Event ID 1: Process creation
Contents
Event ID 1: Process creation¶
Version: 4.81¶
Description¶
The process creation event provides extended information about a newly created process. The full command line provides context on the process execution. The ProcessGUID field is a unique value for this process across a domain to make event correlation easier.
Data Dictionary¶
Field Name |
Type |
Description |
Sample Value |
|---|---|---|---|
RuleName |
string |
custom tag mapped to event. i.e ATT&CK technique ID |
|
UtcTime |
date |
Time in UTC when event was created |
|
ProcessGuid |
string |
Process Guid of the process that got spawned/created (child) |
|
ProcessId |
integer |
Process ID used by the os to identify the created process (child) |
|
Image |
string |
File path of the process being spawned/created. Considered also the child or source process |
|
FileVersion |
string |
Version of the image associated with the main process (child) |
`` |
Description |
string |
Description of the image associated with the main process (child) |
`` |
Product |
string |
Product name the image associated with the main process (child) belongs to |
`` |
Company |
string |
Company name the image associated with the main process (child) belongs to |
`` |
OriginalFileName |
string |
original file name |
`` |
CommandLine |
string |
Arguments which were passed to the executable associated with the main process |
|
CurrentDirectory |
string |
Current working directory from which the main process executed. |
`` |
IntegrityLevel |
string |
Integrity label assigned to a process |
|
User |
string |
Name of the account who created the process (child) . |
|
LogonGuid |
string |
Logon GUID of the user who created the new process. Value that can help you correlate this event with others that contain the same Logon GUID (Sysmon Events) |
|
LogonId |
integer |
Login ID of the user who created the new process. Value that can help you correlate this event with others that contain the same Logon ID |
|
TerminalSessionId |
integer |
ID of the session the user belongs to |
|
Hashes |
string |
Hashes captured by sysmon driver |
`` |
ParentUser |
string |
Name of the account who created the process that spawned/created the main process (child) |
|
ParentProcessGuid |
string |
ProcessGUID of the process that spawned/created the main process (child) |
|
ParentProcessId |
integer |
Process ID of the process that spawned/created the main process (child) |
|
ParentImage |
string |
File path that spawned/created the main process |
|
ParentCommandLine |
string |
Arguments which were passed to the executable associated with the parent process |
|