EVID 1 : Process Created Log Messages

https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

https://in.security/2021/10/18/getting-started-with-sysmon-for-linux/

EVID 1: Process Created Log Messages

Base Rule

Task Created

Other Audit

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Provider

N/A

N/A

Identifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.

EventID

<vmid>

Number

The identifier that the provider used to identify the event.

Version

N/A

N/A

The version number of the event's definition.

Level

<severity>

Text/String/Number

The severity level defined in the event.

Task

<vendorinfo>

Text/String/Number

The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Opcode

N/A

N/A

The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Keywords

<result>

Text/String

A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).

TimeCreated 

N/A

N/A

The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.

EventRecordID

N/A

N/A

The record number assigned to the event when it was logged.

Correlation

N/A

N/A

The activity identifiers that consumers can use to group related events together.

Execution

N/A

N/A

Contains information about the process and thread that logged the event.

Channel

N/A

N/A

The channel to which the event was logged.

Computer

<dname>

Text/String

The name of the computer on which the event occurred.

Security

N/A

N/A

N/A

RuleName

<policy>

Text/String

N/A

UtcTime

N/A

N/A

N/A

ProcessGuid

N/A

N/A

The ProcessGUID field is a unique value for this process across a domain to make event correlation easier

ProcessId

<processid>

Number

A semi-unique (unique between reboots) number that identifies the process.  Process ID allows you to correlate other events logged during the same process.  To determine when the program ended look for a subsequent event 4689 with the same Process ID.

Image

<process>

Text/String

The full path of the executable

FileVersion

N/A

N/A

N/A

Description

N/A

N/A

N/A

Product

N/A

N/A

N/A

Company

N/A

N/A

N/A

OriginalFileName

N/A

N/A

N/A

CommandLine

<command>

Text/String

This field documents the command line arguments (including any passwords) passed into the EXE when the process was started

CurrentDirectory

N/A

N/A

N/A

User

<login>
<domainorigin>

Text/String

N/A

LogonGuid

N/A

N/A

N/A

LogonId

<session>

Text/String/Number

hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID

TerminalSessionId

N/A

N/A

This is the unique Terminal Session ID

IntegrityLevel

N/A

N/A

N/A

Hashes

<hash>

Text/String

The hash is a full hash of the file

ParentProcessGuid

N/A

N/A

Identifies the processes GUID that started this process

ParentProcessId

<parentprocessid>

Number

Identifies the processes ID that started this process

ParentImage

<parentprocesspath>
<parentprocessname>

Text/String

N/A

ParentCommandLine

<object>

Text/String

N/A

ParentUser

N/A

N/A

N/A