search

netevert / sentinel-attack

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
MIT License
1.06k stars 207 forks source link

Pipe Create Event is not parsed correctly #16

Closed netevert closed 5 years ago

netevert commented 5 years ago

I have followed your guides, however phase_name is not being captured in Sentinel:

No-Phase_Name

However the parser was installed successfully:

PArser-EventID5-Phase_Name

And I can clearly see the phase_name in the sysmon event on the server:

Sysmon-EventID5

So I'm a little lost. Also, when querying the log, the column names do not seem to correspond with the data they contain, which suggests perhaps an issue with the parser (?):

Parser-Columns Data

Originally posted by @srthomson in https://github.com/BlueTeamLabs/sentinel-attack/issues/15#issuecomment-532157466