DFIRHub

Windows event log ยท CiscoSecureEndpoint/Events100 Cisco Secure Endpoint Detection

  • Third party
  • 4 fields
  • CiscoSecureEndpoint%4Events.evtx
  • CiscoSecureEndpoint

Fields EvtxECmd extracts

4 columns in the EvtxECmd CSV

  • PayloadData1ThreatModule: %ThreatModule%
    • %ThreatModule% = /Event/EventData/Data[@Name="AttackInfo"]
  • PayloadData2ParentProcessName: %ParentProcessName%
    • %ParentProcessName% = /Event/EventData/Data[@Name="ParentProcessName"]
  • ExecutableInfo%ProcessName%
    • %ProcessName% = /Event/EventData/Data[@Name="ProcessName"]
  • UserName%UserName%
    • %UserName% = /Event/EventData/Data[@Name="AttackInfo"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="CiscoSecureEndpoint" Guid="0643104d-3c79-4ed5-9ed4-cd8e803fea9c"/>
    <EventID>100</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>10</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2022-03-05 19:12:53.1234567"/>
    <EventRecordID>19</EventRecordID>
    <Correlation/>
    <Execution ProcessID="1234" ThreadID="5678"/>
    <Channel>CiscoSecureEndpoint/Events</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="PID">1548</Data>
    <Data Name="TimeStamp">1675861234</Data>
    <Data Name="ProcessName">C:\programdata\evil.exe</Data>
    <Data Name="AttackInfo">{"afps":"C:\\programdata\\evil.exe","ams":"kernel32.dll","at":"2022-10-08 12:13:33","bas":"0x00007FFA54171234","edvs":"5.3.11.13","sfs":[""],"sus":[""],"threat_module_s":"Shellcode","threat_sub_module_s":"PEB","u":"username@DOMAIN"}</Data>
    <Data Name="SuspiciousFiles"></Data>
    <Data Name="ParentProcessName">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data>
    <Data Name="ParentProcessPID">1234</Data>
    <Data Name="ScriptControlBadDll"></Data>
  </EventData>
</Event>

Source: evtx/Maps/CiscoSecureEndpoint-Events_CiscoSecureEndpoint_100.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)