mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
135 lines
4.8 KiB
YAML
135 lines
4.8 KiB
YAML
name: CrowdStrike ProcessRollup2
|
|
id: cbb06880-9dd9-4542-ac60-bd6e5d3c3e4e
|
|
version: 3
|
|
creation_date: '2024-05-22'
|
|
modification_date: '2026-05-13'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Logs process-related activities captured by CrowdStrike, including process creation, termination, and metadata such as hashes, parent processes, and command-line arguments.
|
|
mitre_components:
|
|
- Process Creation
|
|
- Process Termination
|
|
- Process Metadata
|
|
- Command Execution
|
|
- OS API Execution
|
|
source: crowdstrike
|
|
sourcetype: crowdstrike:events:sensor
|
|
separator: event_simpleName
|
|
separator_value: ProcessRollup2
|
|
supported_TA:
|
|
- name: Splunk Add-on for CrowdStrike FDR
|
|
url: https://splunkbase.splunk.com/app/5579
|
|
version: 2.0.5
|
|
fields:
|
|
- AuthenticationId
|
|
- AuthenticationId_meaning
|
|
- AuthenticodeHashData
|
|
- CommandLine
|
|
- ConfigBuild
|
|
- ConfigStateHash
|
|
- EffectiveTransmissionClass
|
|
- Entitlements
|
|
- EventOrigin
|
|
- ImageFileName
|
|
- ImageSubsystem
|
|
- ImageSubsystem_meaning
|
|
- IntegrityLevel
|
|
- IntegrityLevel_meaning
|
|
- MD5HashData
|
|
- ParentAuthenticationId
|
|
- ParentBaseFileName
|
|
- ParentProcessId
|
|
- ProcessCreateFlags
|
|
- ProcessEndTime
|
|
- ProcessParameterFlags
|
|
- ProcessParameterFlags_meaning
|
|
- ProcessStartTime
|
|
- ProcessSxsFlags
|
|
- ProcessSxsFlags_meaning
|
|
- RawProcessId
|
|
- SHA1HashData
|
|
- SHA256HashData
|
|
- SessionId
|
|
- SignInfoFlags
|
|
- SignInfoFlags_meaning
|
|
- SourceProcessId
|
|
- SourceThreadId
|
|
- Tags
|
|
- TargetProcessId
|
|
- TokenType
|
|
- TokenType_meaning
|
|
- UserSid
|
|
- WindowFlags
|
|
- WindowFlags_meaning
|
|
- action
|
|
- aid
|
|
- aid_city
|
|
- aid_computer_name
|
|
- aid_continent
|
|
- aid_country
|
|
- aid_machine_domain
|
|
- aid_os_version
|
|
- aid_ou
|
|
- aid_site_name
|
|
- aid_system_product_name
|
|
- aip
|
|
- cid
|
|
- dest
|
|
- event_ingest_time
|
|
- event_platform
|
|
- event_simpleName
|
|
- eventtype
|
|
- host_res_aid
|
|
- id
|
|
- os
|
|
- parent_process_exec
|
|
- parent_process_id
|
|
- parent_process_name
|
|
- process
|
|
- process_exec
|
|
- process_hash
|
|
- process_id
|
|
- process_integrity_level
|
|
- process_name
|
|
- process_path
|
|
- resolve_dest
|
|
- resolve_process_integrity_level
|
|
- tag
|
|
- timestamp
|
|
- user
|
|
- user_id
|
|
- vendor_product
|
|
output_fields:
|
|
- action
|
|
- dest
|
|
- original_file_name
|
|
- parent_process
|
|
- parent_process_exec
|
|
- parent_process_guid
|
|
- parent_process_id
|
|
- parent_process_name
|
|
- parent_process_path
|
|
- process
|
|
- process_exec
|
|
- process_guid
|
|
- process_hash
|
|
- process_id
|
|
- process_integrity_level
|
|
- process_name
|
|
- process_path
|
|
- user
|
|
- user_id
|
|
- vendor_product
|
|
field_mappings:
|
|
- data_model: cim
|
|
data_set: Endpoint.Processes
|
|
mapping:
|
|
CommandLine: Processes.process
|
|
ImageFileName: Processes.process_path
|
|
ImageFileName|endswith: Processes.process_name
|
|
ParentBaseFileName: Processes.parent_process_name
|
|
ParentProcessId: Processes.parent_process_id
|
|
RawProcessId: Processes.process_id
|
|
SHA256HashData: Processes.process_hash
|
|
UserSid: Processes.user
|
|
example_log: '{"LinkName":"C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk","ProcessCreateFlags":"67634196","IntegrityLevel":"12288","ParentProcessId":"5459598860","SourceProcessId":"5459598860","aip":"3.126.231.40","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-21-586445407-708991241-1829972403-500","event_platform":"Win","TokenType":"1","ProcessEndTime":"","AuthenticodeHashData":"3b98faafc17b47beb9027c437fceeafdf0624a1c","ParentBaseFileName":"explorer.exe","EventOrigin":"1","ImageSubsystem":"3","id":"e2210781-0e8f-47d2-bf6a-56d2c59f38ee","EffectiveTransmissionClass":"3","SessionId":"2","ShowWindowFlags":"1","Tags":"27, 40, 151, 874, 924, 12094627905582, 12094627906234, 211106232533012, 212205744161605, 263882790666253","timestamp":"1713805173418","event_simpleName":"ProcessRollup2","RawProcessId":"5012","ConfigStateHash":"840884426","MD5HashData":"097ce5761c89434367598b34fe32893b","SHA256HashData":"ba4038fd20e474c047be8aad5bfacdb1bfc1ddbe12f803f473b7918d8d819436","ProcessSxsFlags":"64","AuthenticationId":"2669499","ConfigBuild":"1007.3.0018207.1","WindowFlags":"3073","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ","ParentAuthenticationId":"2669499","TargetProcessId":"5642133882","ImageFileName":"\\Device\\HarddiskVolume1\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","SourceThreadId":"30426051160","Entitlements":"15","name":"ProcessRollup2V19","ProcessStartTime":"1713805173.321","ProcessParameterFlags":"24577","aid":"168a90e125d443beb2a4e2914985084d","SignInfoFlags":"8683538","cid":"124cb22314bf4f519be84bce582e7a6b"}'
|