New security capabilities of Event Tracing for Windows

The Event Tracing for Windows has recently received nine improvements to facilitate better cybersecurity threat diagnosis. Specifically, the security-related events now have the Process ID and Process Start Key added to their event schema, which allows for the identification of their causal process. This means that users can use the Windows Event Viewer more effectively for security auditing and diagnostics. The events that have received improvements include, but are not limited to, scheduled task creation/deletion/updates, security audit log clearing, and service installation. By adding the initiating process to the event payload, the likelihood of misunderstanding the cause of each event is significantly reduced. These improvements are already available on all Windows versions. Additional instructions, screenshots, and examples can be found in the link.

The post New security capabilities of Event Tracing for Windows originally appeared on M365 Admin.