Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
example events from sysmon
# generate via: wevtutil gp Microsoft-Windows-Sysmon /getevents /getmessage
name: Microsoft-Windows-Sysmon
guid: 5770385f-c22a-43e0-bf4c-06f5698ffbd9
helpLink:
resourceFileName: C:\Windows\Sysmon.exe
messageFileName: C:\Windows\Sysmon.exe
message:
channels:
channel:
name: Microsoft-Windows-Sysmon/Operational
id: 16
flags: 0
message:
levels:
level:
name: win:Error
value: 2
message: Error
level:
name: win:Informational
value: 4
message: Information
opcodes:
opcode:
name: win:Info
value: 0
task: 0
opcode: 0
message: Info
tasks:
task:
name: SysmonTask-SYSMON_ERROR
value: 255
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee000000ff
message: Error report
task:
name: SysmonTask-SYSMON_CREATE_PROCESS
value: 1
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee00000001
message: Process Create (rule: ProcessCreate)
task:
name: SysmonTask-SYSMON_FILE_TIME
value: 2
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee00000002
message: File creation time changed (rule: FileCreateTime)
task:
name: SysmonTask-SYSMON_NETWORK_CONNECT
value: 3
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee00000003
message: Network connection detected (rule: NetworkConnect)
task:
name: SysmonTask-SYSMON_SERVICE_STATE_CHANGE
value: 4
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee00000004
message: Sysmon service state changed
task:
name: SysmonTask-SYSMON_PROCESS_TERMINATE
value: 5
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee00000005
message: Process terminated (rule: ProcessTerminate)
task:
name: SysmonTask-SYSMON_DRIVER_LOAD
value: 6
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee00000006
message: Driver loaded (rule: DriverLoad)
task:
name: SysmonTask-SYSMON_IMAGE_LOAD
value: 7
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee00000007
message: Image loaded (rule: ImageLoad)
task:
name: SysmonTask-SYSMON_CREATE_REMOTE_THREAD
value: 8
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee00000008
message: CreateRemoteThread detected (rule: CreateRemoteThread)
task:
name: SysmonTask-SYSMON_RAWACCESS_READ
value: 9
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee00000009
message: RawAccessRead detected (rule: RawAccessRead)
task:
name: SysmonTask-SYSMON_ACCESS_PROCESS
value: 10
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee0000000a
message: Process accessed (rule: ProcessAccess)
task:
name: SysmonTask-SYSMON_FILE_CREATE
value: 11
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee0000000b
message: File created (rule: FileCreate)
task:
name: SysmonTask-SYSMON_REG_KEY
value: 12
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee0000000c
message: Registry object added or deleted (rule: RegistryEvent)
task:
name: SysmonTask-SYSMON_REG_SETVALUE
value: 13
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee0000000d
message: Registry value set (rule: RegistryEvent)
task:
name: SysmonTask-SYSMON_REG_NAME
value: 14
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee0000000e
message: Registry object renamed (rule: RegistryEvent)
task:
name: SysmonTask-SYSMON_FILE_CREATE_STREAM_HASH
value: 15
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee0000000f
message: File stream created (rule: FileCreateStreamHash)
task:
name: SysmonTask-SYSMON_SERVICE_CONFIGURATION_CHANGE
value: 16
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee00000010
message: Sysmon config state changed
task:
name: SysmonTask-SYSMON_CREATE_NAMEDPIPE
value: 17
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee00000011
message: Pipe Created (rule: PipeEvent)
task:
name: SysmonTask-SYSMON_CONNECT_NAMEDPIPE
value: 18
eventGUID: c511ffb3-9fbf-45f5-a97b-9bee00000012
message: Pipe Connected (rule: PipeEvent)
keywords:
events:
event:
value: 1
version: 5
opcode: 0
channel: 16
level: 4
task: 1
keywords: 0x8000000000000000
message: Process Create:
UtcTime: %1
ProcessGuid: %2
ProcessId: %3
Image: %4
CommandLine: %5
CurrentDirectory: %6
User: %7
LogonGuid: %8
LogonId: %9
TerminalSessionId: %10
IntegrityLevel: %11
Hashes: %12
ParentProcessGuid: %13
ParentProcessId: %14
ParentImage: %15
ParentCommandLine: %16
event:
value: 2
version: 4
opcode: 0
channel: 16
level: 4
task: 2
keywords: 0x8000000000000000
message: File creation time changed:
UtcTime: %1
ProcessGuid: %2
ProcessId: %3
Image: %4
TargetFilename: %5
CreationUtcTime: %6
PreviousCreationUtcTime: %7
event:
value: 3
version: 5
opcode: 0
channel: 16
level: 4
task: 3
keywords: 0x8000000000000000
message: Network connection detected:
UtcTime: %1
ProcessGuid: %2
ProcessId: %3
Image: %4
User: %5
Protocol: %6
Initiated: %7
SourceIsIpv6: %8
SourceIp: %9
SourceHostname: %10
SourcePort: %11
SourcePortName: %12
DestinationIsIpv6: %13
DestinationIp: %14
DestinationHostname: %15
DestinationPort: %16
DestinationPortName: %17
event:
value: 4
version: 3
opcode: 0
channel: 16
level: 4
task: 4
keywords: 0x8000000000000000
message: Sysmon service state changed:
UtcTime: %1
State: %2
Version: %3
SchemaVersion: %4
event:
value: 5
version: 3
opcode: 0
channel: 16
level: 4
task: 5
keywords: 0x8000000000000000
message: Process terminated:
UtcTime: %1
ProcessGuid: %2
ProcessId: %3
Image: %4
event:
value: 6
version: 3
opcode: 0
channel: 16
level: 4
task: 6
keywords: 0x8000000000000000
message: Driver loaded:
UtcTime: %1
ImageLoaded: %2
Hashes: %3
Signed: %4
Signature: %5
SignatureStatus: %6
event:
value: 7
version: 3
opcode: 0
channel: 16
level: 4
task: 7
keywords: 0x8000000000000000
message: Image loaded:
UtcTime: %1
ProcessGuid: %2
ProcessId: %3
Image: %4
ImageLoaded: %5
Hashes: %6
Signed: %7
Signature: %8
SignatureStatus: %9
event:
value: 8
version: 2
opcode: 0
channel: 16
level: 4
task: 8
keywords: 0x8000000000000000
message: CreateRemoteThread detected:
UtcTime: %1
SourceProcessGuid: %2
SourceProcessId: %3
SourceImage: %4
TargetProcessGuid: %5
TargetProcessId: %6
TargetImage: %7
NewThreadId: %8
StartAddress: %9
StartModule: %10
StartFunction: %11
event:
value: 9
version: 2
opcode: 0
channel: 16
level: 4
task: 9
keywords: 0x8000000000000000
message: RawAccessRead detected:
UtcTime: %1
ProcessGuid: %2
ProcessId: %3
Image: %4
Device: %5
event:
value: 10
version: 3
opcode: 0
channel: 16
level: 4
task: 10
keywords: 0x8000000000000000
message: Process accessed:
UtcTime: %1
SourceProcessGUID: %2
SourceProcessId: %3
SourceThreadId: %4
SourceImage: %5
TargetProcessGUID: %6
TargetProcessId: %7
TargetImage: %8
GrantedAccess: %9
CallTrace: %10
event:
value: 11
version: 2
opcode: 0
channel: 16
level: 4
task: 11
keywords: 0x8000000000000000
message: File created:
UtcTime: %1
ProcessGuid: %2
ProcessId: %3
Image: %4
TargetFilename: %5
CreationUtcTime: %6
event:
value: 12
version: 2
opcode: 0
channel: 16
level: 4
task: 12
keywords: 0x8000000000000000
message: Registry object added or deleted:
EventType: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
Image: %5
TargetObject: %6
event:
value: 13
version: 2
opcode: 0
channel: 16
level: 4
task: 13
keywords: 0x8000000000000000
message: Registry value set:
EventType: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
Image: %5
TargetObject: %6
Details: %7
event:
value: 14
version: 2
opcode: 0
channel: 16
level: 4
task: 14
keywords: 0x8000000000000000
message: Registry object renamed:
EventType: %1
UtcTime: %2
ProcessGuid: %3
ProcessId: %4
Image: %5
TargetObject: %6
NewName: %7
event:
value: 15
version: 2
opcode: 0
channel: 16
level: 4
task: 15
keywords: 0x8000000000000000
message: File stream created:
UtcTime: %1
ProcessGuid: %2
ProcessId: %3
Image: %4
TargetFilename: %5
CreationUtcTime: %6
Hash: %7
event:
value: 16
version: 3
opcode: 0
channel: 16
level: 4
task: 16
keywords: 0x8000000000000000
message: Sysmon config state changed:
UtcTime: %1
Configuration: %2
ConfigurationFileHash: %3
event:
value: 17
version: 1
opcode: 0
channel: 16
level: 4
task: 17
keywords: 0x8000000000000000
message: Pipe Created:
UtcTime: %1
ProcessGuid: %2
ProcessId: %3
PipeName: %4
Image: %5
event:
value: 18
version: 1
opcode: 0
channel: 16
level: 4
task: 18
keywords: 0x8000000000000000
message: Pipe Connected:
UtcTime: %1
ProcessGuid: %2
ProcessId: %3
PipeName: %4
Image: %5
event:
value: 255
version: 3
opcode: 0
channel: 16
level: 2
task: 255
keywords: 0x8000000000000000
message: Error report:
UtcTime: %1
ID: %2
Description: %3
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
<EventID>1</EventID>
<Version>5</Version>
<Level>4</Level>
<Task>1</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-02-21T18:41:25.730575500Z" />
<EventRecordID>9</EventRecordID>
<Correlation />
<Execution ProcessID="4784" ThreadID="4656" />
<Channel>Microsoft-Windows-Sysmon/Operational</Channel>
<Computer>DESKTOP-O3QJU3L</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="UtcTime">2017-02-21 18:41:25.725</Data>
<Data Name="ProcessGuid">{DFB1C9EF-89D5-58AC-0000-0010EEDD0C00}</Data>
<Data Name="ProcessId">3272</Data>
<Data Name="Image">C:\Windows\System32\mmc.exe</Data>
<Data Name="CommandLine">"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s</Data>
<Data Name="CurrentDirectory">C:\Windows\system32\</Data>
<Data Name="User">DESKTOP-O3QJU3L\user</Data>
<Data Name="LogonGuid">{DFB1C9EF-8910-58AC-0000-0020D4480200}</Data>
<Data Name="LogonId">0x248d4</Data>
<Data Name="TerminalSessionId">1</Data>
<Data Name="IntegrityLevel">High</Data>
<Data Name="Hashes">SHA1=AAE83ECC4ABEE2E7567E2FF76B2B046C65336731,MD5=283BDCD7B83EEE614897619332E5B938,SHA256=17DD017B7E7D1DC835CDF5E57156A0FF508EBBC7F4A48E65D77E026C33FCB58E,IMPHASH=ED5A55DAB5A02F29D6EE7E0015F91A9F</Data>
<Data Name="ParentProcessGuid">{DFB1C9EF-8911-58AC-0000-00102B8C0200}</Data>
<Data Name="ParentProcessId">2388</Data>
<Data Name="ParentImage">C:\Windows\explorer.exe</Data>
<Data Name="ParentCommandLine">C:\Windows\Explorer.EXE</Data>
</EventData>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
<EventID>11</EventID>
<Version>2</Version>
<Level>4</Level>
<Task>11</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-02-21T18:42:22.078973800Z" />
<EventRecordID>29</EventRecordID>
<Correlation />
<Execution ProcessID="4784" ThreadID="4656" />
<Channel>Microsoft-Windows-Sysmon/Operational</Channel>
<Computer>DESKTOP-O3QJU3L</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="UtcTime">2017-02-21 18:42:22.074</Data>
<Data Name="ProcessGuid">{DFB1C9EF-B338-58AC-0000-001081BD0000}</Data>
<Data Name="ProcessId">876</Data>
<Data Name="Image">C:\Windows\system32\svchost.exe</Data>
<Data Name="TargetFilename">C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.235.3236.0.exe</Data>
<Data Name="CreationUtcTime">2017-02-21 18:42:22.074</Data>
</EventData>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
<EventID>12</EventID>
<Version>2</Version>
<Level>4</Level>
<Task>12</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-02-21T18:41:25.386462100Z" />
<EventRecordID>6</EventRecordID>
<Correlation />
<Execution ProcessID="4784" ThreadID="4656" />
<Channel>Microsoft-Windows-Sysmon/Operational</Channel>
<Computer>DESKTOP-O3QJU3L</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="EventType">CreateKey</Data>
<Data Name="UtcTime">2017-02-21 18:41:25.370</Data>
<Data Name="ProcessGuid">{DFB1C9EF-8911-58AC-0000-00102B8C0200}</Data>
<Data Name="ProcessId">2388</Data>
<Data Name="Image">C:\Windows\Explorer.EXE</Data>
<Data Name="TargetObject">HKEY_USERS\S-1-5-21-734394340-2380731162-4032342150-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.msc</Data>
</EventData>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
<EventID>13</EventID>
<Version>2</Version>
<Level>4</Level>
<Task>13</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-02-21T18:41:41.843242600Z" />
<EventRecordID>10</EventRecordID>
<Correlation />
<Execution ProcessID="4784" ThreadID="4656" />
<Channel>Microsoft-Windows-Sysmon/Operational</Channel>
<Computer>DESKTOP-O3QJU3L</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="EventType">SetValue</Data>
<Data Name="UtcTime">2017-02-21 18:41:41.840</Data>
<Data Name="ProcessGuid">{DFB1C9EF-B336-58AC-0000-0010E2500000}</Data>
<Data Name="ProcessId">592</Data>
<Data Name="Image">C:\Windows\system32\services.exe</Data>
<Data Name="TargetObject">HKLM\System\CurrentControlSet\Services\DeviceAssociationService\Start</Data>
<Data Name="Details">DWORD (0x00000003)</Data>
</EventData>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
<EventID>16</EventID>
<Version>3</Version>
<Level>4</Level>
<Task>16</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-02-21T18:41:12.874210100Z" />
<EventRecordID>1</EventRecordID>
<Correlation />
<Execution ProcessID="4772" ThreadID="4748" />
<Channel>Microsoft-Windows-Sysmon/Operational</Channel>
<Computer>DESKTOP-O3QJU3L</Computer>
<Security UserID="S-1-5-21-734394340-2380731162-4032342150-1001" />
</System>
<EventData>
<Data Name="UtcTime">2017-02-21 18:41:12.871</Data>
<Data Name="Configuration">config.xml.txt</Data>
<Data Name="ConfigurationFileHash">SHA1=4DF0A30B182E6F181C574724FDE6AA11857DCC17</Data>
</EventData>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
<EventID>3</EventID>
<Version>5</Version>
<Level>4</Level>
<Task>3</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-02-21T18:42:05.590721200Z" />
<EventRecordID>26</EventRecordID>
<Correlation />
<Execution ProcessID="4784" ThreadID="2164" />
<Channel>Microsoft-Windows-Sysmon/Operational</Channel>
<Computer>DESKTOP-O3QJU3L</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="UtcTime">2017-02-21 18:42:04.422</Data>
<Data Name="ProcessGuid">{DFB1C9EF-89FA-58AC-0000-0010FABC1100}</Data>
<Data Name="ProcessId">2324</Data>
<Data Name="Image">C:\Users\user\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe</Data>
<Data Name="User">DESKTOP-O3QJU3L\user</Data>
<Data Name="Protocol">tcp</Data>
<Data Name="Initiated">true</Data>
<Data Name="SourceIsIpv6">false</Data>
<Data Name="SourceIp">10.0.42.89</Data>
<Data Name="SourceHostname">DESKTOP-O3QJU3L.lair</Data>
<Data Name="SourcePort">49925</Data>
<Data Name="SourcePortName" />
<Data Name="DestinationIsIpv6">false</Data>
<Data Name="DestinationIp">40.117.100.83</Data>
<Data Name="DestinationHostname" />
<Data Name="DestinationPort">443</Data>
<Data Name="DestinationPortName">https</Data>
</EventData>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
<EventID>4</EventID>
<Version>3</Version>
<Level>4</Level>
<Task>4</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-02-21T18:41:12.923641300Z" />
<EventRecordID>2</EventRecordID>
<Correlation />
<Execution ProcessID="4784" ThreadID="4656" />
<Channel>Microsoft-Windows-Sysmon/Operational</Channel>
<Computer>DESKTOP-O3QJU3L</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="UtcTime">2017-02-21 18:41:12.917</Data>
<Data Name="State">Started</Data>
<Data Name="Version">6.00</Data>
<Data Name="SchemaVersion">3.30</Data>
</EventData>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
<EventID>5</EventID>
<Version>3</Version>
<Level>4</Level>
<Task>5</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-02-21T18:41:13.940905800Z" />
<EventRecordID>4</EventRecordID>
<Correlation />
<Execution ProcessID="4784" ThreadID="4656" />
<Channel>Microsoft-Windows-Sysmon/Operational</Channel>
<Computer>DESKTOP-O3QJU3L</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="UtcTime">2017-02-21 18:41:13.933</Data>
<Data Name="ProcessGuid">{DFB1C9EF-89C5-58AC-0000-001070D80B00}</Data>
<Data Name="ProcessId">4772</Data>
<Data Name="Image">C:\Users\user\Downloads\Sysmon\Sysmon64.exe</Data>
</EventData>
</Event>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.