πŸ”
Windows Forensic Handbook
Ctrlk
  • πŸ‘‹Welcome
  • Artifacts by Type
    • πŸ—„οΈRegistry Artifacts
    • πŸ“‚Filesystem Artifacts
    • πŸ“…Event Log Artifacts
  • Artifacts by Activity
    • πŸƒβ€β™‚οΈExecution
    • πŸ—’οΈFile Activity
    • πŸ‘¨β€πŸ”§Account Activity
    • 🌎Network Activity
      • Evidence of Network Activity
      • Destination Identification
      • Source Identification
      • Transmit Volume
      • Firewall Activity
        • EventID 2004: Firewall Rule Added
        • EventID 2005: Firewall Rule Modified
        • EventID 2006: Firewall Rule Deleted
        • EventID 2071: Firewall Rule Added
        • EventID 2073: Firewall Rule Modified
        • EventID 2052: Firewall Rule Deleted
        • EventID 4104: PowerShell Script Block Logging
      • Wireless Activity
    • πŸ”Browser Activity
    • πŸ–₯️System Enumeration
Powered by GitBook
On this page
  1. Artifacts by Activity
  2. 🌎Network Activity

Firewall Activity

EventID 2004: Firewall Rule AddedEventID 2005: Firewall Rule ModifiedEventID 2006: Firewall Rule DeletedEventID 2071: Firewall Rule AddedEventID 2073: Firewall Rule ModifiedEventID 2052: Firewall Rule DeletedEventID 4104: PowerShell Script Block Logging

Last updated 2 years ago