hunters-forge-OSSEM/common_information_model/entities/process.md

Process Schema

Event fields used to define metadata about processes in an system.

Data Fields

Standard Name	Type	Description	Sample Value
process_call_trace	string	Stack trace of where open process is called	C:\WINDOWS\SYSTEM32\ntdll.dll+a0344 \
process_command_line	string	Command arguments that were were executed by the main process in the event (child process)	??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1
process_current_directory	string	The path without the name of the image associated with the process	C:\WINDOWS
process_granted_access	string	granted access code requested/used to open a target process	0x1000
process_guid	string	Process Guid of the main process that got spawned/created (child)	{A98268C1-9C2E-5ACD-0000-0010396CAB00}
process_id	integer	Process ID used by the operating system to identify the created process (child)	4756
process_integrity_level	string	Integrity label assigned to a process	Medium
process_name	string	The name of the executable without full path related to the process being spawned/created in the event. Considered also the child or source process	conhost.exe
process_parent_command_line	string	Command arguments that were passed to the executable related to the parent process	C:\WINDOWS\system32\cmd.exe
process_parent_guid	string	ProcessGUID of the process that spawned/created the main process (child)	{A98268C1-9C2E-5ACD-0000-00100266AB00}
process_parent_id	integer	Process ID of the process that spawned/created the main process (child)	240
process_parent_name	string	The name of the executable without full path related to the process that spawned/created the main process (child)	cmd.exe
process_parent_path	string	The complete path and name of the executable related to the the process that spawned/created the main process (child)	C:\Windows\System32\cmd.exe
process_path	string	The complete path and name of the executable related to the main process in the event. Considered also the child or source process path	C:\Windows\System32\conhost.exe
target_process_address	string	The memory address where the subprocess is injected	0xFFFFBC6422DD9C20
target_process_guid	string	Process Guid of the target process	{A98268C1-9C2E-5ACD-0000-00100266AB00}
target_process_id	integer	Process ID used by the os to identify the target process	240
target_process_name	string	The name of the executable related to the target process	cmd.exe
target_process_path	string	The complete path and name of the executable associated with the target process	C:\Windows\System32\cmd.exe