Breadcrumbs

EVID 7 : Image Loaded (Sysmon)

Event Details

Event Type

Image Loaded

Event Description

7 : Logs when a module is loaded in a specific process.

Event ID

7

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field

LogRhythm Default

LogRhythm Default v2.0

Provider

N/A

N/A

EventID

<vmid>

<vmid>

Version

 <version>

N/A

Level

<severity>

<severity>

Task

<vendorinfo>, <subject>

<vendorinfo>

Opcode

N/A

N/A

Keywords

N/A

<result>

TimeCreated 

N/A

N/A

EventRecordID

N/A

N/A

Correlation 

N/A

N/A

Execution 

 <processid>

N/A

Channel

N/A

N/A

Computer

<dname>

<dname>

Security 

<domain>, <login>

N/A

ProcessGUID

N/A

N/A

ProcessID

<processid>

<processid>

Image

<object>

<process> 

FileVersion

N/A

N/A

ImageLoaded

<objectname>

<object>

Hashes

N/A

<hash>

SHA256

<hash>

N/A

MD5

<hash>

N/A

Signed

N/A

N/A

Signature

N/A

N/A

SignatureStatus

N/A

N/A

Userid

N/A

N/A

RuleName

N/A

<policy>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID

Rule Name

Rule Type

Common Events

Classifications

1009237

EVID 7 : Image Loaded

Base Rule

File Opened

Information

LogRhythm Default v2.0 

Regex ID

Rule Name

Rule Type

Common Events

Classifications

1011223

V 2.0 : Object Loaded

Base Rule

Object Initialized

Access Success

V 2.0 : EVID 6 : Driver Loaded

Sub Rule

Object Initialized

Access Success

V 2.0 : EVID 7 : Image Loaded

Sub Rule

Object Initialized

Access Success