admin/trustedsec-SysmonCommunityGuide
1
0
Fork 0
mirror of https://github.com/trustedsec/SysmonCommunityGuide/ synced 2026-06-06 19:46:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1 from codesavvysoftware/master

Browse Source 
Update process-events.md
This commit is contained in:
Carlos Perez
2020-02-06 09:56:49 -04:00
committed by GitHub
parent 2249fc1ee9 de88fe585a
commit ce7ea608b9
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
process-events.md
+5 -1
View File
@@ -26,7 +26,11 @@ Event ID 4624, making the login of this event important.
The ProcessGUID depending on the event and where in the process tree it
is, it will also be known by other names by its relation to the action
monitored
monitored.
ProcessGUID is generated by Sysmon when Sysmon logs the event. ProcessGUID
specifically is not an attribute of the internal Windows process data structs
(EPROCESS). Sysmon keeps track of the GUID until the process exits.
![ProcessGUID Relation](./media/image32.png)