DFIRHub

Windows event log ยท Application42 Sophos System Protection

  • Application
  • 3 fields
  • Application.evtx
  • Sophos System Protection

Fields EvtxECmd extracts

3 columns in the EvtxECmd CSV

  • PayloadData1%File%
    • %File% = /Event/EventData/Data
  • PayloadData2%Hash%
    • %Hash% = /Event/EventData/Data
  • PayloadData3%Size%
    • %Size% = /Event/EventData/Data

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Sophos System Protection"/>
    <EventID Qualifiers="37">42</EventID>
    <Level>3</Level>
    <Task>9</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2020-05-05 20:41:05.2689644"/>
    <EventRecordID>13504</EventRecordID>
    <Channel>Application</Channel>
    <Computer>HostName.Domain.local</Computer>
    <Security/>
  </System>
  <EventData>
    <Data>File, C:\Windows\CSC\v2.0.6\namespace\REDACTED\RedirectedFolders\REDACTED\Downloads\CouponPrinter.exe, Generic PUA CN, SAV, {"ConfigVersion":"3fb696c2c927db995030414188d357143027cdb5164dd3e84a8999906a723c2d","ReputationSource":"unavailable","LocalReputation":"-1","LocalReputationSampleRate":"0","MLScoreMain":"37","MLScorePua":"8","MLSuppressed":"0","GlobalReputation":"28","SHA256FileHash":"6cdffa41e63906094a3d7c15f9cdecbc15ac97edd200f9db015a8162980fe4fd","SHA1FileHash":"2d37f1e76d78dce49cc0ed49d4db0e8dcb931d47","FileSize":" 2810448","FilePath":"C:\\Windows\\CSC\\v2.0.6\\namespace\\REDACTED\\RedirectedFolders\\REDACTED\\Downloads\\CouponPrinter.exe","Remote":"No","ScanEvalReason":"JIT (On-write)","Certificates":[{"CertificateSigner":"Coupons, Inc.","CertificateThumbprint":"f5585d9c39812e3b61ee0b9465a54a828e2238cab49c6ac7b5e9afbe3c14c180","CertificateAlgorithm":"SHA1","CertificateSignatureLocation":"Embedded"}]}</Data>
    <Binary></Binary>
  </EventData>
</Event>

Source: evtx/Maps/Application_Sophos-System-Protection_42.map(opens in new tab) by Mike Stewart and contributors(opens in new tab), MIT License(opens in new tab)