EventID 1 Process Create EventID 4 Sysmon service state changed EventID 10 Process Access

UtcTime Time in UTC when event was created UtcTime Time in UTC when event was created UtcTime Time in UTC when event was created

ProcessGuid Process Guid of the process that got spawned/created (child) State Sysmon service state SourceProcessGUID Process Guid of the source process that opened another process. It is derived from a truncated
part of the machine GUID, the process start-time and the process token ID.
ProcessId Process ID used by the OS to identify the created process (child) Version Sysmon binary version
SourceProcessId Process ID used by the OS to identify the source process that opened another process. Derived
Image File path of the process being spawned/created. Considered also the child or source process SchemaVersion Sysmon config schema version partially from the EPROCESS kernel structure
FileVersion Version of the image associated with the main process (child) SourceThreadId ID of the specific thread inside of the source process that opened another process
Description Description of the image associated with the main process (child) EventID 5 Process terminated
SourceImage File path of the source process that created a thread in another process
Product Product name the image associated with the main process (child) belongs to UtcTime Time in UTC when event was created
TargetProcessGUID Process Guid of the target process
OriginalFileName OriginalFileName from the PE header, added on compilation ProcessGuid Process Guid of the process that terminated
TargetProcessId Process ID used by the OS to identify the target process
Company Company name the image associated with the main process (child) belongs to ProcessId Process ID used by the OS to identify the process that terminated
TargetImage File path of the executable of the target process
CommandLine Arguments which were passed to the executable associated with the main process Image File path of the executable of the process that terminated
GrantedAccess The access flags (bitmask) associated with the process rights requested for the target process
CurrentDirectory The path without the name of the image associated with the process CallTrace Stack trace of where open process is called. Included is the DLL and the relative virtual address of
User Name of the account who created the process (child) . It usually contains domain name and user EventID 6 Kernel driver loaded the functions in the call stack right before the open process call
name UtcTime Time in UTC when event was created
LogonGuid Logon GUID of the user who created the new process. Value that can help you correlate this event ImageLoaded File path of the driver loaded EventID 11 File create
with others that contain the same Logon GUID
Hashes Hashes captured by Sysmon driver UtcTime Time in UTC when event was created
LogonId Login ID of the user who created the new process. Value that can help you correlate this event with
others that contain the same Logon ID Signed Is the driver loaded signed ProcessGuid Process Guid of the process that created the file

TerminalSessionId ID of the session the user belongs to Signature Signer name of the driver ProcessId Process ID used by the OS to identify the process that created the file (child)

IntegrityLevel Integrity label assigned to a process SignatureStatus Status of the signature Image File path of the process that created the file

Hashes Full hash of the file with the algorithms in the HashType field TargetFilename Name of the file that was created
EventID 7 Image loaded CreationUtcTime File creation time
ParentProcessGuid ProcessGUID of the process that spawned/created the main process (child)
UtcTime Time in UTC when event was created
ParentProcessId Process ID of the process that spawned/created the main process (child)
ProcessGuid Process Guid of the process that loaded the image EventID 12 Registry event (Object create and delete)
ParentImage File path that spawned/created the main process
ProcessId Process ID used by the OS to identify the process that loaded the image UtcTime Time in UTC when event was created
ParentCommandLine Arguments which were passed to the executable associated with the parent process
Image File path of the process that loaded the image EventType CreateKey or DeleteKey
EventID 2 File creation time changed
ImageLoaded Path of the image loaded ProcessGuid Process Guid of the process that created or deleted a registry key
UtcTime Time in UTC when event was created
FileVersion Version of the image loaded ProcessId Process ID used by the OS to identify the process that created or deleted a registry key
ProcessGuid Process Guid of the process that changed the file creation time
Description Description of the image loaded Image File path of the process that created or deleted a registry key
ProcessId Process ID used by the OS to identify the process changing the file creation time
Product Product name the image loaded belongs to TargetObject Complete path of the registry key
Image File path of the process that changed the file creation time
Company Company name the image loaded belongs to
TargetFilename Full path name of the file EventID 13 Registry event (Value set)
OriginalFileName OriginalFileName from the PE header, added on compilation
CreationUtcTime New creation time of the file UtcTime Time in UTC when event was created
Hashes Full hash of the file with the algorithms in the HashType field
PreviousCreationUtcTime Previous creation time of the file
Signed State whether the image loaded is signed EventType SetValue
EventID 3 Network connection Signature The signer name ProcessGuid Process Guid of the process that modified a registry value
UtcTime Time in UTC when event was created SignatureStatus status of the signature ProcessId Process ID used by the OS to identify the process that that modified a registry value
ProcessGuid Process Guid of the process that made the network connection Image File path of the process that that modified a registry value
ProcessId Process ID used by the OS to identify the process that made the network connection EventID 8 Remote thread TargetObject Complete path of the modified registry key
Image File path of the process that made the network connection UtcTime Time in UTC when event was created Details Details added to the registry key
User Name of the account who made the network connection SourceProcessGuid Process Guid of the source process that created a thread in another process
EventID 14 Registry event (Key and value rename)
Protocol Protocol being used for the network connection SourceProcessId Process ID used by the OS to identify the source process that created a thread in another process
UtcTime Time in UTC when event was created
Initiated Indicated process initiated TCP connection SourceImage File path of the source process that created a thread in another process
SourceIsIpv6 Is the source IP an Ipv6 TargetProcessGuid Process Guid of the target process EventType RenameKey

SourceIp source IP address that made the network connection TargetProcessId Process ID used by the OS to identify the target process ProcessGuid Process Guid of the process that renamed a registry value and key

SourceHostname DNS name of the host that made the network connection TargetImage File path of the target process ProcessId Process ID used by the OS to identify the process that renamed a registry value and key

SourcePort source port number NewThreadId Id of the new thread created in the target process Image File path of the process that renamed a registry value and key

SourcePortName name of the source port being used StartAddress New thread start address TargetObject Complete path of the renamed registry key

DestinationIsIpv6 is the destination IP an Ipv6 StartModule Start module determined from thread start address mapping to PEB loaded module list NewName New name of the registry key

DestinationIp IP address destination StartFunction Start function is reported if exact match to function in image export tables
EventID 15 File create stream hash
DestinationHostname DNS name of the host that is contacted
EventID 9 Raw access read UtcTime Time in UTC when event was created
DestinationPort destination port number
UtcTime Time in UTC when event was created ProcessGuid Process Guid of the process that created the named file stream
DestinationPortName name of the destination port
ProcessGuid Process Guid of the process that conducted reading operations from the drive ProcessId Process ID used by the OS to identify the process that created the named file stream

ProcessId Process ID used by the OS to identify the process that conducted reading operations from the Image File path of the process that created the named file stream
drive TargetFilename Name of the file
Image File path of the process that conducted reading operations from the drive CreationUtcTime File download time
Device Target device Hash Full hash of the file with the algorithms in the HashType field
EventID 16 Sysmon config state changed EventID 22 DNS
UtcTime Time in UTC when event was created UtcTime Time in UTC when event was created

Configuration File path of the Sysmon config file being updated ProcessGuid Process Guid of the process that made the DNS query
ConfigurationFileHash Hash (SHA1) of the Sysmon config file being updated ProcessId Process ID of the process that made the DNS query
QueryName DNS name that was queries
EventID 17 Pipe event (Pipe created) QueryStatus Query result status code
UtcTime Time in UTC when event was created QueryResults Query results
EventType CreatePipe Image File path of the process that made the DNS query

ProcessGuid Process Guid of the process that created the pipe

EventID 255 Sysmon Error
ProcessId Process ID used by the OS to identify the process that created the pipe
UtcTime Time in UTC when event was created
PipeName Name of the pipe created
Image File path of the process that created the pipe ID Error code
Description Error description

EventID 18 Pipe event (Pipe connected)

Universal for all events
UtcTime Time in UTC when event was created
RuleName Name of the configured rule
EventType ConnectPipe

ProcessGuid Process Guid of the process that connected the pipe

Event relationships
ProcessId Process ID used by the OS to identify the process that connected the pipe
PipeName Name of the pipe connected
Image File path of the process that connected the pipe EventID EventID
ParentProcessGuid SourceProcessGuid
1 8, 10

EventID 19 WMI event (WmiEventFilter activity detected)

UtcTime Time in UTC when event was created

EventType WmiFilterEvent ProcessGuid TargetProcessGuid

Operation wmievent filter operation
User User that created the WMI filter
EventNamespace Event namespace of the WMI class
EventID
Name Event namespace of the WMI class
2, 3, 5, 7, 9, 11, 12,
Query WMI filter query 13, 14, 15, 17, 18, 22

EventID 20 WMI event (WmiEventConsumer activity detected)

UtcTime Time in UTC when event was created EventID EventID
ParentImage SourceImage
EventType WmiConsumerEvent 1 8, 10
Operation wmievent consumer
User user that created the wmi consumer
Name name of the consumer created
Image TargetImage
Type Type of wmi consumer
Destination command of consumer

EventID 21 WMI event (WmiEventConsumerToFilter activity detected) EventID

2, 3, 5, 7, 9, 11, 12,
UtcTime Time in UTC when event was created 13, 14, 15, 17, 18, 22
EventType WmiBindingEvent
Operation wmievent consumer to filter
User user that created the wmi filter Credits
Consumer Consumer created to bind Creator Olaf Hartong (@olafhartong)
Filter Filter created to bind Thanks Mark Russinovich (@markrussinovich), Roberto Rodriguez (@Cyb3rWard0g)
Version 1.1