DFIRHub

Windows event log ยท CiscoSecureEndpoint/Events1300 Cisco Secure Endpoint Detection

  • Third party
  • 4 fields
  • CiscoSecureEndpoint%4Events.evtx
  • CiscoSecureEndpoint

Fields EvtxECmd extracts

4 columns in the EvtxECmd CSV

  • PayloadData1DetectionName: %DetectionName%
    • %DetectionName% = /Event/EventData/Data[@Name="DetectionName"]
  • PayloadData2ParentName: %ParentName%
    • %ParentName% = /Event/EventData/Data[@Name="ParentName"]
  • PayloadData3DetectionId: %DetectionId%
    • %DetectionId% = /Event/EventData/Data[@Name="DetectionId"]
  • ExecutableInfo%DetectedFilePath%
    • %DetectedFilePath% = /Event/EventData/Data[@Name="DetectedFilePath"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="CiscoSecureEndpoint" Guid="0643104d-3c79-4ed5-9ed4-cd8e803fea9c"/>
    <EventID>1300</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>10</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2022-03-05 19:12:53.1234567"/>
    <EventRecordID>19</EventRecordID>
    <Correlation/>
    <Execution ProcessID="1234" ThreadID="5678"/>
    <Channel>CiscoSecureEndpoint/Events</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="DetectionName">IL:Trojan.MSILZilla.6459</Data>
    <Data Name="DetectionId">719612345678907012</Data>
    <Data Name="ParentName">powershell.exe</Data>
    <Data Name="DetectedFilePath">C:\ProgramData\evil.exe</Data>
    <Data Name="DetectionEngine">64</Data>
  </EventData>
</Event>

Source: evtx/Maps/CiscoSecureEndpoint-Events_CiscoSecureEndpoint_1300.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)