Windows event log · Application103 F-Secure Anti-Virus - Manual scanning was finished - workstation was found infected / F-Secure Anti-Virus Detection

  • Application
  • 4 fields
  • Application.evtx
  • FSecure-FSecure Application-F-Secure Anti-VirusFSecure-FSecure-F-Secure Anti-Virus

F-Secure Anti-Virus - Manual scanning was finished - workstation was found infected

Provider FSecure-FSecure Application-F-Secure Anti-Virus

  • PayloadData1%PayloadData1%
    • %PayloadData1% = /Event/EventData/Data[@Name="MessageText"]
  • PayloadData2%PayloadData2%
    • %PayloadData2% = /Event/EventData/Data[@Name="UserName"]

F-Secure Anti-Virus Detection

Provider FSecure-FSecure-F-Secure Anti-Virus

  • UserName%UserName%
    • %UserName% = /Event/EventData/Data
  • PayloadData1%PayloadData1%
    • %PayloadData1% = /Event/EventData/Data

Sample event

FSecure-FSecure Application-F-Secure Anti-Virus event XML

<Event>
  <System>
    <Provider Name="FSecure-FSecure Application-F-Secure Anti-Virus" Guid="14226663-5b17-4fcc-b09b-4d2644e4a1e7"/>
    <EventID>103</EventID>
    <Version>0</Version>
    <Level>1</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2024-01-06 20:50:27.6710933"/>
    <EventRecordID>706</EventRecordID>
    <Correlation/>
    <Execution ProcessID="3096" ThreadID="2272"/>
    <Channel>Application</Channel>
    <Computer>User-PC</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="MessageText">Manual scanning was finished - workstation was found infected!</Data>
    <Data Name="TrapTimestamp">1704574227</Data>
    <Data Name="TrapId">103</Data>
    <Data Name="TrapNumber">9</Data>
    <Data Name="Severity">5</Data>
    <Data Name="HostName">user-pc</Data>
    <Data Name="UserName">User-PC\User</Data>
    <Data Name="ProductOID">1.3.6.1.4.1.2213.12</Data>
    <Data Name="ProductName">F-Secure Anti-Virus</Data>
    <Data Name="ParamCount">0</Data>
    <Data Name="Param"></Data>
  </EventData>
</Event>

Sample event

FSecure-FSecure-F-Secure Anti-Virus event XML

<Event>
  <System>
    <Provider Name="FSecure-FSecure-F-Secure Anti-Virus"/>
    <EventID Qualifiers="49152">103</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2024-01-06 18:57:22.0000000"/>
    <EventRecordID>732</EventRecordID>
    <Channel>Application</Channel>
    <Computer>User-PC</Computer>
    <Security/>
  </System>
  <EventData>
    <Data>2  2024-01-06  18:57:21+00:00  user-pc  User-PC\User  F-Secure Anti-Virus
 Malicious code found in file C:\Users\User\Downloads\mimikatz_trunk\Win32\mimilove.exe.
 Infection: Heuristic.HEUR/AGEN.1221331
 Action: The file was deleted.</Data>
    <Binary></Binary>
  </EventData>
</Event>

Source: evtx/Maps/Application_FSecure-FSecure-Application-F-Secure-Anti-Virus_103.map(opens in new tab), evtx/Maps/Application_FSecure-FSecure-F-Secure-Anti-Virus_103.map(opens in new tab) by Reece394 and contributors(opens in new tab), MIT License(opens in new tab)