Windows event log · Application103 F-Secure Anti-Virus - Manual scanning was finished - workstation was found infected / F-Secure Anti-Virus Detection
- Application
- 4 fields
Application.evtxFSecure-FSecure Application-F-Secure Anti-VirusFSecure-FSecure-F-Secure Anti-Virus
F-Secure Anti-Virus - Manual scanning was finished - workstation was found infected
Provider FSecure-FSecure Application-F-Secure Anti-Virus
- PayloadData1
%PayloadData1%- %PayloadData1% = /Event/EventData/Data[@Name="MessageText"]
- PayloadData2
%PayloadData2%- %PayloadData2% = /Event/EventData/Data[@Name="UserName"]
F-Secure Anti-Virus Detection
Provider FSecure-FSecure-F-Secure Anti-Virus
- UserName
%UserName%- %UserName% = /Event/EventData/Data
- PayloadData1
%PayloadData1%- %PayloadData1% = /Event/EventData/Data
Sample event
FSecure-FSecure Application-F-Secure Anti-Virus event XML
<Event>
<System>
<Provider Name="FSecure-FSecure Application-F-Secure Anti-Virus" Guid="14226663-5b17-4fcc-b09b-4d2644e4a1e7"/>
<EventID>103</EventID>
<Version>0</Version>
<Level>1</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2024-01-06 20:50:27.6710933"/>
<EventRecordID>706</EventRecordID>
<Correlation/>
<Execution ProcessID="3096" ThreadID="2272"/>
<Channel>Application</Channel>
<Computer>User-PC</Computer>
<Security UserID="S-1-5-18"/>
</System>
<EventData>
<Data Name="MessageText">Manual scanning was finished - workstation was found infected!</Data>
<Data Name="TrapTimestamp">1704574227</Data>
<Data Name="TrapId">103</Data>
<Data Name="TrapNumber">9</Data>
<Data Name="Severity">5</Data>
<Data Name="HostName">user-pc</Data>
<Data Name="UserName">User-PC\User</Data>
<Data Name="ProductOID">1.3.6.1.4.1.2213.12</Data>
<Data Name="ProductName">F-Secure Anti-Virus</Data>
<Data Name="ParamCount">0</Data>
<Data Name="Param"></Data>
</EventData>
</Event>Sample event
FSecure-FSecure-F-Secure Anti-Virus event XML
<Event>
<System>
<Provider Name="FSecure-FSecure-F-Secure Anti-Virus"/>
<EventID Qualifiers="49152">103</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2024-01-06 18:57:22.0000000"/>
<EventRecordID>732</EventRecordID>
<Channel>Application</Channel>
<Computer>User-PC</Computer>
<Security/>
</System>
<EventData>
<Data>2 2024-01-06 18:57:21+00:00 user-pc User-PC\User F-Secure Anti-Virus
Malicious code found in file C:\Users\User\Downloads\mimikatz_trunk\Win32\mimilove.exe.
Infection: Heuristic.HEUR/AGEN.1221331
Action: The file was deleted.</Data>
<Binary></Binary>
</EventData>
</Event>Source: evtx/Maps/Application_FSecure-FSecure-Application-F-Secure-Anti-Virus_103.map(opens in new tab), evtx/Maps/Application_FSecure-FSecure-F-Secure-Anti-Virus_103.map(opens in new tab) by Reece394 and contributors(opens in new tab), MIT License(opens in new tab)