tstats_endpoint_processes

Malicious events

| tstats count as count values(Processes.action) as action,
values(Processes.cpu_load_percent) as cpu_load_percent,
values(Processes.dest) as dest,
values(Processes.mem_used) as mem_used,
values(Processes.os) as os,
values(Processes.parent_process) as parent_process,
values(Processes.parent_process_exec) as parent_process_exec,
values(Processes.parent_process_id) as parent_process_id,
values(Processes.parent_process_guid) as parent_process_guid,
values(Processes.parent_process_name) as parent_process_name,
values(Processes.parent_process_path) as parent_process_path,
values(Processes.process) as process,
values(Processes.process_current_directory) as process_current_directory,
values(Processes.process_exec) as process_exec,
values(Processes.process_hash) as process_hash,
values(Processes.process_guid) as process_guid,
values(Processes.process_id) as process_id,
values(Processes.process_integrity_level) as process_integrity_level,
values(Processes.process_name) as process_name,
values(Processes.process_path) as process_path,
values(Processes.tag) as tag,
values(Processes.user) as user,
values(Processes.user_id) as user_id,
values(Processes.vendor_product) as vendor_product,
values(host) as host,
values(source) as source,
values(sourcetype) as sourcetype
from datamodel=Endpoint.Processes
where (Processes.process_name=reg.exe
  OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security*
  OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System*
  OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*)
by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id


Not mailicous events
| tstats count as count values(Processes.action) as action,
values(Processes.cpu_load_percent) as cpu_load_percent,
values(Processes.dest) as dest,
values(Processes.mem_used) as mem_used,
values(Processes.os) as os,
values(Processes.parent_process) as parent_process,
values(Processes.parent_process_exec) as parent_process_exec,
values(Processes.parent_process_id) as parent_process_id,
values(Processes.parent_process_guid) as parent_process_guid,
values(Processes.parent_process_name) as parent_process_name,
values(Processes.parent_process_path) as parent_process_path,
values(Processes.process) as process,
values(Processes.process_current_directory) as process_current_directory,
values(Processes.process_exec) as process_exec,
values(Processes.process_hash) as process_hash,
values(Processes.process_guid) as process_guid,
values(Processes.process_id) as process_id,
values(Processes.process_integrity_level) as process_integrity_level,
values(Processes.process_name) as process_name,
values(Processes.process_path) as process_path,
values(Processes.tag) as tag,
values(Processes.user) as user,
values(Processes.user_id) as user_id,
values(Processes.vendor_product) as vendor_product,
values(host) as host,
values(source) as source,
values(sourcetype) as sourcetype
from datamodel=Endpoint.Processes
where NOT((Processes.process_name=reg.exe
  OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security*
  OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System*
  OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*))
by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id