EVID 9 : Raw Access Read Log Messages
Vendor Documentation
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon https://in.security/2021/10/18/getting-started-with-sysmon-for-linux/ |
Classification
Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|
EVID 9 : Raw Access Read Log Messages | Base Rule | Object Accessed | Access Success |
Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
Provider | N/A | N/A | Identifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event. |
EventID | <vmid> | Number | The identifier that the provider used to identify the event. |
Version | N/A | N/A | The version number of the event's definition. |
Level | <severity> | Text/String/Number | The severity level defined in the event. |
Task | <vendorinfo> | Text/String/Number | The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. |
Opcode | N/A | N/A | The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. |
Keywords | <result> | Text/String | A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data). |
TimeCreated | N/A | N/A | The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute. |
EventRecordID | N/A | N/A | The record number assigned to the event when it was logged. |
Correlation | N/A | N/A | The activity identifiers that consumers can use to group related events together. |
Execution | N/A | N/A | Contains information about the process and thread that logged the event. |
Channel | N/A | N/A | The channel to which the event was logged. |
Computer | <dname> | Text/String | The name of the computer on which the event occurred. |
Security | N/A | N/A | N/A |
RuleName | <policy> | Text/String | N/A |
UtcTime | N/A | N/A | N/A |
ProcessGuid | N/A | N/A | The ProcessGUID field is a unique value for this process across a domain to make event correlation easier |
ProcessId | <processid> | Number | A semi-unique (unique between reboots) number that identifies the process. Process ID allows you to correlate other events logged during the same process. |
Image | <process> | Text/String | The full path of the executable |
Device | <object> | Text/String | N/A |
User | <login> | Text/String | N/A |