DFIRHub

Windows event log ยท Microsoft-Windows-Sysmon/Operational8 CreateRemoteThread

  • Sysmon
  • 7 fields
  • Microsoft-Windows-Sysmon%4Operational.evtx
  • Microsoft-Windows-Sysmon

Fields EvtxECmd extracts

7 columns in the EvtxECmd CSV

  • UserNameSourceUser: %SourceUser% | TargetUser: %TargetUser%
    • %SourceUser% = /Event/EventData/Data[@Name="SourceUser"]
    • %TargetUser% = /Event/EventData/Data[@Name="TargetUser"]
  • PayloadData1StartAddress: %StartAddress%
    • %StartAddress% = /Event/EventData/Data[@Name="StartAddress"]
  • PayloadData2RuleName: %RuleName%
    • %RuleName% = /Event/EventData/Data[@Name="RuleName"]
  • PayloadData3SourceProcessID: %SourceProcessID%, SourceProcessGUID: %SourceProcessGUID%
    • %SourceProcessGUID% = /Event/EventData/Data[@Name="SourceProcessGuid"]
    • %SourceProcessID% = /Event/EventData/Data[@Name="SourceProcessId"]
  • PayloadData4SourceImage: %SourceImage%
    • %SourceImage% = /Event/EventData/Data[@Name="SourceImage"]
  • PayloadData5TargetProcessID: %TargetProcessID%, TargetProcessGUID: %TargetProcessGUID%
    • %TargetProcessGUID% = /Event/EventData/Data[@Name="TargetProcessGuid"]
    • %TargetProcessID% = /Event/EventData/Data[@Name="TargetProcessId"]
  • PayloadData6TargetImage: %TargetImage%
    • %TargetImage% = /Event/EventData/Data[@Name="TargetImage"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Sysmon" Guid="5770385f-c22a-43e0-bf4c-06f5698ffbd9"/>
    <EventID>8</EventID>
    <Version>2</Version>
    <Level>4</Level>
    <Task>8</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2019-04-27 18:47:00.0624748"/>
    <EventRecordID>7023</EventRecordID>
    <Correlation/>
    <Execution ProcessID="1816" ThreadID="1228"/>
    <Channel>Microsoft-Windows-Sysmon/Operational</Channel>
    <Computer>IEWIN7</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="RuleName"></Data>
    <Data Name="UtcTime">2019-04-27 18:47:00.062</Data>
    <Data Name="SourceProcessGuid">365abb72-a3a4-5cc4-0000-001084960c00</Data>
    <Data Name="SourceProcessId">1288</Data>
    <Data Name="SourceImage">C:\Users\Public\KeeFarce.exe</Data>
    <Data Name="TargetProcessGuid">365abb72-a201-5cc4-0000-00104f500800</Data>
    <Data Name="TargetProcessId">2364</Data>
    <Data Name="TargetImage">C:\Program Files\KeePass Password Safe 2\KeePass.exe</Data>
    <Data Name="NewThreadId">1920</Data>
    <Data Name="StartAddress">0x5A801260</Data>
    <Data Name="StartModule">C:\Users\Public\BootstrapDLL.dll</Data>
    <Data Name="StartFunction">LoadManagedProject</Data>
  </EventData>
</Event>

References

5 links

Source: evtx/Maps/Microsoft-Windows-Sysmon-Operational_Microsoft-Windows-Sysmon_8.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)