search

OTRF / OSSEM

Open Source Security Events Metadata (OSSEM)
MIT License
1.22k stars 212 forks source link

WMI fields mismatch between sysmon events and built in wmi events #97

Closed HarishHary closed 3 years ago

HarishHary commented 3 years ago

Their might be a mismatch between 2 log definition related to WMI events.

For example: Sysmon EventID: 20

https://github.com/OTRF/OSSEM/blob/a47073b4a9fd51198880d87976d589fde9b03e1f/source/data_dictionaries/windows/sysmon/events/event-20.yml

WMI EventID: 5861 https://github.com/OTRF/OSSEM/blob/a47073b4a9fd51198880d87976d589fde9b03e1f/source/data_dictionaries/windows/etw-providers/Microsoft-Windows-WMI-Activity/events/event-5861.yml

wmi_consumer_type vs CONSUMER wmi_consume_name vs ESS

We might need to extract and modify fields from the built-in. But I believe that most of the info are present on the EventID: 5861. Was it done on purpose?