新建服务：eventlog[System,,,"Service control Manager",^7045$,,skip]
新建任务计划：eventlog[Microsoft-Windows-TaskScheduler/Operational,,,"TaskScheduler",^106$,,skip]
删除任务计划：eventlog["Microsoft-Windows-TaskScheduler/Operational",,,"TaskScheduler",^141$,,skip]
修改组策略：eventlog[Security,,,,4739,,]
删除安全日志：eventlog[Security,,,,1102,,]
删除用户：eventlog[Security,,,,4726,,]
用户登录：eventlog[Security,,,,4722,,]
A member was added to a security-enabled global group：eventlog[Security,,,,4728,,]
trigger：
{Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].logseverity(0)}>1 and {Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].nodata(600)}=0 and ({Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].str(Admins)}=1 or {Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].str(Management)}=1 or {Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].str(Group Policy)}=1 or {Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].str(RODC)}=1 or {Template Windows AD DS Security Audit:eventlog[Security,,,,^4728$].str(Controllers)}=1 )