Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 12/18/18 10:42:32 PM UTC , NULL ,
- {
- "@timestamp":"2018-12-18T22:42:32.841Z",
- "@metadata":
- {
- "beat":"winlogbeat",
- "type":"doc",
- "version":"6.5.3",
- "topic":"winlogbeat"
- },
- "opcode":"Info",
- "message":"Process Create:\x5CnRuleName: \x5CnUtcTime: 2018-12-18 22:42:32.826\x5CnProcessGuid: {1C9FDC81-77D8-5C19-0000-0010A8182800}\x5CnProcessId: 2620\x5CnImage: C:\x5C\x5CWindows\x5C\x5CSystem32\x5C\x5Ctaskhostw.exe\x5CnFileVersion: 10.0.17134.1 (WinBuild.160101.0800)\x5CnDescription: Host Process for Windows Tasks\x5CnProduct: Microsoft\xC2\xAE Windows\xC2\xAE Operating System\x5CnCompany: Microsoft Corporation\x5CnCommandLine: taskhostw.exe Logon\x5CnCurrentDirectory: C:\x5C\x5CWINDOWS\x5C\x5Csystem32\x5C\x5C\x5CnUser: RIVENDELL\x5C\x5Ccbrown\x5CnLogonGuid: {1C9FDC81-76A7-5C19-0000-00205D8E0900}\x5CnLogonId: 0x98E5D\x5CnTerminalSessionId: 1\x5CnIntegrityLevel: Medium\x5CnHashes: SHA1=2A594345FBCAAD453C72BD0937CBF67FB43A74DF,MD5=CE95E236FC9FE2D6F16C926C75B18BAF,SHA256=740122D338FFD2CBB0877F8AC17B28218EAD02F08A9B28D5266C94E33F938085,IMPHASH=3627BE269990D67CF76A03FA55EF9A08\x5CnParentProcessGuid: {1C9FDC81-7677-5C19-0000-00104A420100}\x5CnParentProcessId: 988\x5CnParentImage: C:\x5C\x5CWindows\x5C\x5CSystem32\x5C\x5Csvchost.exe\x5CnParentCommandLine: C:\x5C\x5CWINDOWS\x5C\x5Csystem32\x5C\x5Csvchost.exe -k netsvcs -p",
- "thread_id":3100,
- "computer_name":"DESKTOP-LFD11QP.RIVENDELL.local",
- "version":5,
- "task":"Process Create (rule: ProcessCreate)",
- "event_data":
- {
- "Hashes":"SHA1=2A594345FBCAAD453C72BD0937CBF67FB43A74DF,MD5=CE95E236FC9FE2D6F16C926C75B18BAF,SHA256=740122D338FFD2CBB0877F8AC17B28218EAD02F08A9B28D5266C94E33F938085,IMPHASH=3627BE269990D67CF76A03FA55EF9A08",
- "ProcessGuid":"{1C9FDC81-77D8-5C19-0000-0010A8182800}",
- "IntegrityLevel":"Medium",
- "UtcTime":"2018-12-18 22:42:32.826",
- "LogonId":"0x98e5d",
- "Description":"Host Process for Windows Tasks",
- "TerminalSessionId":"1",
- "CommandLine":"taskhostw.exe Logon",
- "ParentImage":"C:\x5C\x5CWindows\x5C\x5CSystem32\x5C\x5Csvchost.exe",
- "LogonGuid":"{1C9FDC81-76A7-5C19-0000-00205D8E0900}",
- "User":"RIVENDELL\x5C\x5Ccbrown",
- "FileVersion":"10.0.17134.1 (WinBuild.160101.0800)",
- "ParentProcessId":"988",
- "ParentCommandLine":"C:\x5C\x5CWINDOWS\x5C\x5Csystem32\x5C\x5Csvchost.exe -k netsvcs -p",
- "Product":"Microsoft\xC2\xAE Windows\xC2\xAE Operating System",
- "Image":"C:\x5C\x5CWindows\x5C\x5CSystem32\x5C\x5Ctaskhostw.exe",
- "ProcessId":"2620",
- "CurrentDirectory":"C:\x5C\x5CWINDOWS\x5C\x5Csystem32\x5C\x5C",
- "Company":"Microsoft Corporation",
- "ParentProcessGuid":"{1C9FDC81-7677-5C19-0000-00104A420100}"
- },
- "host":
- {
- "name":"DESKTOP-LFD11QP"
- },
- "type":"wineventlog",
- "provider_guid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
- "level":"Information",
- "event_id":1,
- "log_name":"Microsoft-Windows-Sysmon/Operational",
- "source_name":"Microsoft-Windows-Sysmon",
- "record_number":"3040257",
- "process_id":2160,
- "user":
- {
- "name":"SYSTEM",
- "domain":"NT AUTHORITY",
- "type":"User",
- "identifier":"S-1-5-18"
- },
- "beat":
- {
- "name":"DESKTOP-LFD11QP",
- "hostname":"DESKTOP-LFD11QP",
- "version":"6.5.3"
- }
- }
Add Comment
Please, Sign In to add comment