mirror of
https://github.com/jsecurity101/TelemetrySource
synced 2026-06-06 15:54:34 +00:00
Jonathan Johnson
1 line
14 KiB
XML
1 line
14 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" class="graphdiagram" viewBox="-1351.9437729781873 -466.0489010770097 3576.914087938179 1963.0445173089292"><g class="layer relationships"><g class="related-pair"><g class="relationship" transform="translate(-479.04722595214844,-212.55958557128906) rotate(0)"><path class="relationship" d="M 89.89078140343551 4 L 586.6704171230788 4 L 586.6704171230788 16 L 618.6704171230788 0 L 586.6704171230788 -16 L 586.6704171230788 -4 L 89.89078140343551 -4 Z" fill="rgb(0, 0, 0)" stroke="rgb(51, 51, 51)" stroke-width="0px"/></g></g><g class="related-pair"><g class="relationship" transform="translate(313,250.5) rotate(-90)"><path class="relationship" d="M 141.30320022424445 4 L 257.6827767422194 4 L 257.6827767422194 16 L 289.6827767422194 0 L 257.6827767422194 -16 L 257.6827767422194 -4 L 141.30320022424445 -4 Z" fill="rgb(0, 0, 0)" stroke="rgb(51, 51, 51)" stroke-width="0px"/></g></g><g class="related-pair"><g class="relationship" transform="translate(313,731.6982421875) rotate(-90)"><path class="relationship" d="M 217.40897493085106 4 L 307.89504196325555 4 L 307.89504196325555 16 L 339.89504196325555 0 L 307.89504196325555 -16 L 307.89504196325555 -4 L 217.40897493085106 -4 Z" fill="rgb(0, 0, 0)" stroke="rgb(51, 51, 51)" stroke-width="0px"/></g></g><g class="related-pair"><g class="relationship" transform="translate(313,731.6982421875) rotate(0)"><path class="relationship" d="M 217.40897493085106 4 L 1210.2705580844868 4 L 1210.2705580844868 16 L 1242.2705580844868 0 L 1210.2705580844868 -16 L 1210.2705580844868 -4 L 217.40897493085106 -4 Z" fill="rgb(0, 0, 0)" stroke="rgb(51, 51, 51)" stroke-width="0px"/></g></g><g class="related-pair"><g class="relationship" transform="translate(1727.1820068359375,731.6982421875) rotate(90)"><path class="relationship" d="M 171.91144875145068 4 L 400.4744765415181 4 L 400.4744765415181 16 L 432.4744765415181 0 L 400.4744765415181 -16 L 400.4744765415181 -4 L 171.91144875145068 -4 Z" fill="rgb(0, 0, 0)" stroke="rgb(51, 51, 51)" stroke-width="0px"/></g></g></g><g class="layer nodes"><circle class="node node-id-0" r="74.89078140343551" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" stroke-width="8px" cx="-479.04722595214844" cy="-212.55958557128906"/><circle class="node node-id-1" r="158.37680882906966" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" stroke-width="8px" cx="313" cy="-212.55958557128906"/><circle class="node node-id-2" r="126.30320022424446" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" stroke-width="8px" cx="313" cy="250.5"/><circle class="node node-id-3" r="202.40897493085106" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" stroke-width="8px" cx="313" cy="731.6982421875"/><circle class="node node-id-4" r="156.91144875145068" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" stroke-width="8px" cx="1727.1820068359375" cy="731.6982421875"/><circle class="node node-id-5" r="156.91144875145068" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" stroke-width="8px" cx="1727.1820068359375" cy="1336.0841674804688"/><g class="caption"><text class="caption node" text-anchor="middle" alignment-baseline="central" x="-479.04722595214844" y="-212.55958557128906" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">API's</text></g><g class="caption"><text class="caption node" text-anchor="middle" alignment-baseline="central" x="313" y="-262.55958557128906" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Event</text><text class="caption node" text-anchor="middle" alignment-baseline="central" x="313" y="-212.55958557128906" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Registration</text><text class="caption node" text-anchor="middle" alignment-baseline="central" x="313" y="-162.55958557128906" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Mechanism</text></g><g class="caption"><text class="caption node" text-anchor="middle" alignment-baseline="central" x="313" y="225.5" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Sysmon</text><text class="caption node" text-anchor="middle" alignment-baseline="central" x="313" y="275.5" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Driver</text></g><g class="caption"><text class="caption node" text-anchor="middle" alignment-baseline="central" x="313" y="681.6982421875" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Input/Output</text><text class="caption node" text-anchor="middle" alignment-baseline="central" x="313" y="731.6982421875" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Control</text><text class="caption node" text-anchor="middle" alignment-baseline="central" x="313" y="781.6982421875" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Interface</text></g><g class="caption"><text class="caption node" text-anchor="middle" alignment-baseline="central" x="1727.1820068359375" y="681.6982421875" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Sysmon</text><text class="caption node" text-anchor="middle" alignment-baseline="central" x="1727.1820068359375" y="731.6982421875" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Service</text><text class="caption node" text-anchor="middle" alignment-baseline="central" x="1727.1820068359375" y="781.6982421875" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Binary</text></g><g class="caption"><text class="caption node" text-anchor="middle" alignment-baseline="central" x="1727.1820068359375" y="1286.0841674804688" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Sysmon</text><text class="caption node" text-anchor="middle" alignment-baseline="central" x="1727.1820068359375" y="1336.0841674804688" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Event ID</text><text class="caption node" text-anchor="middle" alignment-baseline="central" x="1727.1820068359375" y="1386.0841674804688" fill="rgb(51, 51, 51)" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">2</text></g></g><g class="layer properties"><g class="speech-bubble node-speech-bubble" transform="translate(-553.938007355584,-212.55958557128906) "><path class="speech-bubble-outline" transform="scale(-1,1) " d="M 0 0 L 20 -10 L 20 -50 A 10 10 0 0 1 30 -60 L 449.62890625 -60 A 10 10 0 0 1 459.62890625 -50 L 459.62890625 50 A 10 10 0 0 1 449.62890625 60 L 30 60 A 10 10 0 0 1 20 50 L 20 10 Z" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" stroke-width="3px"/><text class="speech-bubble-content property-key" x="-296.11328125" y="-25" alignment-baseline="central" text-anchor="end" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif" xml:space="preserve">API(1): </text><text class="speech-bubble-content property-key" x="-296.11328125" y="25" alignment-baseline="central" text-anchor="end" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif" xml:space="preserve">API(2): </text><text class="speech-bubble-content property-value" x="-296.11328125" y="-25" alignment-baseline="central" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">NtCreateFile</text><text class="speech-bubble-content property-value" x="-296.11328125" y="25" alignment-baseline="central" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">SetFileTime</text></g><g class="speech-bubble node-speech-bubble" transform="translate(424.98931550572064,-324.5489010770097) "><path class="speech-bubble-outline" transform="scale(1,-1) " d="M 0 0 L 30 20 L 685.712890625 20 A 10 10 0 0 1 695.712890625 30 L 695.712890625 130 A 10 10 0 0 1 685.712890625 140 L 30 140 A 10 10 0 0 1 20 130 L 20 30 Z" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" stroke-width="3px"/><text class="speech-bubble-content property-key" x="279.8291015625" y="-105" alignment-baseline="central" text-anchor="end" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif" xml:space="preserve">Mechanism: </text><text class="speech-bubble-content property-key" x="279.8291015625" y="-55" alignment-baseline="central" text-anchor="end" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif" xml:space="preserve">Function: </text><text class="speech-bubble-content property-value" x="279.8291015625" y="-105" alignment-baseline="central" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">FltRegisterFilter</text><text class="speech-bubble-content property-value" x="279.8291015625" y="-55" alignment-baseline="central" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">registers a minifilter</text></g><g class="speech-bubble relationship-speech-bubble" transform="translate(1026.8397665076689,731.6982421875) "><path class="speech-bubble-outline" transform="scale(1,1) " d="M 0 0 L -10 20 L -463.4765625 20 A 10 10 0 0 0 -473.4765625 30 L -473.4765625 80 A 10 10 0 0 0 -463.4765625 90 L 463.4765625 90 A 10 10 0 0 0 473.4765625 80 L 473.4765625 30 A 10 10 0 0 0 463.4765625 20 L 10 20 Z" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" stroke-width="3px"/><text class="speech-bubble-content property-key" x="-200.0732421875" y="55" alignment-baseline="central" text-anchor="end" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif" xml:space="preserve">Description: </text><text class="speech-bubble-content property-value" x="-200.0732421875" y="55" alignment-baseline="central" font-size="50px" font-family=""Gill Sans", "Gill Sans MT", Calibri, sans-serif">Pulls the queued event data back</text></g></g><g class="layer overlay"><circle class="node overlay" r="78.89078140343551" stroke="none" fill="rgba(255, 255, 255, 0)" cx="-479.04722595214844" cy="-212.55958557128906"/><circle class="node ring" r="83.89078140343551" fill="none" stroke="rgba(255, 255, 255, 0)" stroke-width="10px" cx="-479.04722595214844" cy="-212.55958557128906"/><circle class="node overlay" r="162.37680882906966" stroke="none" fill="rgba(255, 255, 255, 0)" cx="313" cy="-212.55958557128906"/><circle class="node ring" r="167.37680882906966" fill="none" stroke="rgba(255, 255, 255, 0)" stroke-width="10px" cx="313" cy="-212.55958557128906"/><path class="relationship overlay" fill="rgba(255, 255, 255, 0)" stroke="rgba(255, 255, 255, 0)" stroke-width="10px" transform="translate(-479.04722595214844,-212.55958557128906) rotate(0)" d="M 89.89078140343551 4 L 586.6704171230788 4 L 586.6704171230788 16 L 618.6704171230788 0 L 586.6704171230788 -16 L 586.6704171230788 -4 L 89.89078140343551 -4 Z"/><circle class="node overlay" r="130.30320022424445" stroke="none" fill="rgba(255, 255, 255, 0)" cx="313" cy="250.5"/><circle class="node ring" r="135.30320022424445" fill="none" stroke="rgba(255, 255, 255, 0)" stroke-width="10px" cx="313" cy="250.5"/><path class="relationship overlay" fill="rgba(255, 255, 255, 0)" stroke="rgba(255, 255, 255, 0)" stroke-width="10px" transform="translate(313,250.5) rotate(-90)" d="M 141.30320022424445 4 L 257.6827767422194 4 L 257.6827767422194 16 L 289.6827767422194 0 L 257.6827767422194 -16 L 257.6827767422194 -4 L 141.30320022424445 -4 Z"/><circle class="node overlay" r="206.40897493085106" stroke="none" fill="rgba(255, 255, 255, 0)" cx="313" cy="731.6982421875"/><circle class="node ring" r="211.40897493085106" fill="none" stroke="rgba(255, 255, 255, 0)" stroke-width="10px" cx="313" cy="731.6982421875"/><path class="relationship overlay" fill="rgba(255, 255, 255, 0)" stroke="rgba(255, 255, 255, 0)" stroke-width="10px" transform="translate(313,731.6982421875) rotate(-90)" d="M 217.40897493085106 4 L 307.89504196325555 4 L 307.89504196325555 16 L 339.89504196325555 0 L 307.89504196325555 -16 L 307.89504196325555 -4 L 217.40897493085106 -4 Z"/><circle class="node overlay" r="160.91144875145068" stroke="none" fill="rgba(255, 255, 255, 0)" cx="1727.1820068359375" cy="731.6982421875"/><circle class="node ring" r="165.91144875145068" fill="none" stroke="rgba(255, 255, 255, 0)" stroke-width="10px" cx="1727.1820068359375" cy="731.6982421875"/><path class="relationship overlay" fill="rgba(255, 255, 255, 0)" stroke="rgba(255, 255, 255, 0)" stroke-width="10px" transform="translate(313,731.6982421875) rotate(0)" d="M 217.40897493085106 4 L 1210.2705580844868 4 L 1210.2705580844868 16 L 1242.2705580844868 0 L 1210.2705580844868 -16 L 1210.2705580844868 -4 L 217.40897493085106 -4 Z"/><circle class="node overlay" r="160.91144875145068" stroke="none" fill="rgba(255, 255, 255, 0)" cx="1727.1820068359375" cy="1336.0841674804688"/><circle class="node ring" r="165.91144875145068" fill="none" stroke="rgba(255, 255, 255, 0)" stroke-width="10px" cx="1727.1820068359375" cy="1336.0841674804688"/><path class="relationship overlay" fill="rgba(255, 255, 255, 0)" stroke="rgba(255, 255, 255, 0)" stroke-width="10px" transform="translate(1727.1820068359375,731.6982421875) rotate(90)" d="M 171.91144875145068 4 L 400.4744765415181 4 L 400.4744765415181 16 L 432.4744765415181 0 L 400.4744765415181 -16 L 400.4744765415181 -4 L 171.91144875145068 -4 Z"/></g></svg> |
