Quickly search and reference Windows Security and Sysmon Event IDs.
This tool processes your input in your browser.
Provides detailed information about newly created processes. It is equivalent to Windows Event 4688 but includes the command line and parent-child process relationships.
Useful Fields:Image, CommandLine, ParentImage, Hashes, User
Malicious Use:Detecting execution of malicious payloads, LOLBins like PowerShell or cmd.exe, and suspicious parent-child chains (e.g. Word spawning cmd.exe).
Generated every time a new process starts. Requires Command Line auditing to be enabled via GPO for full visibility.
Useful Fields:New Process Name, Creator Process ID, Process Command Line
Malicious Use:Tracking attacker execution and lateral movement tools.
Records a process explicitly changing a file creation timestamp. This can be legitimate, but it is valuable for detecting timestomping and timeline manipulation.
Useful Fields:Image, TargetFilename, CreationUtcTime, PreviousCreationUtcTime, User
Malicious Use:Detecting attempts to make a backdoor or tool appear older than it is.
Records the Sysmon service starting or stopping. This event is not filterable and should be correlated with service-control activity.
Useful Fields:UtcTime, State
Malicious Use:Detecting a telemetry gap created by stopping or restarting Sysmon during an intrusion.
Records when a process terminates, including its process identity and timestamp.
Useful Fields:UtcTime, ProcessGuid, ProcessId, Image, User
Malicious Use:Correlating short-lived tools, abnormal termination and process chains during an investigation.
Analyze and organize security indicators, logs, files, and timelines in one local workspace.
Design and execute structured security incident response workflows.
Create portable Sigma detection rules locally for SIEM and EDR workflows.
Inspect email headers locally for SPF, DKIM, DMARC and phishing indicators.