DFIRHub

Windows event log · Application1 Carbon Black Defense / Cylance alert / An attempt to exploit a known vulnerability detected

  • Application
  • 10 fields
  • Application.evtx
  • CbDefenseCylanceSvcMicrosoft-Windows-Audit-CVE

Carbon Black Defense

Provider CbDefense

  • PayloadData1Data: %Data%
    • %Data% = /Event/EventData/Data

Cylance alert

Provider CylanceSvc

  • ExecutableInfoFile Path: %FilePath%
    • %FilePath% = /Event/EventData/Data
  • PayloadData1%Message%
    • %Message% = /Event/EventData/Data
  • PayloadData2%IpAddress% [%Device%]
    • %IpAddress% = /Event/EventData/Data
    • %Device% = /Event/EventData/Data
  • PayloadData3MAC Address:%MAC%
    • %MAC% = /Event/EventData/Data
  • PayloadData4Cylance Score:%CylanceScore%
    • %CylanceScore% = /Event/EventData/Data
  • PayloadData5Running:%Running% | AutoRun:%AutoRun%
    • %Running% = /Event/EventData/Data
    • %AutoRun% = /Event/EventData/Data
  • PayloadData6SHA256:%SHA256%
    • %SHA256% = /Event/EventData/Data

An attempt to exploit a known vulnerability detected

Provider Microsoft-Windows-Audit-CVE

  • PayloadData1%CVEID%
    • %CVEID% = /Event/EventData/Data[@Name="CVEID"]
  • PayloadData2%AdditionalDetails%
    • %AdditionalDetails% = /Event/EventData/Data[@Name="AdditionalDetails"]

Sample event

CbDefense event XML

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <Event>
    <System>
      <Provider Name="CbDefense"/>
      <EventID Qualifiers="32770">1</EventID>
      <Level>3</Level>
      <Task>0</Task>
      <Keywords>0x80000000000000</Keywords>
      <TimeCreated SystemTime="2021-07-22 10:07:04.0000000"/>
      <EventRecordID>79686</EventRecordID>
      <Channel>Application</Channel>
      <Computer>HOSTNAME</Computer>
      <Security/>
    </System>
    <EventData>
      <Data>CbDefense, CbDefense Debug Port has been opened</Data>
      <Binary></Binary>
    </EventData>
  </Event>

Sample event

CylanceSvc event XML

<Event>
  <System>
    <Provider Name="CylanceSvc"/>
    <EventID Qualifiers="0">1</EventID>
    <Level>4</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-05-15 10:32:40.0000000"/>
    <EventRecordID>178229</EventRecordID>
    <Channel>Application</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security/>
  </System>
  <EventData>
    <Data>A threat has been quarantined
Device: HOSTNAME; IP: 10.2.11.13; MAC: A4-1F-66-32-26-0F
File path: C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\random\ShipmentTracker-123456[1].exe
Cylance Score: -13
Running: False, Auto Run: False
Sha256: 8E5AD8F6707B8FA834DCDC728D83238C2007A6ED6794F77A569FE84358703C6D</Data>
    <Binary></Binary>
  </EventData>
</Event>

Sample event

Microsoft-Windows-Audit-CVE event XML

<System>
  <Provider Name="Microsoft-Windows-Audit-CVE" Guid="{85a62a0d-7e17-485f-9d4f-749a287193a6}"/>
  <EventID>1</EventID>
  <Version>0</Version>
  <Level>3</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8000000000000000</Keywords>
  <TimeCreated SystemTime="2020-01-15T23:53:36.821170000Z"/>
  <EventRecordID>32459</EventRecordID>
  <Correlation/>
  <Execution ProcessID="19928" ThreadID="15488"/>
  <Channel>Application</Channel>
  <Computer>xxxxxxxxxxxxxxxxxx</Computer>
  <Security UserID="xxxxxxxxxxxxxxxxxxxxxxxxx"/>
</System>
<EventData>
  <Data Name="CVEID">[CVE-2020-0601] cert validation</Data>
  <Data Name="AdditionalDetails">
    CA:
    <@DidierStevens>sha1: 7A036FBBDBF7F29A3821A8087CE177E60927A6F3 para: something otherPara: something</Data>
  </EventData>

References

3 links

Source: evtx/Maps/Application_CarbonBlackDefense_1.map(opens in new tab), evtx/Maps/Application_CylanceSvc_1.map(opens in new tab), evtx/Maps/Application_Microsoft-Windows-Audit-CVE_1.map(opens in new tab) by Andrew Rathbun, Troy Larson and contributors(opens in new tab), MIT License(opens in new tab)