DFIRHub

Windows event log ยท System2 An attempt to exploit a known vulnerability detected

  • System
  • 2 fields
  • System.evtx
  • Microsoft-Windows-Audit-CVE

Fields EvtxECmd extracts

2 columns in the EvtxECmd CSV

  • PayloadData1%CVEID%
    • %CVEID% = /Event/EventData/Data[@Name="CVEID"]
  • PayloadData2%AdditionalDetails%
    • %AdditionalDetails% = /Event/EventData/Data[@Name="AdditionalDetails"]

Sample event

Event XML from the map file

<System>
  <Provider Name="Microsoft-Windows-Audit-CVE" Guid="{85a62a0d-7e17-485f-9d4f-749a287193a6}"/>
  <EventID>2</EventID>
  <Version>0</Version>
  <Level>3</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8000000000000000</Keywords>
  <TimeCreated SystemTime="2020-01-15T23:53:36.821170000Z"/>
  <EventRecordID>32459</EventRecordID>
  <Correlation/>
  <Execution ProcessID="19928" ThreadID="15488"/>
  <Channel>System</Channel>
  <Computer>xxxxxxxxxxxxxxxxxx</Computer>
  <Security UserID="xxxxxxxxxxxxxxxxxxxxxxxxx"/>
</System>
<EventData>
  <Data Name="CVEID">xxxxxxxxxxxxxxxxx</Data>
  <Data Name="AdditionalDetails">xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</Data>
</EventData>

Source: evtx/Maps/System_Microsoft-Windows-Audit-CVE_2.map(opens in new tab) by Troy Larson and contributors(opens in new tab), MIT License(opens in new tab)