security_content/data_sources/endpoint/Sysmon_Event_ID_1.yml at develop · Elmo-Riyani/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
name: Sysmon Event ID 1
id: 398e5e07-226e-474e-91c8-a22a995e2bb8
date: '2022-09-13'
author: Patrick Bareiss, Splunk
type: sysmon
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
category: process_creation
product: windows
supported_TA:
- name: Splunk Add-on for Sysmon
  version: 3.0.0
  url: https://splunkbase.splunk.com/app/5709/
references:
- https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
supported_targets:
  - Endpoint.Processes
  - Windows Security 4688
  - Crowdstrike Process
raw_fields:
  - ProcessGuid
  - ProcessId
  - Image
  - CommandLine
  - CurrentDirectory
  - User
  - IntegrityLevel
  - Hashes
  - ParentProcessGuid
  - ParentProcessId
  - ParentImage
  - ParentCommandLine
  - Computer
field_mappings:
  - data_model: cim
    data_set: Endpoint.Processes
    mapping:
      ProcessGuid: Processes.process_guid
      ProcessId: Processes.process_id
      Image: Processes.process_path
      Image|endswith: Processes.process_name
      CommandLine: Processes.process
      CurrentDirectory: Processes.process_current_directory
      User: Processes.user
      IntegrityLevel: Processes.process_integrity_level
      Hashes: Processes.process_hash
      ParentProcessGuid: Processes.parent_process_guid
      ParentProcessId: Processes.parent_process_id
      ParentImage: Processes.parent_process_name
      ParentCommandLine: Processes.parent_process
      Computer: Processes.dest
      OriginalFileName: Processes.original_file_name
convert_to_log_source:
  - data_source: Windows Security 4688
    mapping:
      ProcessId: NewProcessId
      Image: NewProcessName
      Image|endswith: NewProcessName|endswith
      CommandLine: Process_Command_Line
      User: SubjectUserSid
      ParentProcessId: ProcessId
      ParentImage: ParentProcessName
      ParentImage|endswith: ParentProcessName|endswith
      Computer: Computer
      OriginalFileName: NewProcessName|endswith
  - data_source: Crowdstrike Process
    mapping:
      ProcessId: RawProcessId
      Image: ImageFileName
      CommandLine: CommandLine
      User: UserSid
      ParentProcessId: ParentProcessId
      ParentImage: ParentBaseFileName