DFIRHub

Windows event log ยท Microsoft-Windows-AppID/Operational4004 Code Signature Verification

  • Defender and policy
  • 3 fields
  • Microsoft-Windows-AppID%4Operational.evtx
  • Microsoft-Windows-AppID

Fields EvtxECmd extracts

3 columns in the EvtxECmd CSV

  • ExecutableInfo%FilePath%
    • %FilePath% = /Event/UserData/FilePathPublisherNameAndStatusData/FilePath
  • PayloadData1%PublisherName%
    • %PublisherName% = /Event/UserData/FilePathPublisherNameAndStatusData/PublisherName
  • PayloadData2%Status%
    • %Status% = /Event/UserData/FilePathPublisherNameAndStatusData/Status

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-AppID" ="{3cb2a168-fe19-4a4e-bdad-dcf422f13473}"/>
    <EventID>4004</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2019-10-23 00:07:54.6428199"/>
    <EventRecordID>4154</EventRecordID>
    <Correlation ActivityID="94c65781-35fd-4f10-a688-6e30c9a9a423"/>
    <Execution ProcessID="868" ThreadID="4056"/>
    <Channel>Microsoft-Windows-AppID/Operational</Channel>
    <Computer>xxxxxxxxxx</Computer>
    <Security UserID="S-1-5-19"/>
  </System>
  <UserData>
    <FilePathPublisherNameAndStatusData>
      <FilePathLength>39</FilePathLength>
      <FilePath>\\?\C:\Windows\System32\wsmprovhost.exe</FilePath>
      <PublisherNameLength>54</PublisherNameLength>
      <PublisherName>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US</PublisherName>
      <Status>0x0</Status>
    </FilePathPublisherNameAndStatusData>
  </UserData>
</Event>

References

1 link

Source: evtx/Maps/Microsoft-Windows-AppID-Operational_Microsoft-Windows-AppID_4004.map(opens in new tab) by Phill Moore and contributors(opens in new tab), MIT License(opens in new tab)