@jamiehynds @efd6 Thanks for your suggestion.

    <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
        <System>
            <Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}' />
            <EventID>29</EventID>
            <Version>5</Version>
            <Level>4</Level>
            <Task>29</Task>
            <Opcode>0</Opcode>
            <Keywords>0x8000000000000000</Keywords>
            <TimeCreated SystemTime='2023-06-30T01:53:13.0787986Z' />
            <EventRecordID>679378</EventRecordID>
            <Correlation />
            <Execution ProcessID='2824' ThreadID='1380' />
            <Channel>Microsoft-Windows-Sysmon/Operational</Channel>
            <Computer>SEC-TRACE-WinSRV22-Y01</Computer>
            <Security UserID='S-1-5-18' />
        </System>
        <EventData>
            <Data Name='RuleName'>-</Data>
            <Data Name='UtcTime'>2023-06-30 01:53:13.076</Data>
            <Data Name='ProcessGuid'>{2f280947-3586-649e-5901-000000000e00}</Data>
            <Data Name='ProcessId'>3828</Data>
            <Data Name='User'>SEC-TRACE-WINSR\auruser</Data>
            <Data Name='Image'>C:\Windows\system32\curl.exe</Data>
            <Data Name='TargetFilename'>
                C:\Users\auruser\Desktop\32365e3e64d28cc94756ac9a09b67f06.bin</Data>
            <Data Name='Hashes'>
                SHA1=D48757B74EFF02255F74614F35AA27ABBE3F72C7,MD5=32365E3E64D28CC94756AC9A09B67F06,SHA256=09043C51719D4BF6405C9A7A292BB9BB3BCC782F639B708DDCC4EEDB5E5C9CE9,IMPHASH=1F2627FC453DC35031A9502372BD3549</Data>
        </EventData>
    </Event>

Add coverage for sysmon 15.0/event 29 #6748

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions