From de88fe585aa675921b56d7524c75adf5abacd0e8 Mon Sep 17 00:00:00 2001 From: codesavvysoftware Date: Thu, 6 Feb 2020 06:40:30 -0500 Subject: [PATCH] Update process-events.md Added a paragraph about the ProcessGUID describing how it is created and accessed. --- process-events.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/process-events.md b/process-events.md index ff62065..202f3fb 100644 --- a/process-events.md +++ b/process-events.md @@ -26,7 +26,11 @@ Event ID 4624, making the login of this event important. The ProcessGUID depending on the event and where in the process tree it is, it will also be known by other names by its relation to the action -monitored +monitored. + +ProcessGUID is generated by Sysmon when Sysmon logs the event. ProcessGUID +specifically is not an attribute of the internal Windows process data structs +(EPROCESS). Sysmon keeps track of the GUID until the process exits. ![ProcessGUID Relation](./media/image32.png)