Instances of computer programs that are being executed by at least one thread. Processes have memory space for process executables, loaded modules (DLLs or shared libraries), and allocated memory regions containing everything from user input to application-specific data structures[1]
Operating system function/method calls executed by a process
Operating system function/method calls executed by a process
Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
Opening of a process by another process, typically to read memory of the target process (ex: Sysmon EID 10)
Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688)
Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.
| Domain | ID | Name | |
|---|---|---|---|
| Enterprise | T1548 | Abuse Elevation Control Mechanism | |
| .002 | Bypass User Account Control | ||
| .003 | Sudo and Sudo Caching | ||
| Enterprise | T1134 | Access Token Manipulation | |
| .004 | Parent PID Spoofing | ||
| Enterprise | T1562 | .010 | Impair Defenses: Downgrade Attack |
| Enterprise | T1056 | Input Capture | |
| .004 | Credential API Hooking | ||
| Enterprise | T1036 | Masquerading | |
| .003 | Rename System Utilities | ||
| .005 | Match Legitimate Name or Location | ||
Changes made to a process, or its contents, typically to write and/or execute code in the memory of the target process (ex: Sysmon EID 8)
Changes made to a process, or its contents, typically to write and/or execute code in the memory of the target process (ex: Sysmon EID 8)
Exit of a running process (ex: Sysmon EID 5 or Windows EID 4689)
Exit of a running process (ex: Sysmon EID 5 or Windows EID 4689)
| Domain | ID | Name | |
|---|---|---|---|
| Enterprise | T1562 | Impair Defenses | |
| .001 | Disable or Modify Tools | ||
| Enterprise | T1489 | Service Stop | |