Log sources and field names

logsource

logsource names the kind of event a rule is written for, not a file or an index. It has three optional keys:

• product: the operating system or product, for example windows, linux, aws.
• category: a kind of event independent of the tool that recorded it, for example process_creation, network_connection, registry_set, process_access.
• service: a specific log, for example security or sysmon on Windows.

The tool that converts the rule decides which real log a logsource means. On this site category: process_creation means Sysmon Event ID 1, registry_set means Event ID 13 and process_access means Event ID 10. A SIEM might map process_creation to Windows Security Event ID 4688 instead, which has different field names. That is why the Sigma project keeps a list of field names per category (the taxonomy): rules use those names, and the converter translates them.

Fields of a process start

A Sysmon process creation event has these fields, among others:

• Image: the full path of the program that was started.
• CommandLine: the full command line, including the program and its arguments.
• ParentImage and ParentCommandLine: the program that started it, and its command line.
• OriginalFileName: the file name written into the program file when it was built. It stays the same when the file is renamed, so it still identifies a copied and renamed mshta.exe.
• User, IntegrityLevel, CurrentDirectory, Company, Description, Product.

A field name in a rule is written as the log source names it. Every field condition refers to exactly one field: Image|endswith: '\mshta.exe' says nothing about the parent.

Why the parent matters

A program that runs script code, such as mshta.exe, is interesting mostly for what it starts next. In the exercise data, mshta.exe started three processes: a command shell, a calculator and PowerShell. Searching on the parent finds those, whatever program they are.