DFIRHub

Windows event log ยท COMODO Client - Security CEF3 COMODO Security CEF Client

  • Third party
  • 5 fields
  • COMODO Client - Security CEF.evtx
  • File Rating

Fields EvtxECmd extracts

5 columns in the EvtxECmd CSV

  • ExecutableInfo%ExecutableInfo%
    • %ExecutableInfo% = /Event/EventData/Data
  • PayloadData1%PayloadData1%
    • %PayloadData1% = /Event/EventData/Data
  • PayloadData2%PayloadData2%
    • %PayloadData2% = /Event/EventData/Data
  • PayloadData3%PayloadData3%
    • %PayloadData3% = /Event/EventData/Data
  • PayloadData4%PayloadData4%
    • %PayloadData4% = /Event/EventData/Data

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="File Rating"/>
    <EventID Qualifiers="16384">3</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-06-13 03:22:03.3502016"/>
    <EventRecordID>724549</EventRecordID>
    <Channel>COMODO Client - Security CEF</Channel>
    <Computer>hostname.domain.com</Computer>
    <Security/>
  </System>
  <EventData>
    <Data>Jun 13 2021 03:22:03 0000 HOSTNAME CEF:0|comodo|cis.cas.endpoint|12.7.1.8539|9FB5B608-55DE-4704-A02C-71BD45426149|Rating Info|5|filePath=C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files\FileName.vbs #fname=FileName.vbs act=Added cat=rating reason=COMODO cs1Label=old_rating cs1=Unrecognized cs2Label=new_rating cs2=Unrecognized cs3Label=src_rating cs3=FLS cs4Label=status cs4=0 fileHash=E56BB8E025E0B1DD89EFF01180D7ACCBA597AC1A dvchost=hostname.domain.com dvc=127.0.0.1 #deviceExternalId=96966028D15B1C8E4B0C5CBCE3A34E446DEC474B</Data>
    <Binary></Binary>
  </EventData>
</Event>

Source: evtx/Maps/COMODO-Client-Security-CEF_File-Rating_3.map(opens in new tab) by Peter Snyder and contributors(opens in new tab), MIT License(opens in new tab)