0

Extend version of the question

I'm trying to figure out how to detect the launch of unwanted processes based on regular logging in Windows and sysmon. Sysmon event 1 allows you to get a significant amount of information about the running process: OriginalFileName, User, LogonGuid, Hashes, and so on. For example:

Process Create:
RuleName: 
UtcTime: 2021-09-14 08:41:15.359
ProcessGuid: {b56fc2d9-602b-6140-0000-001009272900}
ProcessId: 7804
Image: C:\Windows\System32\MusNotificationUx.exe
FileVersion: 10.0.18362.1533 (WinBuild.160101.0800)
Description: MusNotificationUx.exe
Product: Microsoft® Windows® Operating System
Company: Microsoft Corporation
OriginalFileName: MusNotificationUx.exe
CommandLine: %%systemroot%%\system32\MusNotificationUx.exe ClearActiveNotifications
CurrentDirectory: C:\WINDOWS\system32\
User: test\testUser
LogonGuid: {b56fc2d9-5ffa-6140-0000-0020c4d71800}
LogonId: 0x18D7C4
TerminalSessionId: 2
IntegrityLevel: Medium
Hashes: MD5=64C6885F0A077303D0BDF90B8C19F8DD
ParentProcessGuid: {b56fc2d9-6029-6140-0000-0010b70f2900}
ParentProcessId: 7796
ParentImage: C:\Windows\System32\MusNotification.exe
ParentCommandLine: C:\WINDOWS\system32\MusNotification.exe LogonUpdateResults

But the log does not contain the SID of the user who started the process. Why is this done and is there any way to get the SID in the log without building additional correlations?

Original Question:

Why is there no user SID in the sysmon event with id 1 (process creation)? Are there any configuration options to get it?

2
  • Presumably you also checked for service account SIDs, such as LOCALSYSTEM? Also, it might help if you'd share the whole event details, but it also might fit better, as a question, in Superuser.
    – CBHacking
    Sep 20 '21 at 6:25
  • Sysmon does not collect the SID for the user for event ID 1, and afaik there's no documented way to add it. Only someone at Microsoft would be able to tell you why it's a limitation.
    – Polynomial
    Sep 20 '21 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.