| 1 |
Microsoft-Windows-Sysmon/Operational |
1 |
Process Create (rule: ProcessCreate) |
Process Create.
- LogonGuid/LogonId: ID of the logon session
- ParentProcessGuid/ParentProcessId: Process ID of the parent process
- ParentImage: Executable file of the parent process
- CommandLine: Command line of the execution command (the option contains changed timestamp items and the data after change)
- ParentCommandLine: Command line of the parent process
- UtcTime: Process execution date and time (UTC)
- ProcessGuid/ProcessId: Process ID
- User: Execute as user
- Hashes: Hash value of the executable file
- Image: Path to the executable file (executable file name of the tool)
|
| Security |
4688 |
Process Create |
A new process has been created.
- Process Information > Required Label: Necessity of privilege escalation (Mandatory Label\High Mandatory Level)
- Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
- Process Information > Source Process Name: Path to the parent process that created the new process. A record is confirmed on Windows 10 only.
- Log Date and Time: Process execution date and time (local time)
- Process Information > New Process Name: Path to the executable file (executable file name of the tool)
- Process Information > Token Escalation Type: Presence of privilege escalation (1)
- Process Information > New Process ID: Process ID (hexadecimal)
- Process Information > Source Process ID: Process ID of the parent process that created the new process. "Creator Process ID" in Windows 7
- Subject > Logon ID: Session ID of the user who executed the process
|
| 2 |
Security |
4656 |
File System/Other Object Access Events |
A handle to an object was requested.
- Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (WriteData or AddFile, AppendData)
- Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID: Session ID of the user who executed the process
- Object > Handle ID: ID of the relevant handle
- Object > Object Name: Target file name (C:\Windows\Prefetch\[Executable File Name of Tool]-[RANDOM].pf)
|
| Security |
4663 |
File System |
An attempt was made to access an object.
- Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (WriteData or AddFile, AppendData)
- Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
- Object > Object Name: Target file name (C:\Windows\Prefetch\[Executable File Name of Tool]-[RANDOM].pf)
- Process Information > Process Name: Name of the process that closed the handle (C:\Windows\System32\svchost.exe)
- Subject > Logon ID: Session ID of the user who executed the process
- Object > Handle ID: ID of the relevant handle (Handle ID requested in the Event ID: 4656 before)
|
| Security |
4658 |
File System |
The handle to an object was closed.
- Process Information > Process ID: Process ID (hexadecimal)
- Process Information > Process Name: Name of the process that requested the object
- Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID: Session ID of the user who executed the process
- Object > Handle ID: ID of the relevant handle
|
| 3 |
Microsoft-Windows-Sysmon/Operational |
2 |
File creation time changed (rule: FileCreateTime) |
File creation time changed.
- UtcTime: Date and time the change occurred (UTC)
- TargetFilename: Name of the file changed
- PreviousCreationUtcTime: Old timestamp (UTC)
- CreationUtcTime: New timestamp (UTC)
|
| Microsoft-Windows-Sysmon/Operational |
9 |
RawAccessRead detected (rule: RawAccessRead) |
RawAccessRead detected.
- Device: Name of the device that has the target file
- Image: Path to the executable file (executable file name of the tool)
|
| Security |
4656 |
File System/Other Object Access Events |
A handle to an object was requested.
- Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (SYNCHRONIZE, ReadAttributes, WriteAttributes)
- Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID: Session ID of the user who executed the process
- Object > Handle ID: ID of the relevant handle
- Object > Object Name: Target file name (file in which the timestamp was changed)
|
| Security |
4663 |
File System |
An attempt was made to access an object.
- Audit Success: Success or fail (Access successful) (If success, the timestamp was changed successfully.)
- Access Request Information > Access/Reason for Access/Access Mask: Requested privileges (WriteAttributes)
- Subject > Security ID/Account Name/Account Domain: SID/Account name/Domain of the user who executed the tool
- Object > Handle ID: ID of the relevant handle (Handle ID requested in the Event ID: 4656 before)
- Object > Object Name: Target file name (file in which the timestamp was changed)
|
| Security |
4658 |
File System |
The handle to an object was closed.
- Process Information > Process Name: Name of the process that requested the object (tool executable file name)
- Object > Handle ID: ID of the relevant handle (Handle ID requested in the Event ID: 4656 before)
|
| 4 |
Security |
4689 |
Process Termination |
A process has exited.
- Log Date and Time: Process terminated date and time (local time)
- Process Information > Exit Status: Process return value
- Process Information > Process Name: Path to the executable file (executable file name of the tool)
|
| Microsoft-Windows-Sysmon/Operational |
5 |
Process terminated (rule: ProcessTerminate) |
Process terminated.
- UtcTime: Process terminated date and time (UTC)
- ProcessGuid/ProcessId: Process ID
- Image: Path to the executable file (executable file name of the tool)
|