DFIRHub

Windows event log · Cisco AnyConnect Secure Mobility Client2127 Cisco AnyConnect VPN IP assigned

untested regex for IPv6 parsing

  • Third party
  • 1 field
  • Cisco AnyConnect Secure Mobility Client.evtx
  • acvpnagent

Notes

  • untested regex for IPv6 parsing
  • -
  • - Property: PayloadData2
  • PropertyValue: "%PayloadData2%"
  • Values:
  • Name: PayloadData2
  • Value: "/Event/EventData/Data"
  • Refine: "IPv6 address: ([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4} | ([0-9a-fA-F]{1,4}:){1,7}:| ([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4} | ([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2} | ([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3} | ([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4} | ([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5} | [0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6}) | :((:[0-9a-fA-F]{1,4}){1,7}|:) | fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,} | ::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]) | ([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))"

Fields EvtxECmd extracts

1 column in the EvtxECmd CSV

  • PayloadData1%PayloadData1% assigned
    • %PayloadData1% = /Event/EventData/Data

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="acvpnagent"/>
    <EventID Qualifiers="25600">2127</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x0080000000000000</Keywords>
    <TimeCreated SystemTime="2020-04-14T15:35:06.3842374Z"/>
    <EventRecordID>32701</EventRecordID>
    <Channel>Cisco AnyConnect Secure Mobility Client</Channel>
    <Computer>My-Laptop123.domain.local</Computer>
    <Security/>
  </System>
  <EventData>
    <Data>VPN Adapter Configuration:
   IPv4 address: 10.20.14.231/8
   IPv6 address: N/A (block IPv6 traffic)
   Default domain: N/A
   DNS suffixes: N/A
   DNS servers: 8.8.8.8, 208.67.222.222
   WINS servers: 2.3.1.120, 10.10.1.10
   MTU: 1300</Data>
    <Binary></Binary>
  </EventData>
</Event>

Source: evtx/Maps/Cisco-AnyConnect-Secure-Mobility-Client_acvpnagent_2127.map(opens in new tab) by Mike Brewer and contributors(opens in new tab), MIT License(opens in new tab)