cscli parsers install crowdsecurity/sysmon-logsA parser for sysmon events.
Example acquisition config:
1source: wineventlog2pretty_name: sysmon3event_channel: "Microsoft-Windows-Sysmon/Operational"4labels:5 type: sysmon
1onsuccess: next_stage2filter: "evt.Parsed.Channel == 'Microsoft-Windows-Sysmon/Operational'"3name: crowdsecurity/sysmon4description: "Parse sysmon events"5nodes:6 - filter: evt.Parsed.EventID == '1'7 statics:8 - parsed: ProcessGuid9 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")10 - parsed: Image11 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")12 - parsed: ProcessId13 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")14 - parsed: FileVersion15 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='FileVersion']")16 - parsed: Description17 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Description']")18 - parsed: Company19 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Company']")20 - parsed: OriginalFileName21 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='OriginalFileName']")22 - parsed: CommandLine23 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='CommandLine']")24 - parsed: CurrentDirectory25 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='CurrentDirectory']")26 - parsed: User27 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='User']")28 - parsed: LogonGuid29 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='LogonGuid']")30 - parsed: LogonId31 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='LogonId']")32 - parsed: TerminalSessionId33 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TerminalSessionId']")34 - parsed: IntegrityLevel35 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='IntegrityLevel']")36 - parsed: Hashes37 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Hashes']")38 - parsed: ParentProcessGuid39 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ParentProcessGuid']")40 - parsed: ParentProcessId41 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ParentProcessId']")42 - parsed: ParentImage43 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ParentImage']")44 - parsed: ParentCommandLine45 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ParentCommandLine']")46 - parsed: ParentUser47 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ParentUser']")48 - meta: SysmonEventType49 value: ProcessCreation50 - meta: CommandLine51 expression: evt.Parsed.CommandLine52 - meta: CurrentDirectory53 expression: evt.Parsed.CurrentDirectory54 - meta: User55 expression: evt.Parsed.User56 - meta: Hashes57 expression: evt.Parsed.Hashes58 - meta: ParentImage59 expression: evt.Parsed.ParentImage60 - filter: evt.Parsed.EventID == '2'61 statics:62 - parsed: ProcessGuid63 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")64 - parsed: Image65 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")66 - parsed: ProcessId67 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")68 - parsed: TargetFilename69 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetFilename']")70 - parsed: CreationUtcTime71 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='CreationUtcTime']")72 - parsed: CreationUtcTime73 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='CreationUtcTime']")74 - meta: SysmonEventType75 value: CreationTimeChanged76 - filter: evt.Parsed.EventID == '3'77 statics:78 - parsed: ProcessGuid79 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")80 - parsed: Image81 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")82 - parsed: ProcessId83 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")84 - parsed: User85 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='User']")86 - parsed: Protocol87 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Protocol']")88 - parsed: Initiated89 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Initiated']")90 - parsed: SourceIsIpv691 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SourceIsIpv6']")92 - parsed: SourceIp93 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SourceIp']")94 - parsed: SourceHostname95 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SourceHostname']")96 - parsed: SourcePort97 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SourcePort']")98 - parsed: SourcePortName99 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SourcePortName']")100 - parsed: DestinationIsIpv6101 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='DestinationIsIpv6']")102 - parsed: DestinationIp103 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='DestinationIp']")104 - parsed: DestinationHostname105 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='DestinationHostname']")106 - parsed: DestinationPort107 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='DestinationPort']")108 - parsed: DestinationPortName109 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='DestinationPortName']")110 - meta: SysmonEventType111 value: NetworkConnection112 - filter: evt.Parsed.EventID == '4'113 statics:114 - parsed: State115 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='State']")116 - parsed: Version117 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Version']")118 - parsed: SchemaVersion119 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SchemaVersion']")120 - meta: SysmonEventType121 value: SysmonServiceStateChanged122 - filter: evt.Parsed.EventID == '5'123 statics:124 - parsed: ProcessGuid125 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")126 - parsed: Image127 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")128 - parsed: ProcessId129 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")130 - meta: SysmonEventType131 value: ProcessTerminated132 - filter: evt.Parsed.EventID == '6'133 statics:134 - parsed: ImageLoaded135 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ImageLoaded']")136 - parsed: Hashes137 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Hashes']")138 - parsed: Signed139 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Signed']")140 - parsed: Signature141 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Signature']")142 - parsed: SignatureStatus143 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SignatureStatus']")144 - meta: SysmonEventType145 value: DriverLoaded146 - filter: evt.Parsed.EventID == '7'147 statics:148 - parsed: ProcessGuid149 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")150 - parsed: ProcessId151 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")152 - parsed: Image153 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")154 - parsed: ImageLoaded155 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ImageLoaded']")156 - parsed: Hashes157 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Hashes']")158 - parsed: Signed159 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Signed']")160 - parsed: Signature161 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Signature']")162 - parsed: SignatureStatus163 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SignatureStatus']")164 - meta: SysmonEventType165 value: ImageLoaded166 - filter: evt.Parsed.EventID == '8'167 statics:168 - parsed: SourceProcessGuid169 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SourceProcessGuid']")170 - parsed: SourceProcessId171 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SourceProcessId']")172 - parsed: SourceImage173 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SourceImage']")174 - parsed: TargetProcessGuid175 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetProcessGuid']")176 - parsed: TargetProcessId177 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetProcessId']")178 - parsed: TargetImage179 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetImage']")180 - parsed: NewThreadId181 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='NewThreadId']")182 - parsed: StartAddress183 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='StartAddress']")184 - parsed: StartModule185 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='StartModule']")186 - parsed: StartFunction187 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='StartFunction']")188 - meta: SysmonEventType189 value: CreateRemoteThread190 - filter: evt.Parsed.EventID == '9'191 statics:192 - parsed: ProcessGuid193 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")194 - parsed: ProcessId195 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")196 - parsed: Image197 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")198 - parsed: Device199 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Device']")200 - meta: SysmonEventType201 value: RawAccessRead202 - filter: evt.Parsed.EventID == '10'203 statics:204 - parsed: SourceProcessGUID205 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SourceProcessGUID']")206 - parsed: SourceProcessId207 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SourceProcessId']")208 - parsed: SourceThreadId209 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SourceThreadId']")210 - parsed: SourceImage211 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SourceImage']")212 - parsed: TargetProcessGUID213 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetProcessGUID']")214 - parsed: TargetProcessId215 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetProcessId']")216 - parsed: TargetImage217 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetImage']")218 - parsed: GrantedAccess219 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='GrantedAccess']")220 - parsed: CallTrace221 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='CallTrace']")222 - meta: SysmonEventType223 value: ProcessAccess224 - filter: evt.Parsed.EventID == '11'225 statics:226 - parsed: ProcessGuid227 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")228 - parsed: ProcessId229 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")230 - parsed: Image231 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")232 - parsed: TargetFilename233 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetFilename']")234 - parsed: CreationUtcTime235 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='CreationUtcTime']")236 - meta: SysmonEventType237 value: FileCreate238 - filter: evt.Parsed.EventID == '12'239 statics:240 - parsed: EventType241 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='EventType']")242 - parsed: ProcessGuid243 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")244 - parsed: ProcessId245 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")246 - parsed: Image247 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")248 - parsed: TargetObject249 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetObject']")250 - meta: SysmonEventType251 value: RegistryCreateOrDel252 - filter: evt.Parsed.EventID == '13'253 statics:254 - parsed: EventType255 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='EventType']")256 - parsed: ProcessGuid257 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")258 - parsed: ProcessId259 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")260 - parsed: Image261 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")262 - parsed: TargetObject263 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetObject']")264 - parsed: Details265 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Details']")266 - meta: SysmonEventType267 value: RegistrySetValue268 - filter: evt.Parsed.EventID == '14'269 statics:270 - parsed: EventType271 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='EventType']")272 - parsed: ProcessGuid273 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")274 - parsed: ProcessId275 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")276 - parsed: Image277 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")278 - parsed: TargetObject279 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetObject']")280 - parsed: NewName281 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='NewName']")282 - meta: SysmonEventType283 value: RegistryRename284 - filter: evt.Parsed.EventID == '15'285 statics:286 - parsed: ProcessGuid287 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")288 - parsed: ProcessId289 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")290 - parsed: Image291 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")292 - parsed: TargetFilename293 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetFilename']")294 - parsed: CreationUtcTime295 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='CreationUtcTime']")296 - meta: SysmonEventType297 value: FileCreateStreamHash298 - filter: evt.Parsed.EventID == '16'299 statics:300 - parsed: ConfigurationFileHash301 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ConfigurationFileHash']")302 - parsed: Configuration303 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Configuration']")304 - meta: SysmonEventType305 value: SysmonConfigChange306 - filter: evt.Parsed.EventID == '17'307 statics:308 - parsed: ProcessGuid309 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")310 - parsed: ProcessId311 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")312 - parsed: Image313 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")314 - parsed: PipeName315 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='PipeName']")316 - meta: SysmonEventType317 value: PipeCreated318 - filter: evt.Parsed.EventID == '18'319 statics:320 - parsed: ProcessGuid321 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")322 - parsed: ProcessId323 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")324 - parsed: Image325 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")326 - parsed: PipeName327 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='PipeName']")328 - meta: SysmonEventType329 value: PipeConnected330 - filter: evt.Parsed.EventID == '19'331 statics:332 - parsed: EventType333 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='EventType']")334 - parsed: Operation335 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Operation']")336 - parsed: User337 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='User']")338 - parsed: EventNamespace339 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='EventNamespace']")340 - parsed: Name341 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Name']")342 - parsed: Query343 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Query']")344 - meta: SysmonEventType345 value: WmiEventFilter346 - filter: evt.Parsed.EventID == '20'347 statics:348 - parsed: EventType349 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='EventType']")350 - parsed: Operation351 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Operation']")352 - parsed: User353 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='User']")354 - parsed: Type355 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Type']")356 - parsed: Name357 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Name']")358 - parsed: Destination359 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Destination']")360 - meta: SysmonEventType361 value: WmiEventConsumer362 - filter: evt.Parsed.EventID == '21'363 statics:364 - parsed: EventType365 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='EventType']")366 - parsed: Operation367 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Operation']")368 - parsed: User369 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='User']")370 - parsed: Consumer371 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Consumer']")372 - parsed: Filter373 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Filter']")374 - meta: SysmonEventType375 value: WmiEventConsumerToFilter376 - filter: evt.Parsed.EventID == '22'377 statics:378 - parsed: ProcessGuid379 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")380 - parsed: ProcessId381 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")382 - parsed: QueryName383 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='QueryName']")384 - parsed: QueryStatus385 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='QueryStatus']")386 - parsed: QueryResults387 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='QueryResults']")388 - parsed: Image389 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")390 - meta: SysmonEventType391 value: DNSEvent392 - filter: evt.Parsed.EventID == '23'393 statics:394 - parsed: ProcessGuid395 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")396 - parsed: ProcessId397 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")398 - parsed: User399 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='User']")400 - parsed: Image401 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")402 - parsed: TargetFilename403 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetFilename']")404 - parsed: Hashes405 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Hashes']")406 - parsed: IsExecutable407 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='IsExecutable']")408 - parsed: Archived409 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Archived']")410 - meta: SysmonEventType411 value: FileDelete412 - filter: evt.Parsed.EventID == '24'413 statics:414 - parsed: ProcessGuid415 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")416 - parsed: ProcessId417 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")418 - parsed: User419 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='User']")420 - parsed: Image421 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")422 - parsed: Session423 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Session']")424 - parsed: ClientInfo425 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ClientInfo']")426 - parsed: Hashes427 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Hashes']")428 - parsed: IsExecutable429 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='IsExecutable']")430 - parsed: Archived431 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Archived']")432 - meta: SysmonEventType433 value: ClipboardChange434 - filter: evt.Parsed.EventID == '225'435 statics:436 - meta: SysmonEventType437 value: SysmonInternalError438439statics:440 - meta: service441 value: sysmon442 - meta: RuleName443 expression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='RuleName']")