hunters-forge-OSSEM/docs/cdm/tables/processes.md

processes

Endpoint Process Events

Attributes

Entity	Name	Type	Description	Sample Value
process	process_call_trace	string	Stack trace of where open process is called	C:\WINDOWS\SYSTEM32\ntdll.dll+a0344
process	process_command_line	string	Command arguments that were were executed by the process in the endpoint.	C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1
process	process_company	string	Company name metadata of the Image file	Microsoft Corporation
process	process_file_description	string	Description of the Image file	Console Window Host
process	process_file_directory	string	Current working directory for the Image file related to the process. It does not include the Image file name. Only the Path.	C:\WINDOWS\system32\
process	process_file_name	string	Name of the Image file or executable file used to define the initial code and data mapped into the process' virtual address space. This does not contain the full patth of the Image file.	conhost.exe
process	process_file_path	string	The complete path and name of the Image file or executable file used to define the initial code and data mapped into the process' virtual address space.	C:\Windows\System32\conhost.exe
process	process_file_product	string	The Image's file product name	Microsoft® Windows® Operating System
process	process_file_version	string	Version of the Image file	10.0.16299.15 (WinBuild.160101.0800)
process	process_granted_access	string	granted access code requested/used to open a target process	0x1000
process	process_guid	string	Process global unique identifer used to identify a process across other operating systems. This can be created by group hashing values such as Process Name, Process Id, Process Start Time, Process Path and even Computer Name. Datasets such as Sysmon call this the ProcessGuid. This is similar to the output from the UUIDGEN command.	A98268C1-9C2E-5ACD-0000-0010396CAB00
process	process_hash_imphash	string	IMPHASH hash of the image/binary/file	2505BD03D7BD285E50CE89CEC02B333B
process	process_hash_md5	string	MD5 hash of the image/binary/file	6A255BEBF3DBCD13585538ED47DBAFD7
process	process_hash_sha1	string	SHA1 hash of the image/binary/file	B0BF5AC2E81BBF597FAD5F349FEEB32CAC449FA2
process	process_hash_sha256	string	SHA256 hash of the image/binary/file	4668BB2223FFB983A5F1273B9E3D9FA2C5CE4A0F1FB18CA5C1B285762020073C
process	process_hash_sha512	string	SHA512 hash of the image/binary/file	1AD1D79F85D8F6A50EA282F63898D652661DAA0C1FD361C22647CABC98A70E8CBCE83200D579D10DD0A3D46BE9496DCDFDDF28B0C5E9709343B032A8796FBECB
process	process_id	integer	Process unique identifier used by the current operating system to identify a process.	4756
process	process_injected_address	string	The memory address where the subprocess is injected	0xFFFFBC6422DD9C20
process	process_integrity_level	string	Integrity label assigned to a process	Medium
process	process_is_hidden	boolean	Describes if the process is hidden.	True
process	process_name	string	Name of the process derived from the Image file or executable file used to define the initial code and data mapped into the process' virtual address space. This does not contain the full patth of the Image file.	conhost.exe
process	process_parent_call_trace	string	Stack trace of where open process is called	C:\WINDOWS\SYSTEM32\ntdll.dll+a0344
process	process_parent_command_line	string	Command arguments that were were executed by the process in the endpoint.	C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1
process	process_parent_company	string	Company name metadata of the Image file	Microsoft Corporation
process	process_parent_file_description	string	Description of the Image file	Console Window Host
process	process_parent_file_directory	string	Current working directory for the Image file related to the process. It does not include the Image file name. Only the Path.	C:\WINDOWS\system32\
process	process_parent_file_name	string	Name of the Image file or executable file used to define the initial code and data mapped into the process' virtual address space. This does not contain the full patth of the Image file.	conhost.exe
process	process_parent_file_path	string	The complete path and name of the Image file or executable file used to define the initial code and data mapped into the process' virtual address space.	C:\Windows\System32\conhost.exe
process	process_parent_file_product	string	The Image's file product name	Microsoft® Windows® Operating System
process	process_parent_file_version	string	Version of the Image file	10.0.16299.15 (WinBuild.160101.0800)
process	process_parent_granted_access	string	granted access code requested/used to open a target process	0x1000
process	process_parent_guid	string	Process global unique identifer used to identify a process across other operating systems. This can be created by group hashing values such as Process Name, Process Id, Process Start Time, Process Path and even Computer Name. Datasets such as Sysmon call this the ProcessGuid. This is similar to the output from the UUIDGEN command.	A98268C1-9C2E-5ACD-0000-0010396CAB00
process	process_parent_hash_imphash	string	IMPHASH hash of the image/binary/file	2505BD03D7BD285E50CE89CEC02B333B
process	process_parent_hash_md5	string	MD5 hash of the image/binary/file	6A255BEBF3DBCD13585538ED47DBAFD7
process	process_parent_hash_sha1	string	SHA1 hash of the image/binary/file	B0BF5AC2E81BBF597FAD5F349FEEB32CAC449FA2
process	process_parent_hash_sha256	string	SHA256 hash of the image/binary/file	4668BB2223FFB983A5F1273B9E3D9FA2C5CE4A0F1FB18CA5C1B285762020073C
process	process_parent_hash_sha512	string	SHA512 hash of the image/binary/file	1AD1D79F85D8F6A50EA282F63898D652661DAA0C1FD361C22647CABC98A70E8CBCE83200D579D10DD0A3D46BE9496DCDFDDF28B0C5E9709343B032A8796FBECB
process	process_parent_id	integer	Process unique identifier used by the current operating system to identify a process.	4756
process	process_parent_injected_address	string	The memory address where the subprocess is injected	0xFFFFBC6422DD9C20
process	process_parent_integrity_level	string	Integrity label assigned to a process	Medium
process	process_parent_is_hidden	boolean	Describes if the process is hidden.	True
process	process_parent_name	string	Name of the process derived from the Image file or executable file used to define the initial code and data mapped into the process' virtual address space. This does not contain the full patth of the Image file.	conhost.exe