DFIRHub

Windows event log ยท Application2 Cylance alert

  • Application
  • 7 fields
  • Application.evtx
  • CylanceSvc

Fields EvtxECmd extracts

7 columns in the EvtxECmd CSV

  • ExecutableInfoFile Path: %FilePath%
    • %FilePath% = /Event/EventData/Data
  • PayloadData1%Message%
    • %Message% = /Event/EventData/Data
  • PayloadData2%IpAddress% [%Device%]
    • %IpAddress% = /Event/EventData/Data
    • %Device% = /Event/EventData/Data
  • PayloadData3MAC Address:%MAC%
    • %MAC% = /Event/EventData/Data
  • PayloadData4ProcessID: %ProcessID%
    • %ProcessID% = /Event/EventData/Data
  • PayloadData5ViolationType: %ViolationType%
    • %ViolationType% = /Event/EventData/Data
  • PayloadData6SHA256:%SHA256%
    • %SHA256% = /Event/EventData/Data

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="CylanceSvc"/>
    <EventID Qualifiers="0">2</EventID>
    <Level>4</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-05-15 10:32:40.0000000"/>
    <EventRecordID>178229</EventRecordID>
    <Channel>Application</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security/>
  </System>
  <EventData>
    <Data>A potentially malicious process was Blocked by policy
Device: HOSTNAME; IP: 10.2.13.25; MAC: C8-1F-67-34-26-0F
File path: c:\Program Files\Microsoft Security Client\MsMpEng.exe
Process Id: 679
Violation Type: LsassRead, Occurrences: 1
Sha256: 774EA0DE962589D3EF3EB079BD54F5C59B9679355742D87185BEE10EF7E45501</Data>
    <Binary></Binary>
  </EventData>
</Event>

Source: evtx/Maps/Application_CylanceSvc_2.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)