name: Windows Event Log Application 3000
id: 3911945d-9222-408d-b851-9b1bce4c2d24
version: 3
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
description: Logs the termination of a process, including details about the process, its termination code, and timestamp.
mitre_components:
    - Process Termination
    - Process Metadata
    - Application Log Content
    - OS API Execution
source: XmlWinEventLog:Application
sourcetype: XmlWinEventLog
separator: EventCode
separator_value: '3000'
supported_TA:
    - name: Splunk Add-on for Microsoft Windows
      url: https://splunkbase.splunk.com/app/742
      version: 10.0.1
fields:
    - _time
    - Channel
    - Computer
    - Error_Code
    - EventCode
    - EventData_Xml
    - EventRecordID
    - EventSourceName
    - Guid
    - Keywords
    - Level
    - Name
    - Opcode
    - ProcessID
    - Qualifiers
    - RecordNumber
    - SystemTime
    - System_Props_Xml
    - Task
    - ThreadID
    - UserID
    - Version
    - dest
    - dvc
    - dvc_nt_host
    - event_id
    - eventtype
    - host
    - id
    - index
    - linecount
    - param1
    - param2
    - param3
    - punct
    - signature_id
    - source
    - sourcetype
    - splunk_server
    - tag
    - tag::eventtype
    - timestamp
    - user_id
    - vendor_product
output_fields:
    - dest
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-ProcessExitMonitor' Guid='{FD771D53-8492-4057-8E35-8C02813AF49B}' EventSourceName='Process Exit Monitor'/><EventID Qualifiers='16384'>3000</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2022-09-08T18:21:27.155712000Z'/><EventRecordID>21334</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>win-host-mhaag-attack-range-117</Computer><Security UserID='S-1-5-21-62830434-419094169-3251522898-500'/></System><EventData Name='EVENT_PROCESSTERMINATION_SELF'><Data Name='param1'>C:\Windows\System32\klist.exe</Data><Data Name='param2'>0</Data><Data Name='param3'>01d8c3afcf370d13</Data></EventData></Event>