Windows event log · Application3 McAfee Endpoint Detection / Trellix Endpoint Detection

<System>
  <Provider Name="McAfee Endpoint Security"/>
  <EventID Qualifiers="8192">3</EventID>
  <Level>2</Level>
  <Task>0</Task>
  <Keywords>0x80000000000000</Keywords>
  <TimeCreated SystemTime="2021-06-15 07:28:19.0000000"/>
  <EventRecordID>522596</EventRecordID>
  <Channel>Application</Channel>
  <Computer>hostname.domain.com</Computer>
  <Security UserID="S-1-5-18"/>
</System>
<EventData>
  <Data>EventID=1428

domain\username ran on-demand scan "Quick Scan", which detected the threat Trojan named Cobalt/Shell.a!mem while scanning C:\Windows\SysWOW64\rundll32.exe but the file can't be deleted because it's locked. The #file will be deleted when the file isn't locked. To identify the process locking the file, see KB85494.</Data>
  <Binary></Binary>
</EventData>
</Event>
________________________________________
<Event>
  <System>
    <Provider Name="McAfee Endpoint Security"/>
    <EventID Qualifiers="8192">3</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-06-18 20:09:09.0000000"/>
    <EventRecordID>522679</EventRecordID>
    <Channel>Application</Channel>
    <Computer>hostname.domain.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data>EventID=1027

domain\username ran C:\Windows\explorer.exe, which attempted to access C:\Windows\S5S.exe. The Trojan named Packed-GDT!EA62D92F33DA was detected and deleted.</Data>
    <Binary></Binary>
  </EventData>
</Event>

<Event>
  <System>
    <Provider Name="Trellix Endpoint Security"/>
    <EventID Qualifiers="8192">3</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2024-01-03 23:29:00.6240345"/>
    <EventRecordID>811</EventRecordID>
    <Correlation/>
    <Execution ProcessID="3584" ThreadID="0"/>
    <Channel>Application</Channel>
    <Computer>DESKTOP-8EB4LCL</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data>EventID=1027

DESKTOP-8EB4LCL\User ran C:\Program Files\7-Zip\7zG.exe, which attempted to access C:\Users\User\Downloads\1a69f2fcfe5b35bf44ea42a1efe89f18f6b0d522cbbea5c51bae93aff7d3188b\1a69f2fcfe5b35bf44ea42a1efe89f18f6b0d522cbbea5c51bae93aff7d3188b.exe. The Trojan named Artemis!5FE4EA367CEE was detected and deleted.</Data>
    <Binary></Binary>
  </EventData>
</Event>