EVID 400, 403, 600
Vendor Documentation
Classification
Rule Name | Rule Type | Classification | Common Event |
|---|---|---|---|
EVID 400/403/600 | Base Rule | Audit : Other Audit | MS Windows PowerShell Event |
EVID 400 : PS Activity Started | Sub Rule | Startup and Shutdown | Process/Service Started |
EVID 403 : PS Activity Stopped | Sub Rule | Startup and Shutdown | Process/Service Stopped |
EVID 600 : PS Provider Started | Sub Rule | Startup and Shutdown | Process/Service Started |
Mapping with LogRhythm Schema
| Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
|---|---|---|---|
| Provider Name | N/A | N/A | Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event. |
| EventID Qualifiers="0" | <vmid> | Number | The identifier that the provider used to identify the event. |
| Level | <severity> | Text/String | The severity level defined in the event. |
| Task | <vendorinfo> | Text/String | The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. |
| Keywords | N/A | N/A | A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data). |
| TimeCreated | N/A | N/A | The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute. |
| EventRecordID | N/A | N/A | The record number assigned to the event when it was logged. |
| Channel | N/A | N/A | The channel to which the event was logged. |
| Computer | <dname> | Text/String | The name of the computer on which the event occurred. |
| Security | N/A | N/A | N/A |
| NewEngineState | <status> | Text/String | N/A |
| PreviousEngineState | N/A | N/A | N/A |
| ProviderName | N/A | N/A | N/A |
| NewProviderState | <status> | Text/String | N/A |
| SequenceNumber | N/A | N/A | N/A |
| HostName | <account> | Text/String | N/A |
| HostVersion | N/A | N/A | N/A |
| HostId | N/A | N/A | N/A |
| HostApplication | N/A | N/A | N/A |
| EngineVersion | N/A | N/A | N/A |
| RunspaceId | N/A | N/A | N/A |
| PipelineId | N/A | N/A | N/A |
| CommandName | N/A | N/A | N/A |
| CommandType | N/A | N/A | N/A |
| ScriptName | N/A | N/A | N/A |
| CommandPath | N/A | N/A | N/A |
| CommandLine | <command> | Text/String | N/A |