Microsoft Windows AMSI Security Modeling Rule

Details

ID	`Microsoft_Windows_AMSI_ModelingRule`
From Version	8.3.0

Schema

`microsoft_amsi_raw`

Field	Type	Array?
`event_data`	string	—
`event_id`	string	—
`log_level`	string	—
`message`	string	—
`opcode`	string	—
`os_subtype`	string	—
`process_cmd`	string	—
`process_md5`	string	—
`process_name`	string	—
`process_path`	string	—
`process_pid`	string	—
`process_sha256`	string	—
`process_thread_id`	string	—
`provider_name`	string	—
`record_id`	string	—
`time_created`	datetime	—

Source

MicrosoftWindowsAMSI.xif MicrosoftWindowsAMSI.yml MicrosoftWindowsAMSI_schema.json

Download History Raw

fromversion: 8.3.0
id: Microsoft_Windows_AMSI_ModelingRule
name: Microsoft Windows AMSI Security Modeling Rule
rules: ''
schema: ''
tags: ''
supportedModules:
- xsiam