b\u017en\u00e9 spu\u0161t\u011bn\u00ed DHCP serveru v dom\u00e9nov\u00e9m prost\u0159ed\u00ed\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; potvrzuje, \u017ee server pro\u0161el vestav\u011bnou ochranou Active Directory proti podvr\u017een\u00fdm DHCP server\u016fm.\"],\n[56,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: selh\u00e1n\u00ed autorizace, slu\u017eba byla zastavena\",\"K\u00f3d auditn\u00edho logu DHCP serveru 56 \u2013 server zjistil, \u017ee nen\u00ed autorizovan\u00fd v Active Directory, a p\u0159estal obsluhovat klienty (ochrana proti podvr\u017een\u00fdm server\u016fm).\",\"crit\",[\"\u0160patn\u011b nakonfigurovan\u00fd nebo nov\u011b pov\u00fd\u0161en\u00fd DHCP server, kter\u00fd zat\u00edm nen\u00ed autorizovan\u00fd\",\"Neautorizovan\u00fd \/ podvr\u017een\u00fd DHCP server blokovan\u00fd ochrann\u00fdmi mechanismy AD\"],\"P\u0159\u00edmo relevantn\u00ed pro odhalen\u00ed \u0161patn\u011b nakonfigurovan\u00e9ho nebo neautorizovan\u00e9ho DHCP serveru v s\u00edti \u2013 vestav\u011bn\u00e1 ochrana Active Directory zabr\u00e1nila serveru obsluhovat klienty, co\u017e je p\u0159esn\u011b to chov\u00e1n\u00ed, jak\u00e9 chcete vid\u011bt p\u0159i blokov\u00e1n\u00ed podvr\u017een\u00e9ho serveru.\"],\n[61,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: byl nalezen dal\u0161\u00ed autorizovan\u00fd server\",\"K\u00f3d auditn\u00edho logu DHCP serveru 61 \u2013 server zjistil dal\u0161\u00ed DHCP server n\u00e1le\u017eej\u00edc\u00ed do dom\u00e9ny integrovan\u00e9 s AD.\",\"info\",[\"B\u011b\u017en\u00e1 redundance v\u00edce DHCP server\u016f\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; potvrzuje b\u011b\u017enou redundanci v\u00edce server\u016f.\"],\n[62,\"DHCP Server\",\"DHCP server\",\"DHCP audit log: v s\u00edti byl nalezen dal\u0161\u00ed DHCP server\",\"K\u00f3d auditn\u00edho logu DHCP serveru 62 \u2013 b\u011bhem kontrol detekce podvr\u017een\u00fdch server\u016f byl zji\u0161t\u011bn nezn\u00e1m\u00fd DHCP server v s\u00edti.\",\"warn\",[\"Legitimn\u00ed, ale neregistrovan\u00fd DHCP server\",\"Podvr\u017een\u00fd DHCP server, n\u00e1hodn\u00fd nebo z\u00e1m\u011brn\u00fd\"],\"Kl\u00ed\u010dov\u00fd sign\u00e1l pro odhalen\u00ed podvr\u017een\u00e9ho DHCP serveru \u2013 neautorizovan\u00fd DHCP server v s\u00edti m\u016f\u017ee klient\u016fm p\u0159id\u011blovat \u0161kodlivou br\u00e1nu nebo DNS nastaven\u00ed a t\u00edm zachyt\u00e1vat nebo p\u0159esm\u011brov\u00e1vat jejich provoz.\"],\n[1,\"Sysmon\",\"Sysmon\",\"Vytvo\u0159en\u00ed procesu\",\"Bohat\u0161\u00ed obdoba ud\u00e1losti Security 4688 od Sysmonu \u2013 zachycuje cel\u00fd p\u0159\u00edkazov\u00fd \u0159\u00e1dek, hashe a rodi\u010dovsk\u00fd proces pro ka\u017ed\u00fd nov\u00fd proces. V\u016fbec nejpou\u017e\u00edvan\u011bj\u0161\u00ed Sysmon ud\u00e1lost v detek\u010dn\u00edm in\u017een\u00fdrstv\u00ed.\",\"warn\",[\"B\u011b\u017en\u00e9 spou\u0161t\u011bn\u00ed aplikac\u00ed a skript\u016f\",\"\u0160kodliv\u00e9 n\u00e1stroje nebo living-off-the-land techniky\"],\"Jedna z nejcenn\u011bj\u0161\u00edch ud\u00e1lost\u00ed pro detekci na koncov\u00fdch bodech v\u016fbec \u2013 v kombinaci s p\u0159\u00edkazov\u00fdm \u0159\u00e1dkem, hashem a rodi\u010dovsk\u00fdm procesem odhaluje living-off-the-land techniky a neobvykl\u00e9 \u0159et\u011bzce spou\u0161t\u011bn\u00ed, kter\u00e9 jsou kl\u00ed\u010dov\u00e9 pro odhalen\u00ed \u0161kodliv\u00e9ho k\u00f3du.\"],\n[2,\"Sysmon\",\"Sysmon\",\"Proces zm\u011bnil \u010das vytvo\u0159en\u00ed souboru\",\"Ozna\u010duje manipulaci s \u010dasov\u00fdm raz\u00edtkem vytvo\u0159en\u00ed souboru ('timestomping'), b\u011b\u017enou anti-forenzn\u00ed techniku.\",\"warn\",[\"Legitimn\u00ed archiva\u010dn\u00ed\/z\u00e1lohovac\u00ed n\u00e1stroje zachov\u00e1vaj\u00edc\u00ed \u010dasov\u00e1 raz\u00edtka\",\"Timestomping za \u00fa\u010delem zamaskov\u00e1n\u00ed doby ulo\u017een\u00ed \u0161kodliv\u00e9ho souboru\"],\"Timestomping je dob\u0159e zdokumentovan\u00e1 anti-forenzn\u00ed technika pou\u017e\u00edvan\u00e1 k tomu, aby \u0161kodliv\u00fd soubor splynul s legitimn\u00edmi, star\u0161\u00edmi soubory a unikl t\u0159\u00edd\u011bn\u00ed podle \u010dasu.\"],\n[3,\"Sysmon\",\"Sysmon\",\"S\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed\",\"Loguje odchoz\u00ed (a n\u011bkter\u00e1 p\u0159\u00edchoz\u00ed) TCP\/UDP p\u0159ipojen\u00ed v\u010detn\u011b zdrojov\u00e9ho\/c\u00edlov\u00e9ho procesu, IP adresy a portu \u2013 kl\u00ed\u010dov\u00e9 pro odhalen\u00ed komunikace s C2.\",\"warn\",[\"B\u011b\u017en\u00e1 s\u00ed\u0165ov\u00e1 aktivita aplikac\u00ed\",\"Beaconing C2 nebo exfiltrace dat\"],\"Kl\u00ed\u010dov\u00e9 pro odhalen\u00ed beaconingu s command-and-control serverem, zejm\u00e9na ve spojen\u00ed s reputac\u00ed procesu a c\u00edlov\u00e9 IP adresy\/dom\u00e9ny.\"],\n[4,\"Sysmon\",\"Sysmon\",\"Byl zm\u011bn\u011bn stav slu\u017eby Sysmon\",\"Sysmon s\u00e1m se spustil nebo zastavil \u2013 stoj\u00ed za to na to alertovat, proto\u017ee vypnut\u00ed Sysmonu oslep\u00ed ve\u0161kerou detekci na n\u011bm postavenou.\",\"crit\",[\"Pl\u00e1novan\u00fd upgrade Sysmonu nebo obnoven\u00ed konfigurace\",\"\u00dato\u010dn\u00edk vyp\u00edn\u00e1 Sysmon, aby unikl detekci\"],\"Pokud je Sysmon zastaven nebo p\u0159enastaven na m\u00e9n\u011b logov\u00e1n\u00ed, ka\u017ed\u00e1 navazuj\u00edc\u00ed detekce na n\u011bm postaven\u00e1 p\u0159estane fungovat \u2013 tato ud\u00e1lost by m\u011bla v\u017edy vyvolat alert.\"],\n[5,\"Sysmon\",\"Sysmon\",\"Proces byl ukon\u010den\",\"Ozna\u010duje ukon\u010den\u00ed procesu, ve spojen\u00ed s ud\u00e1lost\u00ed ID 1 d\u00e1v\u00e1 d\u00e9lku trv\u00e1n\u00ed procesu.\",\"info\",[\"B\u011b\u017en\u00e9 dokon\u010den\u00ed procesu\"],\"N\u00edzk\u00e9 riziko samo o sob\u011b; podp\u016frn\u00fd detail pro korelaci s Event ID 1.\"],\n[6,\"Sysmon\",\"Sysmon\",\"Byl na\u010dten ovlada\u010d\",\"Byl na\u010dten ovlada\u010d j\u00e1dra, v\u010detn\u011b informac\u00ed o jeho podpisu\/hashi.\",\"warn\",[\"Legitimn\u00ed hardwarov\u00e9 nebo bezpe\u010dnostn\u00ed ovlada\u010de\",\"Na\u010dten\u00ed \u0161kodliv\u00e9ho nebo zraniteln\u00e9ho ovlada\u010de ('BYOVD')\"],\"Na\u010dten\u00ed legitimn\u011b podepsan\u00e9ho, ale zraniteln\u00e9ho ovlada\u010de (technika 'Bring Your Own Vulnerable Driver') je zn\u00e1m\u00e1 technika pro z\u00edsk\u00e1n\u00ed spu\u0161t\u011bn\u00ed k\u00f3du na \u00farovni j\u00e1dra nebo vy\u0159azen\u00ed bezpe\u010dnostn\u00edch n\u00e1stroj\u016f, tak\u017ee neobvykl\u00e9 nebo nov\u011b se objevuj\u00edc\u00ed ovlada\u010de zaslou\u017e\u00ed prov\u011b\u0159en\u00ed.\"],\n[7,\"Sysmon\",\"Sysmon\",\"Byl na\u010dten image (modul)\",\"Do procesu byla na\u010dtena DLL nebo spustiteln\u00fd modul. Velmi vysok\u00fd objem; typicky se filtruje na konkr\u00e9tn\u00ed cesty nebo nepodepsan\u00e9 moduly.\",\"info\",[\"B\u011b\u017en\u00e9 na\u010d\u00edt\u00e1n\u00ed modul\u016f aplikac\u00ed\",\"DLL sideloading\/hijacking malwarem\"],\"DLL sideloading a hijacking (p\u0159im\u011bn\u00ed legitimn\u00ed aplikaci, aby m\u00edsto o\u010dek\u00e1van\u00e9 knihovny na\u010detla \u0161kodlivou DLL) je b\u011b\u017en\u00fd zp\u016fsob, jak spustit \u0161kodliv\u00fd k\u00f3d pod identitou d\u016fv\u011bryhodn\u00e9ho procesu.\"],\n[8,\"Sysmon\",\"Sysmon\",\"CreateRemoteThread\",\"Proces vytvo\u0159il vl\u00e1kno uvnit\u0159 jin\u00e9ho procesu \u2013 klasick\u00fd prvek techniky process injection.\",\"crit\",[\"Legitimn\u00ed ladic\u00ed nebo monitorovac\u00ed n\u00e1stroje\",\"Process injection za \u00fa\u010delem ukryt\u00ed \u0161kodliv\u00e9ho k\u00f3du v d\u016fv\u011bryhodn\u00e9m procesu\"],\"Z\u00e1kladn\u00ed stavebn\u00ed prvek klasick\u00fdch technik process injection pou\u017e\u00edvan\u00fdch ke spu\u0161t\u011bn\u00ed \u0161kodliv\u00e9ho k\u00f3du uvnit\u0159 d\u016fv\u011bryhodn\u00e9ho procesu (nap\u0159. explorer.exe), aby splynul a unikl detekci.\"],\n[9,\"Sysmon\",\"Sysmon\",\"RawAccessRead\",\"Proces \u010detl p\u0159\u00edmo z disku pomoc\u00ed n\u00edzko\u00farov\u0148ov\u00e9ho p\u0159\u00edstupu \\\\\\\\.\\\\ a obe\u0161el tak b\u011b\u017en\u00e1 rozhran\u00ed souborov\u00e9ho syst\u00e9mu.\",\"warn\",[\"Z\u00e1lohovac\u00ed, forenzn\u00ed nebo imaging n\u00e1stroje pro disky\",\"Malware \u010dtouc\u00ed raw sektory disku za \u00fa\u010delem kr\u00e1de\u017ee p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f nebo obejit\u00ed monitoringu na \u00farovni soubor\u016f\"],\"Malware a n\u00e1stroje pro kr\u00e1de\u017e p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f n\u011bkdy \u010dtou raw sektory disku p\u0159\u00edmo, aby obe\u0161ly kontroly p\u0159\u00edstupu na \u00farovni soubor\u016f nebo z\u00edskaly data (nap\u0159. registrov\u00e9 \u00faly), kter\u00e1 jsou za b\u011bhu Windows norm\u00e1ln\u011b uzam\u010den\u00e1.\"],\n[10,\"Sysmon\",\"Sysmon\",\"ProcessAccess\",\"Jeden proces otev\u0159el handle k jin\u00e9mu s konkr\u00e9tn\u00edmi p\u0159\u00edstupov\u00fdmi pr\u00e1vy \u2013 ud\u00e1lost nej\u010dast\u011bji spojovan\u00e1 s n\u00e1stroji na dumpov\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f \u010dtouc\u00edmi pam\u011b\u0165 LSASS.\",\"crit\",[\"Legitimn\u00ed bezpe\u010dnostn\u00ed n\u00e1stroje kontroluj\u00edc\u00ed proces (nap\u0159. antivirus)\",\"Dumpov\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f z LSASS\"],\"Kl\u00ed\u010dov\u00e1 ud\u00e1lost pro odhalen\u00ed n\u00e1stroj\u016f na dumpov\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f (nap\u0159\u00edklad t\u011bch, kter\u00e9 \u010dtou pam\u011b\u0165 procesu LSASS) a extrahuj\u00ed ulo\u017een\u00e1 hesla a Kerberos tikety z b\u011b\u017e\u00edc\u00edho syst\u00e9mu.\"],\n[11,\"Sysmon\",\"Sysmon\",\"FileCreate\",\"Byl vytvo\u0159en nebo p\u0159eps\u00e1n soubor, v\u010detn\u011b cel\u00e9 cesty \u2013 u\u017eite\u010dn\u00e9 pro zachycen\u00ed droppovan\u00e9ho malwaru a artefakt\u016f perzistence v okam\u017eiku jejich ulo\u017een\u00ed na disk.\",\"warn\",[\"B\u011b\u017en\u00e1 aktivita aplikac\u00ed a u\u017eivatel\u016f se soubory\",\"Zapisov\u00e1n\u00ed payload\u016f malwaru na disk\"],\"Zachycuje malwarov\u00e9 payloady a droppovac\u00ed n\u00e1stroje v okam\u017eiku, kdy jsou zaps\u00e1ny na disk, \u010dasto je\u0161t\u011b p\u0159edt\u00edm, ne\u017e se v\u016fbec spust\u00ed.\"],\n[12,\"Sysmon\",\"Sysmon\",\"RegistryEvent: vytvo\u0159en\u00ed\/smaz\u00e1n\u00ed objektu\",\"Byl vytvo\u0159en nebo smaz\u00e1n kl\u00ed\u010d registru.\",\"info\",[\"B\u011b\u017en\u00e9 zm\u011bny konfigurace aplikac\u00ed\",\"Zav\u00e1d\u011bn\u00ed nebo \u00faklid perzistence p\u0159es registr\"],\"Vytvo\u0159en\u00ed kl\u00ed\u010de registru je \u010dasto sou\u010d\u00e1st\u00ed zav\u00e1d\u011bn\u00ed mechanism\u016f perzistence; smaz\u00e1n\u00ed m\u016f\u017ee znamenat, \u017ee \u00fato\u010dn\u00edk po sob\u011b ukl\u00edz\u00ed.\"],\n[13,\"Sysmon\",\"Sysmon\",\"RegistryEvent: nastaven\u00ed hodnoty\",\"Byla nastavena hodnota registru \u2013 zvl\u00e1\u0161\u0165 vysok\u00fd sign\u00e1l u b\u011b\u017en\u00fdch m\u00edst perzistence, jako jsou kl\u00ed\u010de Run.\",\"warn\",[\"Legitimn\u00ed konfigurace softwaru\",\"Zaveden\u00ed perzistence p\u0159es kl\u00ed\u010d Run nebo podobn\u00fd mechanismus\"],\"Jedna z nejcenn\u011bj\u0161\u00edch Sysmon ud\u00e1lost\u00ed pro odhalen\u00ed perzistence p\u0159es registr, proto\u017ee v\u011bt\u0161ina autorun\/Run-key technik se nakonec projev\u00ed jako nastaven\u00ed hodnoty.\"],\n[14,\"Sysmon\",\"Sysmon\",\"RegistryEvent: p\u0159ejmenov\u00e1n\u00ed kl\u00ed\u010de\/hodnoty\",\"Byl p\u0159ejmenov\u00e1n kl\u00ed\u010d nebo hodnota registru.\",\"info\",[\"B\u011b\u017en\u00e1 \u00fadr\u017eba aplikac\u00ed\"],\"M\u00e9n\u011b \u010dast\u00e9 ne\u017e zm\u011bny hodnot, ale p\u0159ejmenov\u00e1n\u00ed bezpe\u010dnostn\u011b relevantn\u00edch kl\u00ed\u010d\u016f m\u016f\u017ee znamenat pokus o ukryt\u00ed nebo p\u0159em\u00edst\u011bn\u00ed mechanismu perzistence.\"],\n[15,\"Sysmon\",\"Sysmon\",\"FileCreateStreamHash\",\"Byl vytvo\u0159en soubor s alternativn\u00edm datov\u00fdm proudem a Sysmon hashoval obsah tohoto proudu \u2013 b\u011b\u017en\u011b se objevuje u proudu 'Mark of the Web' u soubor\u016f sta\u017een\u00fdch z internetu.\",\"info\",[\"Soubory sta\u017een\u00e9 p\u0159es prohl\u00ed\u017ee\u010d nebo e-mailov\u00e9ho klienta (b\u011b\u017en\u00e9)\",\"Payload skryt\u00fd v alternativn\u00edm datov\u00e9m proudu\"],\"Proud Mark of the Web je p\u0159esn\u011b to, co chr\u00e1n\u00ed u\u017eivatele p\u0159ed makry a spustiteln\u00fdmi soubory sta\u017een\u00fdmi z internetu \u2013 sledov\u00e1n\u00ed t\u00e9to ud\u00e1losti pom\u00e1h\u00e1 odhalit i soubory, kde tato ochrana mohla b\u00fdt odstran\u011bna nebo chyb\u00ed.\"],\n[16,\"Sysmon\",\"Sysmon\",\"Zm\u011bna konfigurace Sysmonu\",\"Byla znovu na\u010dtena nebo zm\u011bn\u011bna vlastn\u00ed konfigurace Sysmonu.\",\"warn\",[\"Pl\u00e1novan\u00e9 lad\u011bn\u00ed konfigurace\",\"\u00dato\u010dn\u00edk oslabuje pokryt\u00ed logov\u00e1n\u00edm Sysmonu\"],\"\u00dato\u010dn\u00edk nebo \u0161kodliv\u00fd insider zu\u017euj\u00edc\u00ed pravidla logov\u00e1n\u00ed Sysmonu m\u00e1 funk\u010dn\u011b podobn\u00fd efekt jako vypnut\u00ed \u010d\u00e1sti va\u0161\u00ed detekce, ani\u017e by p\u0159itom slu\u017ebu \u00fapln\u011b zastavil, co\u017e se h\u016f\u0159 v\u0161imne.\"],\n[17,\"Sysmon\",\"Sysmon\",\"PipeEvent: pipe byl vytvo\u0159en\",\"Byla vytvo\u0159ena pojmenovan\u00e1 roura (named pipe), b\u011b\u017en\u011b pou\u017e\u00edvan\u00e1 pro meziprocesovou komunikaci a komunikaci C2 framework\u016f.\",\"warn\",[\"B\u011b\u017en\u00e1 meziprocesov\u00e1 komunikace\",\"Frameworky pro command-and-control (nap\u0159. pojmenovan\u00e9 roury ve stylu Cobalt Strike)\"],\"N\u011bkolik dob\u0159e zn\u00e1m\u00fdch C2 framework\u016f komunikuje p\u0159es pojmenovan\u00e9 roury s rozpoznateln\u00fdmi vzory pojmenov\u00e1n\u00ed, co\u017e z t\u00e9to \u2013 by\u0165 hlu\u010dn\u00e9 \u2013 ud\u00e1losti d\u011bl\u00e1 u\u017eite\u010dn\u00fd C2 detek\u010dn\u00ed sign\u00e1l.\"],\n[18,\"Sysmon\",\"Sysmon\",\"PipeEvent: pipe bylo p\u0159ipojeno\",\"Proces se p\u0159ipojil k existuj\u00edc\u00ed pojmenovan\u00e9 rou\u0159e.\",\"warn\",[\"B\u011b\u017en\u00e1 meziprocesov\u00e1 komunikace\",\"Komunikace C2 frameworku nebo n\u00e1stroj\u016f pro later\u00e1ln\u00ed pohyb p\u0159es pojmenovanou rouru\"],\"Ve spojen\u00ed s vytvo\u0159en\u00edm roury odhaluje komunikaci C2 frameworku nebo n\u00e1stroj\u016f pro later\u00e1ln\u00ed pohyb mezi procesy nebo stroji.\"],\n[19,\"Sysmon\",\"Sysmon\",\"WmiEvent: aktivita WmiEventFilter\",\"Byl zaregistrov\u00e1n nov\u00fd WMI event filter \u2013 b\u011b\u017en\u00fd stavebn\u00ed prvek perzistence p\u0159es WMI.\",\"crit\",[\"Legitimn\u00ed n\u00e1stroje pro syst\u00e9movou spr\u00e1vu\",\"Zav\u00e1d\u011bn\u00ed mechanismu perzistence p\u0159es WMI\"],\"Prvn\u00ed f\u00e1ze perzistence p\u0159es WMI, techniky, kter\u00e1 p\u0159e\u017eije restart a nespol\u00e9h\u00e1 se na napl\u00e1novanou \u00falohu ani slu\u017ebu, co\u017e ji \u010din\u00ed obl\u00edbenou u sofistikovan\u011bj\u0161\u00edch \u00fato\u010dn\u00edk\u016f.\"],\n[20,\"Sysmon\",\"Sysmon\",\"WmiEvent: aktivita WmiEventConsumer\",\"Byl zaregistrov\u00e1n nov\u00fd WMI event consumer (ak\u010dn\u00ed strana perzistence p\u0159es WMI).\",\"crit\",[\"Legitimn\u00ed n\u00e1stroje pro syst\u00e9movou spr\u00e1vu\",\"Zav\u00e1d\u011bn\u00ed mechanismu perzistence p\u0159es WMI\"],\"Druh\u00e1 f\u00e1ze perzistence p\u0159es WMI \u2013 consumer definuje samotnou \u0161kodlivou akci (nap\u0159. spu\u0161t\u011bn\u00ed skriptu), kter\u00e1 se vykon\u00e1, jakmile je spln\u011bna podm\u00ednka filtru.\"],\n[21,\"Sysmon\",\"Sysmon\",\"WmiEvent: aktivita WmiEventConsumerToFilter\",\"WMI consumer byl sv\u00e1z\u00e1n s filtrem, \u010d\u00edm\u017e se dokon\u010dila WMI subskripce \u2013 spolu s Event ID 19\/20 jde o kompletn\u00ed \u0159et\u011bzec perzistence p\u0159es WMI.\",\"crit\",[\"Legitimn\u00ed n\u00e1stroje pro syst\u00e9movou spr\u00e1vu\",\"Dokon\u010den\u00ed mechanismu perzistence p\u0159es WMI\"],\"Pokud vid\u00edte Event ID 19, 20 i 21 pohromad\u011b pro stejnou subskripci, je to t\u00e9m\u011b\u0159 jednozna\u010dn\u00fd d\u016fkaz zaveden\u00ed perzistence p\u0159es WMI.\"],\n[22,\"Sysmon\",\"Sysmon\",\"DNSEvent: DNS dotaz\",\"Loguje DNS dotazy prov\u00e1d\u011bn\u00e9 procesy na stroji, v\u010detn\u011b dotazovan\u00e9ho n\u00e1zvu a \u017e\u00e1daj\u00edc\u00edho procesu \u2013 cenn\u00e9 pro odhalen\u00ed command-and-control nebo exfiltrace dat p\u0159es DNS.\",\"warn\",[\"B\u011b\u017en\u00e9 DNS vyhled\u00e1v\u00e1n\u00ed aplikac\u00ed\",\"DNS tunneling nebo p\u0159elo\u017een\u00ed C2 dom\u00e9ny\"],\"DNS tunneling a DNS-based C2 jsou navr\u017een\u00e9 tak, aby splynuly s norm\u00e1ln\u011b vypadaj\u00edc\u00edm provozem, tak\u017ee logov\u00e1n\u00ed DNS dotaz\u016f na \u00farovni procesu (nikoli jen na s\u00ed\u0165ov\u00e9 vrstv\u011b) je cenn\u00e9 pro p\u0159i\u0159azen\u00ed podez\u0159el\u00fdch dotaz\u016f ke konkr\u00e9tn\u00edmu procesu.\"],\n[23,\"Sysmon\",\"Sysmon\",\"FileDelete (archivov\u00e1no)\",\"Byl smaz\u00e1n soubor odpov\u00eddaj\u00edc\u00ed nakonfigurovan\u00fdm pravidl\u016fm a Sysmon uchoval jeho kopii ve sv\u00e9m archiva\u010dn\u00edm adres\u00e1\u0159i pro pozd\u011bj\u0161\u00ed anal\u00fdzu.\",\"warn\",[\"B\u011b\u017en\u00fd \u00faklid sledovan\u00fdch typ\u016f soubor\u016f\",\"Anti-forenzn\u00ed \u00faklid po spu\u0161t\u011bn\u00ed malwaru (archivovan\u00e1 kopie zachov\u00e1v\u00e1 d\u016fkaz)\"],\"Proto\u017ee Sysmon uchov\u00e1 kopii smazan\u00e9ho souboru, tato ud\u00e1lost m\u016f\u017ee zachovat samotn\u00fd \u0161kodliv\u00fd soubor pro pozd\u011bj\u0161\u00ed anal\u00fdzu i pot\u00e9, co se ho \u00fato\u010dn\u00edk pokus\u00ed smazat \u2013 jedna z nejcenn\u011bj\u0161\u00edch forenzn\u00edch funkc\u00ed Sysmonu.\"],\n[24,\"Sysmon\",\"Sysmon\",\"ClipboardChange\",\"Do\u0161lo ke zm\u011bn\u011b obsahu syst\u00e9mov\u00e9 schr\u00e1nky.\",\"info\",[\"B\u011b\u017en\u00e9 kop\u00edrov\u00e1n\u00ed\/vkl\u00e1d\u00e1n\u00ed\",\"Kr\u00e1de\u017e p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f nebo dat p\u0159es malware sleduj\u00edc\u00ed schr\u00e1nku\"],\"Malware sleduj\u00edc\u00ed schr\u00e1nku (pou\u017e\u00edvan\u00fd ke kr\u00e1de\u017ei kryptom\u011bnov\u00fdch adres nebo p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f zkop\u00edrovan\u00fdch u\u017eivatelem) je zdokumentovan\u00e1 technika, kterou tato ud\u00e1lost m\u016f\u017ee pomoci odhalit.\"],\n[25,\"Sysmon\",\"Sysmon\",\"ProcessTampering\",\"Odhaluje techniky process hollowing nebo 'herpaderping', kdy se image procesu neshoduje s t\u00edm, co bylo p\u016fvodn\u011b spu\u0161t\u011bno.\",\"crit\",[\"Vz\u00e1cn\u00e9 u legitimn\u00edho softwaru\",\"Process hollowing\/herpaderping za \u00fa\u010delem ukryt\u00ed \u0161kodliv\u00e9ho k\u00f3du uvnit\u0159 zd\u00e1nliv\u011b legitimn\u00edho procesu\"],\"C\u00edl\u00ed p\u0159\u00edmo na process hollowing a herpaderping, sofistikovan\u00e9 techniky navr\u017een\u00e9 speci\u00e1ln\u011b tak, aby unikly antiviru i ru\u010dn\u00ed kontrole proces\u016f t\u00edm, \u017ee \u0161kodliv\u00fd k\u00f3d vypad\u00e1, \u017ee b\u011b\u017e\u00ed pod legitimn\u00ed identitou procesu.\"],\n[26,\"Sysmon\",\"Sysmon\",\"FileDeleteDetected\",\"Byl smaz\u00e1n soubor odpov\u00eddaj\u00edc\u00ed nakonfigurovan\u00fdm pravidl\u016fm (zaznamen\u00e1no bez uchov\u00e1n\u00ed kopie, na rozd\u00edl od Event ID 23).\",\"warn\",[\"B\u011b\u017en\u00fd \u00faklid sledovan\u00fdch typ\u016f soubor\u016f\",\"Maz\u00e1n\u00ed d\u016fkaz\u016f po \u0161kodliv\u00e9 aktivit\u011b\"],\"M\u016f\u017ee znamenat, \u017ee \u00fato\u010dn\u00edk nebo malware ma\u017ee vlastn\u00ed artefakty, aby zahladil stopy, ale na rozd\u00edl od Event ID 23 zde nen\u00ed uchov\u00e1na \u017e\u00e1dn\u00e1 kopie pro pozd\u011bj\u0161\u00ed anal\u00fdzu.\"],\n[27,\"Sysmon\",\"Sysmon\",\"FileBlockExecutable\",\"Sysmon zjistil a zablokoval vytvo\u0159en\u00ed spustiteln\u00e9ho souboru odpov\u00eddaj\u00edc\u00edho jeho blokovac\u00edm pravidl\u016fm.\",\"crit\",[\"Zablokovan\u00e1 legitimn\u00ed instalace softwaru (zkontrolujte pravidlo)\",\"Zablokovan\u00fd pokus o um\u00edst\u011bn\u00ed \u0161kodliv\u00e9ho spustiteln\u00e9ho souboru\"],\"\u00dasp\u011b\u0161n\u00e9 zablokov\u00e1n\u00ed je dobr\u00e1 zpr\u00e1va, ale z\u00e1rove\u0148 potvrzuje, \u017ee do\u0161lo k pokusu o um\u00edst\u011bn\u00ed spustiteln\u00e9ho souboru odpov\u00eddaj\u00edc\u00edho va\u0161im blokovac\u00edm pravidl\u016fm do sledovan\u00e9ho um\u00edst\u011bn\u00ed \u2013 stoj\u00ed za pro\u0161et\u0159en\u00ed zdroje.\"],\n[28,\"Sysmon\",\"Sysmon\",\"FileBlockShredding\",\"Sysmon zjistil a zablokoval pokus o skartov\u00e1n\u00ed\/p\u0159eps\u00e1n\u00ed souboru n\u00e1strojem pro bezpe\u010dn\u00e9 maz\u00e1n\u00ed.\",\"warn\",[\"Zablokovan\u00e9 legitimn\u00ed pou\u017eit\u00ed n\u00e1stroje pro bezpe\u010dn\u00e9 maz\u00e1n\u00ed\",\"Zablokovan\u00e9 anti-forenzn\u00ed skartov\u00e1n\u00ed souboru \u00fato\u010dn\u00edkem\"],\"Zablokovan\u00fd pokus o skartov\u00e1n\u00ed m\u016f\u017ee znamenat, \u017ee se \u00fato\u010dn\u00edk sna\u017eil bezpe\u010dn\u011b vymazat d\u016fkazy o sv\u00e9 \u010dinnosti z disku.\"],\n[29,\"Sysmon\",\"Sysmon\",\"FileExecutableDetected\",\"Sysmon zjistil vytvo\u0159en\u00ed nov\u00e9ho spustiteln\u00e9ho souboru odpov\u00eddaj\u00edc\u00edho jeho sledovac\u00edm pravidl\u016fm (detek\u010dn\u00ed prot\u011bj\u0161ek k Event ID 27, bez blokov\u00e1n\u00ed).\",\"warn\",[\"B\u011b\u017en\u00e1 instalace softwaru\",\"Nov\u011b um\u00edst\u011bn\u00fd \u0161kodliv\u00fd spustiteln\u00fd soubor\"],\"Detek\u010dn\u00ed prot\u011bj\u0161ek k FileBlockExecutable; u\u017eite\u010dn\u00e9 pro p\u0159ehled o nov\u00fdch spustiteln\u00fdch souborech objevuj\u00edc\u00edch se ve sledovan\u00fdch um\u00edst\u011bn\u00edch i tam, kde blokov\u00e1n\u00ed nen\u00ed zapnut\u00e9.\"]\n];\n\nconst $=id=>document.getElementById(id);\nconst CATS=[...new Set(DATA.map(d=>d[2]))];\nlet activeCat='all', activeLog='all', query='';\n\nfunction buildChips(){\n const chipsEl=$('lm-chips');\n chipsEl.innerHTML='';\n const all=document.createElement('button');\n all.type='button';all.className='lm-chip is-active';all.textContent='V\u0161echny kategorie';all.dataset.cat='all';\n chipsEl.appendChild(all);\n CATS.forEach(c=>{\n  const b=document.createElement('button');\n  b.type='button';b.className='lm-chip';b.textContent=c;b.dataset.cat=c;\n  chipsEl.appendChild(b);\n });\n chipsEl.addEventListener('click',e=>{\n  const b=e.target.closest('.lm-chip');if(!b)return;\n  activeCat=b.dataset.cat;\n  [...chipsEl.children].forEach(el=>el.classList.toggle('is-active',el===b));\n  render();\n });\n}\n\nfunction sevClass(s){return s==='crit'?'lm-sev-crit':s==='warn'?'lm-sev-warn':'lm-sev-info'}\nfunction sevLabel(s){return s==='crit'?'Vysok\u00fd sign\u00e1l':s==='warn'?'Prov\u011b\u0159it':'Informativn\u00ed'}\n\nfunction countLabel(n){\n \/\/ Czech pluralization: 1 \/ 2-4 \/ 0,5+\n if(n===1)return n+' nalezen\u00e9 Event ID';\n if(n>=2){ if(n<=4) return n+' nalezen\u00e1 Event ID'; }\n return n+' nalezen\u00fdch Event ID';\n}\n\nfunction matches(entry){\n const [id,log,cat,title,desc]=entry;\n if(activeLog!=='all'){ if(log!==activeLog) return false; }\n if(activeCat!=='all'){ if(cat!==activeCat) return false; }\n if(!query)return true;\n const q=query.toLowerCase();\n return String(id).includes(q) || title.toLowerCase().includes(q) || desc.toLowerCase().includes(q) || cat.toLowerCase().includes(q) || log.toLowerCase().includes(q);\n}\n\nfunction render(){\n const results=DATA.filter(matches).sort((a,b)=>a[0]-b[0]);\n $('lm-count').textContent=countLabel(results.length);\n const container=$('lm-results');\n container.innerHTML='';\n results.forEach(([id,log,cat,title,desc,sev,causes,risk])=>{\n  const card=document.createElement('div');card.className='lm-card';\n  card.innerHTML=`\n   <div class=\"lm-id-col\"><div class=\"lm-id\">${id}<\/div><span class=\"lm-sev ${sevClass(sev)}\">${sevLabel(sev)}<\/span><\/div>\n   <div class=\"lm-body\">\n    <div class=\"lm-tags\"><span class=\"lm-tag\">Log ${log}<\/span><span class=\"lm-tag\">${cat}<\/span><\/div>\n    <h4>${title}<\/h4>\n    <p class=\"lm-desc\">${desc}<\/p>\n    <div class=\"lm-risk-label\">Bezpe\u010dnostn\u00ed v\u00fdznam<\/div>\n    <p class=\"lm-risk\">${risk}<\/p>\n    <div class=\"lm-causes-label\">Obvykle se objevuje spolu s<\/div>\n    <ul class=\"lm-causes\">${causes.map(c=>`<li>${c}<\/li>`).join('')}<\/ul>\n   <\/div>`;\n  container.appendChild(card);\n });\n}\n\n$('lm-search').addEventListener('input',e=>{query=e.target.value.trim();render()});\n$('lm-log-filter').addEventListener('change',e=>{activeLog=e.target.value;render()});\nbuildChips();render();\n})();\n<\/script>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Vyhled\u00e1v\u00e1n\u00ed Event ID Windows N\u00e1stroj pro vyhled\u00e1v\u00e1n\u00ed Windows Event ID Vyhledejte Event ID z log\u016f Security,<\/p>\n","protected":false},"author":4,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"content-type":"","footnotes":""},"class_list":["post-7948","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/pages\/7948","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/comments?post=7948"}],"version-history":[{"count":5,"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/pages\/7948\/revisions"}],"predecessor-version":[{"id":7960,"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/pages\/7948\/revisions\/7960"}],"wp:attachment":[{"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/media?parent=7948"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}