1,Win-Sysmon-1-Create-Process
2,Win-Sysmon-2-FileCreation-Time-Changed
3,"Win-Sysmon-3-Network-Connection-IPv4,Win-Sysmon-3-Network-Connection-IPv6"
5,Win-Sysmon-5-Process-Terminated
6,Win-Sysmon-6-Driver-Loaded
7,Win-Sysmon-7-Image-Loaded
8,Win-Sysmon-8-CreateRemoteThread
9,Win-Sysmon-9-RawAccessRead
10,Win-Sysmon-10-ProcessAccess
11,Win-Sysmon-11-FileCreate
12,"Win-Sysmon-12-Registry-CreateKey,Win-Sysmon-12-Registry-DeleteKey,Win-Sysmon-12-Registry-CreateValue,Win-Sysmon-12-Registry-DeleteValue"
13,Win-Sysmon-13-Registry-SetValue
14,"Win-Sysmon-14-Registry-RenameKey,Win-Sysmon-14-Registry-RenameValue"
15,Win-Sysmon-15-FileCreateStreamHash
16,Win-Sysmon-16-SysmonConfigStateChanged
17,Win-Sysmon-17-PipeCreated
18,Win-Sysmon-18-PipeConnected
19,Win-Sysmon-19-WMIEventFilterActivity
20,Win-Sysmon-20-WMIEventConsumerActivity
21,Win-Sysmon-21-WMIEventConsumerToFilterActivity
22,Win-Sysmon-22-DNSQuery
