Skip to content

Commit 310dbf6

Browse files
leehinmanleehinman
authored
Add pe fields to Sysmon module (#22217)
- ProcessCreate event - LoadImage event Closes #17335
1 parent 577c25b commit 310dbf6

7 files changed

Lines changed: 257 additions & 0 deletions

‎CHANGELOG.next.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -800,6 +800,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
800800
- Add registry and code signature information and ECS categorization fields for sysmon module {pull}18058[18058]
801801
- Add new winlogbeat security dashboard {pull}18775[18775]
802802
- Add `event.outcome` to events based on the audit success and audit failure keywords. {pull}20564[20564]
803+
- Add file.pe and process.pe fields to ProcessCreate & LoadImage events in Sysmon module. {issue}17335[17335] {pull}22217[22217]
803804

804805
*Elastic Log Driver*
805806
- Add support for `docker logs` command {pull}19531[19531]

‎x-pack/winlogbeat/module/sysmon/config/winlogbeat-sysmon.js‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -677,11 +677,37 @@ var sysmon = (function () {
677677
from: "winlog.event_data.ParentCommandLine",
678678
to: "process.parent.command_line",
679679
},
680+
{
681+
from: "winlog.event_data.OriginalFileName",
682+
to: "process.pe.original_file_name",
683+
},
680684
],
681685
mode: "rename",
682686
ignore_missing: true,
683687
fail_on_error: false,
684688
})
689+
.Convert({
690+
fields: [{
691+
from: "winlog.event_data.Company",
692+
to: "process.pe.company",
693+
},
694+
{
695+
from: "winlog.event_data.Description",
696+
to: "process.pe.description",
697+
},
698+
{
699+
from: "winlog.event_data.FileVersion",
700+
to: "process.pe.file_version",
701+
},
702+
{
703+
from: "winlog.event_data.Product",
704+
to: "process.pe.product",
705+
},
706+
],
707+
mode: "copy",
708+
ignore_missing: true,
709+
fail_on_error: false,
710+
})
685711
.Add(setRuleName)
686712
.Add(setProcessNameUsingExe)
687713
.Add(splitProcessArgs)
@@ -951,6 +977,11 @@ var sysmon = (function () {
951977
from: "winlog.event_data.ImageLoaded",
952978
to: "file.path",
953979
},
980+
{
981+
from: "winlog.event_data.OriginalFileName",
982+
to: "file.pe.original_file_name",
983+
},
984+
954985
],
955986
mode: "rename",
956987
ignore_missing: true,
@@ -965,7 +996,24 @@ var sysmon = (function () {
965996
from: "winlog.event_data.SignatureStatus",
966997
to: "file.code_signature.status",
967998
},
999+
{
1000+
from: "winlog.event_data.Company",
1001+
to: "file.pe.company",
1002+
},
1003+
{
1004+
from: "winlog.event_data.Description",
1005+
to: "file.pe.description",
1006+
},
1007+
{
1008+
from: "winlog.event_data.FileVersion",
1009+
to: "file.pe.file_version",
1010+
},
1011+
{
1012+
from: "winlog.event_data.Product",
1013+
to: "file.pe.product",
1014+
},
9681015
],
1016+
ignore_missing: true,
9691017
fail_on_error: false,
9701018
})
9711019
.Add(setRuleName)

‎x-pack/winlogbeat/module/sysmon/test/testdata/sysmon-12-loadimage.evtx‎

68 KB
Binary file not shown.

‎x-pack/winlogbeat/module/sysmon/test/testdata/sysmon-12-loadimage.evtx.golden.json‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
[
2+
{
3+
"@timestamp": "2020-10-28T02:39:26.374Z",
4+
"event": {
5+
"category": [
6+
"process"
7+
],
8+
"code": 7,
9+
"kind": "event",
10+
"module": "sysmon",
11+
"provider": "Microsoft-Windows-Sysmon",
12+
"type": [
13+
"change"
14+
]
15+
},
16+
"file": {
17+
"code_signature": {
18+
"signed": true,
19+
"status": "Valid",
20+
"subject_name": "Microsoft Windows",
21+
"valid": true
22+
},
23+
"directory": "C:\\Windows\\System32",
24+
"extension": "dll",
25+
"hash": {
26+
"md5": "c7c45610f644906e6f7d664ef2e45b08",
27+
"sha1": "9955a1c071c44a7ceecc0d928a9cfb7f64cc3f93",
28+
"sha256": "4808f1101f4e42387d8ddb7a355668bae3bf6f781c42d3bcd82e23446b1deb3e"
29+
},
30+
"name": "IDStore.dll",
31+
"path": "C:\\Windows\\System32\\IDStore.dll",
32+
"pe": {
33+
"company": "Microsoft Corporation",
34+
"description": "Identity Store",
35+
"file_version": "10.0.17763.1 (WinBuild.160101.0800)",
36+
"imphash": "194f3797b52231028c718b6d776c6853",
37+
"original_file_name": "IdStore.dll",
38+
"product": "Microsoft® Windows® Operating System"
39+
}
40+
},
41+
"host": {
42+
"name": "vagrant"
43+
},
44+
"log": {
45+
"level": "information"
46+
},
47+
"process": {
48+
"entity_id": "{9f32b55f-d9de-5f98-f006-000000000600}",
49+
"executable": "C:\\Windows\\System32\\dllhost.exe",
50+
"name": "dllhost.exe",
51+
"pid": 5184
52+
},
53+
"related": {
54+
"hash": [
55+
"9955a1c071c44a7ceecc0d928a9cfb7f64cc3f93",
56+
"c7c45610f644906e6f7d664ef2e45b08",
57+
"4808f1101f4e42387d8ddb7a355668bae3bf6f781c42d3bcd82e23446b1deb3e",
58+
"194f3797b52231028c718b6d776c6853"
59+
]
60+
},
61+
"winlog": {
62+
"api": "wineventlog",
63+
"channel": "Microsoft-Windows-Sysmon/Operational",
64+
"computer_name": "vagrant",
65+
"event_data": {
66+
"Company": "Microsoft Corporation",
67+
"Description": "Identity Store",
68+
"FileVersion": "10.0.17763.1 (WinBuild.160101.0800)",
69+
"Product": "Microsoft® Windows® Operating System",
70+
"RuleName": "-",
71+
"Signature": "Microsoft Windows",
72+
"SignatureStatus": "Valid",
73+
"Signed": "true"
74+
},
75+
"event_id": 7,
76+
"process": {
77+
"pid": 1676,
78+
"thread": {
79+
"id": 4796
80+
}
81+
},
82+
"provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
83+
"provider_name": "Microsoft-Windows-Sysmon",
84+
"record_id": 10685,
85+
"user": {
86+
"domain": "NT AUTHORITY",
87+
"identifier": "S-1-5-18",
88+
"name": "SYSTEM",
89+
"type": "Well Known Group"
90+
},
91+
"version": 3
92+
}
93+
}
94+
]

‎x-pack/winlogbeat/module/sysmon/test/testdata/sysmon-12-processcreate.evtx‎

68 KB
Binary file not shown.

‎x-pack/winlogbeat/module/sysmon/test/testdata/sysmon-12-processcreate.evtx.golden.json‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
[
2+
{
3+
"@timestamp": "2020-10-27T20:00:14.32Z",
4+
"event": {
5+
"category": [
6+
"process"
7+
],
8+
"code": 1,
9+
"kind": "event",
10+
"module": "sysmon",
11+
"provider": "Microsoft-Windows-Sysmon",
12+
"type": [
13+
"start",
14+
"process_start"
15+
]
16+
},
17+
"host": {
18+
"name": "vagrant"
19+
},
20+
"log": {
21+
"level": "information"
22+
},
23+
"process": {
24+
"args": [
25+
"C:\\Windows\\system32\\notepad.exe"
26+
],
27+
"command_line": "\"C:\\Windows\\system32\\notepad.exe\" ",
28+
"entity_id": "{9f32b55f-7c4e-5f98-5803-000000000500}",
29+
"executable": "C:\\Windows\\System32\\notepad.exe",
30+
"hash": {
31+
"sha1": "b6d237154f2e528f0b503b58b025862d66b02b73"
32+
},
33+
"name": "notepad.exe",
34+
"parent": {
35+
"args": [
36+
"C:\\Windows\\Explorer.EXE"
37+
],
38+
"command_line": "C:\\Windows\\Explorer.EXE",
39+
"entity_id": "{9f32b55f-6fdf-5f98-7000-000000000500}",
40+
"executable": "C:\\Windows\\explorer.exe",
41+
"name": "explorer.exe",
42+
"pid": 4212
43+
},
44+
"pe": {
45+
"company": "Microsoft Corporation",
46+
"description": "Notepad",
47+
"file_version": "10.0.17763.475 (WinBuild.160101.0800)",
48+
"original_file_name": "NOTEPAD.EXE",
49+
"product": "Microsoft® Windows® Operating System"
50+
},
51+
"pid": 3616,
52+
"working_directory": "C:\\Users\\vagrant\\"
53+
},
54+
"related": {
55+
"hash": "b6d237154f2e528f0b503b58b025862d66b02b73",
56+
"user": "vagrant"
57+
},
58+
"user": {
59+
"domain": "VAGRANT",
60+
"name": "vagrant"
61+
},
62+
"winlog": {
63+
"api": "wineventlog",
64+
"channel": "Microsoft-Windows-Sysmon/Operational",
65+
"computer_name": "vagrant",
66+
"event_data": {
67+
"Company": "Microsoft Corporation",
68+
"Description": "Notepad",
69+
"FileVersion": "10.0.17763.475 (WinBuild.160101.0800)",
70+
"IntegrityLevel": "Medium",
71+
"LogonGuid": "{9f32b55f-6fdd-5f98-e7c9-020000000000}",
72+
"LogonId": "0x2c9e7",
73+
"Product": "Microsoft® Windows® Operating System",
74+
"RuleName": "-",
75+
"TerminalSessionId": "1"
76+
},
77+
"event_id": 1,
78+
"process": {
79+
"pid": 7144,
80+
"thread": {
81+
"id": 6876
82+
}
83+
},
84+
"provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
85+
"provider_name": "Microsoft-Windows-Sysmon",
86+
"record_id": 20,
87+
"user": {
88+
"domain": "NT AUTHORITY",
89+
"identifier": "S-1-5-18",
90+
"name": "SYSTEM",
91+
"type": "Well Known Group"
92+
},
93+
"version": 5
94+
}
95+
}
96+
]

‎x-pack/winlogbeat/module/sysmon/test/testdata/sysmon-9.01.evtx.golden.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,12 @@
126126
"name": "services.exe",
127127
"pid": 488
128128
},
129+
"pe": {
130+
"company": "Sysinternals - www.sysinternals.com",
131+
"description": "System activity monitor",
132+
"file_version": "9.01",
133+
"product": "Sysinternals Sysmon"
134+
},
129135
"pid": 4860,
130136
"working_directory": "C:\\Windows\\system32\\"
131137
},
@@ -215,6 +221,12 @@
215221
"name": "svchost.exe",
216222
"pid": 560
217223
},
224+
"pe": {
225+
"company": "Microsoft Corporation",
226+
"description": "Sink to receive asynchronous callbacks for WMI client application",
227+
"file_version": "6.3.9600.16384 (winblue_rtm.130821-1623)",
228+
"product": "Microsoft® Windows® Operating System"
229+
},
218230
"pid": 5028,
219231
"working_directory": "C:\\Windows\\system32\\"
220232
},
@@ -404,6 +416,12 @@
404416
"name": "svchost.exe",
405417
"pid": 560
406418
},
419+
"pe": {
420+
"company": "Microsoft Corporation",
421+
"description": "WMI Provider Host",
422+
"file_version": "6.3.9600.16384 (winblue_rtm.130821-1623)",
423+
"product": "Microsoft® Windows® Operating System"
424+
},
407425
"pid": 4508,
408426
"working_directory": "C:\\Windows\\system32\\"
409427
},

0 commit comments

Comments
 (0)