DFIRHub

Windows event log ยท Kaspersky Endpoint Security362 Kaspersky AV Detection

  • Third party
  • 4 fields
  • Kaspersky Endpoint Security.evtx
  • avp

Fields EvtxECmd extracts

4 columns in the EvtxECmd CSV

  • ExecutableInfo%ExecutableInfo%
    • %ExecutableInfo% = /Event/EventData/Data
  • UserName%UserName%
    • %UserName% = /Event/EventData/Data
  • PayloadData1%PayloadData1%
    • %PayloadData1% = /Event/EventData/Data
  • PayloadData2%PayloadData2%
    • %PayloadData2% = /Event/EventData/Data

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="avp"/>
    <EventID Qualifiers="49154">362</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2020-02-28 13:37:03.0223965"/>
    <EventRecordID>89</EventRecordID>
    <Channel>Kaspersky Endpoint Security</Channel>
    <Computer>hostname.domain.local</Computer>
    <Security/>
  </System>
  <EventData>
    <Data>Event type:     Dangerous link blocked
Application:     Microsoft Edge Content Process
Application\Name:     MicrosoftEdgeCP.exe
Application\Path:     C:\Windows\System32\
Application\Process ID:     7756
User:     domain\user (Active user)
Component:     Web Threat Protection
Result\Description:     Blocked
Result\Type:     Malicious link
Result\Name:     baddomain.com
Result\Threat level:     High
Result\Precision:     Exactly
Object:     baddomain.com
Object\Type:     Web page
Object\Path:     baddomain.com
Object\Name:     baddomain.com
Reason:     Automatic analysis
Database release date:     2/28/2020 1:47:00 AM</Data>
    <Binary></Binary>
  </EventData>

Source: evtx/Maps/Kaspersky-Endpoint-Security_avp_362.map(opens in new tab) by Peter Snyder and contributors(opens in new tab), MIT License(opens in new tab)