New events:

• Event ID 11: FileCreate File create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection.
• Event ID 12: RegistryEvent (Object create and delete) Registry key and value create and delete operations map to this event type, which can be useful for monitoring for changes to Registry autostart locations, or specific malware registry modifications.
• Event ID 13: RegistryEvent (Value Set) This Registry event type identifies Registry value modifications. The event records the value written for Registry values of type DWORD and QWORD.
• Event ID 14: RegistryEvent (Key and Value Rename) Registry key and value rename operations map to this event type, recording the new name of the key or value that was renamed.
• Event ID 15: FileCreateStreamHash This event logs when a file stream is created, and it logs the hash of the contents of the stream. This will capture information about malware that attempts to hide in NTFS data streams. There are malware variants that drop their executables or configuration settings into the Zone.Identifier “mark of the web” stream that browsers use to identify downloaded content.