DFIRHub

Windows event log ยท Microsoft-Windows-Win32k/Operational260 A program was executed

  • Windows operational
  • 2 fields
  • Microsoft-Windows-Win32k%4Operational.evtx
  • Microsoft-Windows-Win32k

Fields EvtxECmd extracts

2 columns in the EvtxECmd CSV

  • PayloadData1Blocked: %Blocked%
    • %Blocked% = /Event/EventData/Data[@Name="Blocked"]
  • ExecutableInfo%SourceProcessName%
    • %SourceProcessName% = /Event/EventData/Data[@Name="SourceProcessName"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Win32k" Guid="8c416c79-d49b-4f01-a467-e56d3aa8234c"/>
    <EventID>260</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>260</Task>
    <Opcode>0</Opcode>
    <Keywords>0x100000100000000</Keywords>
    <TimeCreated SystemTime="2025-04-12 15:43:16.1867980"/>
    <EventRecordID>23456</EventRecordID>
    <Correlation ActivityID="8c679c79-d49b-4f01-abcd-e56d3679234c"/>
    <Execution ProcessID="12148" ThreadID="19124"/>
    <Channel>Microsoft-Windows-Win32k/Operational</Channel>
    <Computer>hostname.DOMAIN</Computer>
    <Security UserID="S-1-5-21-123456789-123456789-123456789-123456"/>
  </System>
  <EventData>
    <Data Name="SourceProcessName">C:\Users\testuser\AppData\Roaming\MobaXterm\slash\bin\MobaRTE.exe</Data>
    <Data Name="SourceType">1</Data>
    <Data Name="FontSourcePath"></Data>
    <Data Name="Blocked">True</Data>
  </EventData>
</Event>

Source: evtx/Maps/Microsoft-Windows-Win32k-Operational_Microsoft-Windows-Win32k_260.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)