mirror of
https://github.com/jonny-jhnson/JonMon-Lite
synced 2026-06-21 13:54:24 +00:00
Jonathan Johnson
601 lines
24 KiB
Groff
601 lines
24 KiB
Groff
<?xml version='1.0' encoding='utf-8' standalone='yes'?>
|
|
<instrumentationManifest
|
|
xmlns="http://schemas.microsoft.com/win/2004/08/events"
|
|
xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events"
|
|
xmlns:xs="http://www.w3.org/2001/XMLSchema"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd"
|
|
>
|
|
<instrumentation>
|
|
<events>
|
|
<provider
|
|
name="JonMon-Lite"
|
|
guid="{D8909C24-5BE9-4502-98CA-AB7BDC24899D}"
|
|
symbol="JonMonLiteProvider"
|
|
resourceFileName="C:\Windows\JonMon-Lite-Provider.dll"
|
|
messageFileName="C:\Windows\JonMon-Lite-Provider.dll"
|
|
>
|
|
<channels>
|
|
<channel name="JonMon-Lite/Operational" chid="JonMon-Lite" enabled="true" type="Operational" isolation="System">
|
|
<logging>
|
|
<maxSize>67112660</maxSize>
|
|
</logging>
|
|
</channel>
|
|
</channels>
|
|
<templates>
|
|
<template tid="EID1">
|
|
<data
|
|
name="EventTime"
|
|
inType="win:SYSTEMTIME"
|
|
outType="xs:dateTime">
|
|
</data>
|
|
<data
|
|
name="WorkstationName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="NewProcessId"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="ParentProcessId"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="SessionId"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="Flags"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="IsElevated"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="MandatoryLabel"
|
|
inType="win:SID"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ImageName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="PackageFullName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="SecurityMitigations"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
</template>
|
|
|
|
<template tid="EID2">
|
|
<data
|
|
name="EventTime"
|
|
inType="win:SYSTEMTIME"
|
|
outType="xs:dateTime">
|
|
</data>
|
|
<data
|
|
name="WorkstationName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="BaseName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="RelativeName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="Disposition"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="Status"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
</template>
|
|
|
|
<template tid="EID3">
|
|
<data
|
|
name="EventTime"
|
|
inType="win:SYSTEMTIME"
|
|
outType="xs:dateTime">
|
|
</data>
|
|
<data
|
|
name="WorkstationName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ServiceName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ImagePath"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ServiceType"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="StartType"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="AccountName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
</template>
|
|
|
|
<template tid="EID4">
|
|
<data
|
|
name="EventTime"
|
|
inType="win:SYSTEMTIME"
|
|
outType="xs:dateTime">
|
|
</data>
|
|
<data
|
|
name="WorkstationName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="FileName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="IssuingThreadId"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="ShareAccess"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="CreateOptions"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
</template>
|
|
|
|
<template tid="EID5">
|
|
<data
|
|
name="EventTime"
|
|
inType="win:SYSTEMTIME"
|
|
outType="xs:dateTime">
|
|
</data>
|
|
<data
|
|
name="WorkstationName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ProcessId"
|
|
inType="win:UInt64"
|
|
outType="xs:unsignedLong">
|
|
</data>
|
|
<data
|
|
name="AssemblyID"
|
|
inType="win:UInt64"
|
|
outType="xs:unsignedLong">
|
|
</data>
|
|
<data
|
|
name="AppDomainID"
|
|
inType="win:UInt64"
|
|
outType="xs:unsignedLong">
|
|
</data>
|
|
<data
|
|
name="AssemblyName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ClrInstanceID"
|
|
inType="win:UInt16"
|
|
outType="xs:HexInt16">
|
|
</data>
|
|
</template>
|
|
|
|
<template tid="EID6">
|
|
<data
|
|
name="EventTime"
|
|
inType="win:SYSTEMTIME"
|
|
outType="xs:dateTime">
|
|
</data>
|
|
<data
|
|
name="WorkstationName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ProcessId"
|
|
inType="win:UInt64"
|
|
outType="xs:unsignedLong">
|
|
</data>
|
|
<data
|
|
name="Namespace"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ESS"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="Consumer"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="PossibleCause"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
</template>
|
|
|
|
<template tid="EID7">
|
|
<data
|
|
name="EventTime"
|
|
inType="win:SYSTEMTIME"
|
|
outType="xs:dateTime">
|
|
</data>
|
|
<data
|
|
name="WorkstationName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ProcessId"
|
|
inType="win:UInt64"
|
|
outType="xs:unsignedLong">
|
|
</data>
|
|
<data
|
|
name="InterfaceUUID"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ProcNum"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="Protocol"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="NetworkAddress"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="Endpoint"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="InterfaceString"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="MethodString"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
</template>
|
|
|
|
<template tid="EID8">
|
|
<data
|
|
name="EventTime"
|
|
inType="win:SYSTEMTIME"
|
|
outType="xs:dateTime">
|
|
</data>
|
|
<data
|
|
name="WorkstationName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ProcessId"
|
|
inType="win:UInt64"
|
|
outType="xs:unsignedLong">
|
|
</data>
|
|
<data
|
|
name="InterfaceUUID"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ProcNum"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="Protocol"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="NetworkAddress"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="Endpoint"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="InterfaceString"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="MethodString"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
</template>
|
|
<template tid="EID9">
|
|
<data
|
|
name="EventTime"
|
|
inType="win:SYSTEMTIME"
|
|
outType="xs:dateTime">
|
|
</data>
|
|
<data
|
|
name="WorkstationName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ProcessId"
|
|
inType="win:UInt64"
|
|
outType="xs:unsignedLong">
|
|
</data>
|
|
<data
|
|
name="OperationType"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="DataDescription"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="Flags"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="ProtectionFlags"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
</template>
|
|
<template tid="EID10">
|
|
<data
|
|
name="EventTime"
|
|
inType="win:SYSTEMTIME"
|
|
outType="xs:dateTime">
|
|
</data>
|
|
<data
|
|
name="WorkstationName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ProcessId"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="SrcIpAddressIpv4"
|
|
inType="win:UnicodeString"
|
|
outType="win:string">
|
|
</data>
|
|
<data
|
|
name="DestIpAddressIpv4"
|
|
inType="win:UnicodeString"
|
|
outType="win:string">
|
|
</data>
|
|
<data
|
|
name="SrcPort"
|
|
inType="win:UInt16"
|
|
outType="win:Port">
|
|
</data>
|
|
<data
|
|
name="DestPort"
|
|
inType="win:UInt16"
|
|
outType="win:Port">
|
|
</data>
|
|
<data
|
|
name="Initiated"
|
|
inType="win:Boolean"
|
|
outType="xs:boolean">
|
|
</data>
|
|
</template>
|
|
<template tid="EID11">
|
|
<data
|
|
name="EventTime"
|
|
inType="win:SYSTEMTIME"
|
|
outType="xs:dateTime">
|
|
</data>
|
|
<data
|
|
name="WorkstationName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ProcessId"
|
|
inType="win:UInt64"
|
|
outType="xs:unsignedLong">
|
|
</data>
|
|
<data
|
|
name="AppName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ContentName"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ScanStatus"
|
|
inType="win:UInt8"
|
|
outType="xs:string">
|
|
</data>
|
|
<data
|
|
name="ScanResult"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="ContentSize"
|
|
inType="win:UInt32"
|
|
outType="xs:unsignedInt">
|
|
</data>
|
|
<data
|
|
name="Content"
|
|
inType="win:Binary"
|
|
length="ContentSize"
|
|
outType="xs:hexBinary">
|
|
</data>
|
|
<data
|
|
name="DecodedContent"
|
|
inType="win:UnicodeString"
|
|
outType="xs:string">
|
|
</data>
|
|
</template>
|
|
</templates>
|
|
<events>
|
|
<event value="1"
|
|
channel="JonMon-Lite"
|
|
level="win:Informational"
|
|
template="EID1"
|
|
opcode="win:Info"
|
|
symbol="ProcessCreation"
|
|
message ="$(string.ProcessCreation.EventMessage)"/>
|
|
<event value="2"
|
|
channel="JonMon-Lite"
|
|
level="win:Informational"
|
|
template="EID2"
|
|
opcode="win:Info"
|
|
symbol="RegistryCreateKey"
|
|
message ="$(string.RegistryCreateKey.EventMessage)"/>
|
|
<event value="3"
|
|
channel="JonMon-Lite"
|
|
level="win:Informational"
|
|
template="EID3"
|
|
opcode="win:Info"
|
|
symbol="ServiceCreation"
|
|
message ="$(string.ServiceCreation.EventMessage)"/>
|
|
<event value="4"
|
|
channel="JonMon-Lite"
|
|
level="win:Informational"
|
|
template="EID4"
|
|
opcode="win:Info"
|
|
symbol="FileCreation"
|
|
message ="$(string.FileCreation.EventMessage)"/>
|
|
<event value="5"
|
|
channel="JonMon-Lite"
|
|
level="win:Informational"
|
|
template="EID5"
|
|
opcode="win:Info"
|
|
symbol="DotNetLoad"
|
|
message ="$(string.DotNetLoad.EventMessage)"/>
|
|
<event value="6"
|
|
channel="JonMon-Lite"
|
|
level="win:Informational"
|
|
template="EID6"
|
|
opcode="win:Info"
|
|
symbol="WMIEventFilter"
|
|
message ="$(string.WMIEventFilter.EventMessage)"/>
|
|
<event value="7"
|
|
channel="JonMon-Lite"
|
|
level="win:Informational"
|
|
template="EID7"
|
|
opcode="win:Info"
|
|
symbol="RPCClient"
|
|
message ="$(string.RPCClient.EventMessage)"/>
|
|
<event value="8"
|
|
channel="JonMon-Lite"
|
|
level="win:Informational"
|
|
template="EID8"
|
|
opcode="win:Info"
|
|
symbol="RPCServer"
|
|
message ="$(string.RPCServer.EventMessage)"/>
|
|
<event value="9"
|
|
channel="JonMon-Lite"
|
|
level="win:Informational"
|
|
template="EID9"
|
|
opcode="win:Info"
|
|
symbol="DPAPIUnprotect"
|
|
message ="$(string.DPAPIUnprotect.EventMessage)"/>
|
|
<event value="10"
|
|
channel="JonMon-Lite"
|
|
level="win:Informational"
|
|
template="EID10"
|
|
opcode="win:Info"
|
|
symbol="NetworkConnection"
|
|
message ="$(string.NetworkConnection.EventMessage)"/>
|
|
<event value="11"
|
|
channel="JonMon-Lite"
|
|
level="win:Informational"
|
|
template="EID11"
|
|
opcode="win:Info"
|
|
symbol="AMSI"
|
|
message ="$(string.AMSI.EventMessage)"/>
|
|
</events>
|
|
</provider>
|
|
</events>
|
|
</instrumentation>
|
|
<localization xmlns="http://schemas.microsoft.com/win/2004/08/events">
|
|
<resources culture="en-US">
|
|
<stringTable>
|
|
<string id="ProcessCreation.EventMessage" value="Process Creation Event %n%n Click on Details or XML view to see event information"/>
|
|
<string id="RegistryCreateKey.EventMessage" value="Registry Key Creation Event %n%n Click on Details or XML view to see event information"/>
|
|
<string id="ServiceCreation.EventMessage" value="Service Creation Event %n%n Click on Details or XML view to see event information"/>
|
|
<string id="FileCreation.EventMessage" value="File Creation Event %n%n Click on Details or XML view to see event information"/>
|
|
<string id="DotNetLoad.EventMessage" value="Dot Net Load Event %n%n Click on Details or XML view to see event information"/>
|
|
<string id="WMIEventFilter.EventMessage" value="WMI Event Filter Event %n%n Click on Details or XML view to see event information"/>
|
|
<string id="RPCClient.EventMessage" value="RPC Client Event %n%n Click on Details or XML view to see event information"/>
|
|
<string id="RPCServer.EventMessage" value="RPC Server Event %n%n Click on Details or XML view to see event information"/>
|
|
<string id="DPAPIUnprotect.EventMessage" value="DPAPI Unprotect Event %n%n Click on Details or XML view to see event information"/>
|
|
<string id="NetworkConnection.EventMessage" value="Network Connection Event %n%n Click on Details or XML view to see event information"/>
|
|
<string id="AMSI.EventMessage" value="AMSI Event %n%n Click on Details or XML view to see event information"/>
|
|
</stringTable>
|
|
</resources>
|
|
</localization>
|
|
</instrumentationManifest> |