Event ID 1: Process creation

Version: 4.81

Description

The process creation event provides extended information about a newly created process. The full command line provides context on the process execution. The ProcessGUID field is a unique value for this process across a domain to make event correlation easier.

Data Dictionary

Field Name

Type

Description

Sample Value

RuleName

string

custom tag mapped to event. i.e ATT&CK technique ID

T1114

UtcTime

date

Time in UTC when event was created

2021-10-13T20:06:22.6500000Z

ProcessGuid

string

Process Guid of the process that got spawned/created (child)

{844e14fa-3c3e-6167-98ab-cd236b550000}

ProcessId

integer

Process ID used by the os to identify the created process (child)

5079

Image

string

File path of the process being spawned/created. Considered also the child or source process

/usr/sbin/rsyslogd

FileVersion

string

Version of the image associated with the main process (child)

``

Description

string

Description of the image associated with the main process (child)

``

Product

string

Product name the image associated with the main process (child) belongs to

``

Company

string

Company name the image associated with the main process (child) belongs to

``

OriginalFileName

string

original file name

``

CommandLine

string

Arguments which were passed to the executable associated with the main process

/usr/sbin/rsyslogd -n

CurrentDirectory

string

Current working directory from which the main process executed.

``

IntegrityLevel

string

Integrity label assigned to a process

no level

User

string

Name of the account who created the process (child) .

root

LogonGuid

string

Logon GUID of the user who created the new process. Value that can help you correlate this event with others that contain the same Logon GUID (Sysmon Events)

{844e14fa-0000-0000-0000-000000000000}

LogonId

integer

Login ID of the user who created the new process. Value that can help you correlate this event with others that contain the same Logon ID

0xf6219

TerminalSessionId

integer

ID of the session the user belongs to

4294967295

Hashes

string

Hashes captured by sysmon driver

``

ParentUser

string

Name of the account who created the process that spawned/created the main process (child)

root

ParentProcessGuid

string

ProcessGUID of the process that spawned/created the main process (child)

{A98268C1-9C2E-5ACD-0000-00100266AB00}

ParentProcessId

integer

Process ID of the process that spawned/created the main process (child)

240

ParentImage

string

File path that spawned/created the main process

/lib/systemd/systemd

ParentCommandLine

string

Arguments which were passed to the executable associated with the parent process

/sbin/init