hunters-forge-OSSEM/docs/cdm/entities/process.md

process

Event fields used to define metadata about processes in an system. Isolated memory address space that is used to run a program. Inside a processes' address space the system can load code modules, but must have at latest one thread running to do so.

Attributes

Name	Type	Description	Sample Value
process_call_trace	string	Stack trace of where open process is called	```C:\WINDOWS\SYSTEM32\ntdll.dll+a0344
process_command_line	string	Command arguments that were were executed by the process in the endpoint.	C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1
process_company	string	Company name metadata of the Image file	Microsoft Corporation
process_current_directory	string	The full path to the current directory for the process. The string can also specify a UNC path.	C:\Users\Panda\Test
process_file_description	string	Description of the Image file	Console Window Host
process_file_name	string	Name of the Image file or executable file used to define the initial code and data mapped into the process' virtual address space. This does not contain the full patth of the Image file.	conhost.exe
process_file_path	string	The complete path and name of the Image file or executable file used to define the initial code and data mapped into the process' virtual address space.	C:\Windows\System32\conhost.exe
process_file_product	string	The Image's file product name	Microsoft Windows Operating System
process_file_version	string	Version of the Image file	10.0.16299.15 (WinBuild.160101.0800)
process_granted_access	string	granted access code requested/used to open a target process	0x1000
process_guid	string	Process global unique identifer used to identify a process across other operating systems. This can be created by group hashing values such as Process Name, Process Id, Process Start Time, Process Path and even Computer Name. Datasets such as Sysmon call this the ProcessGuid. This is similar to the output from the UUIDGEN command.	A98268C1-9C2E-5ACD-0000-0010396CAB00
process_hash_imphash	string	IMPHASH hash of the image/binary/file	2505BD03D7BD285E50CE89CEC02B333B
process_hash_md5	string	MD5 hash of the image/binary/file	6A255BEBF3DBCD13585538ED47DBAFD7
process_hash_sha1	string	SHA1 hash of the image/binary/file	B0BF5AC2E81BBF597FAD5F349FEEB32CAC449FA2
process_hash_sha256	string	SHA256 hash of the image/binary/file	4668BB2223FFB983A5F1273B9E3D9FA2C5CE4A0F1FB18CA5C1B285762020073C
process_hash_sha512	string	SHA512 hash of the image/binary/file	1AD1D79F85D8F6A50EA282F63898D652661DAA0C1FD361C22647CABC98A70E8CBCE83200D579D10DD0A3D46BE9496DCDFDDF28B0C5E9709343B032A8796FBECB
process_id	integer	Process unique identifier used by the current operating system to identify a process.	4756
process_injected_address	string	The memory address where the subprocess is injected	0xFFFFBC6422DD9C20
process_integrity_level	string	Integrity label assigned to a process	Medium
process_is_hidden	boolean	Describes if the process is hidden.	True
process_name	string	Name of the process derived from the Image file or executable file used to define the initial code and data mapped into the process' virtual address space. This does not contain the full patth of the Image file.	conhost.exe
process_parent_call_trace	string	Stack trace of where open process is called	```C:\WINDOWS\SYSTEM32\ntdll.dll+a0344
process_parent_command_line	string	Command arguments that were were executed by the process in the endpoint.	C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1
process_parent_company	string	Company name metadata of the Image file	Microsoft Corporation
process_parent_current_directory	string	The full path to the current directory for the process. The string can also specify a UNC path.	C:\Users\Panda\Test
process_parent_file_description	string	Description of the Image file	Console Window Host
process_parent_file_name	string	Name of the Image file or executable file used to define the initial code and data mapped into the process' virtual address space. This does not contain the full patth of the Image file.	conhost.exe
process_parent_file_path	string	The complete path and name of the Image file or executable file used to define the initial code and data mapped into the process' virtual address space.	C:\Windows\System32\conhost.exe
process_parent_file_product	string	The Image's file product name	Microsoft Windows Operating System
process_parent_file_version	string	Version of the Image file	10.0.16299.15 (WinBuild.160101.0800)
process_parent_granted_access	string	granted access code requested/used to open a target process	0x1000
process_parent_guid	string	Process global unique identifer used to identify a process across other operating systems. This can be created by group hashing values such as Process Name, Process Id, Process Start Time, Process Path and even Computer Name. Datasets such as Sysmon call this the ProcessGuid. This is similar to the output from the UUIDGEN command.	A98268C1-9C2E-5ACD-0000-0010396CAB00
process_parent_hash_imphash	string	IMPHASH hash of the image/binary/file	2505BD03D7BD285E50CE89CEC02B333B
process_parent_hash_md5	string	MD5 hash of the image/binary/file	6A255BEBF3DBCD13585538ED47DBAFD7
process_parent_hash_sha1	string	SHA1 hash of the image/binary/file	B0BF5AC2E81BBF597FAD5F349FEEB32CAC449FA2
process_parent_hash_sha256	string	SHA256 hash of the image/binary/file	4668BB2223FFB983A5F1273B9E3D9FA2C5CE4A0F1FB18CA5C1B285762020073C
process_parent_hash_sha512	string	SHA512 hash of the image/binary/file	1AD1D79F85D8F6A50EA282F63898D652661DAA0C1FD361C22647CABC98A70E8CBCE83200D579D10DD0A3D46BE9496DCDFDDF28B0C5E9709343B032A8796FBECB
process_parent_id	integer	Process unique identifier used by the current operating system to identify a process.	4756
process_parent_injected_address	string	The memory address where the subprocess is injected	0xFFFFBC6422DD9C20
process_parent_integrity_level	string	Integrity label assigned to a process	Medium
process_parent_is_hidden	boolean	Describes if the process is hidden.	True
process_parent_name	string	Name of the process derived from the Image file or executable file used to define the initial code and data mapped into the process' virtual address space. This does not contain the full patth of the Image file.	conhost.exe