diff --git a/Parsers/ASimProcessEvent/IngestTimeParsers/ASimProcessEventCrowdStrikeFalconEndpointProtection.yaml b/Parsers/ASimProcessEvent/IngestTimeParsers/ASimProcessEventCrowdStrikeFalconEndpointProtection.yaml new file mode 100644 index 00000000000..9027f413009 --- /dev/null +++ b/Parsers/ASimProcessEvent/IngestTimeParsers/ASimProcessEventCrowdStrikeFalconEndpointProtection.yaml @@ -0,0 +1,174 @@ +Parser: + DisplayName: "Ingestion-time Process Event ASIM parser for CrowdStrike Falcon Endpoint Protection" + Version: "0.1.0" + LastUpdated: "2026-10-27" +Product: + Name: "CrowdStrike Falcon Endpoint Protection" +Normalization: + Schema: "ProcessEvent" + Version: "1.0.0" +Author: "Microsoft" +Description: | + Normalizes the accepted CrowdStrike_Process_Events_CL process observations, creation, termination, and termination requests to ASimProcessEventLogs during ingestion. +ParserName: "ASimProcessEventCrowdStrikeFalconEndpointProtection" +DCRType: "Standard" +InputStream: "Custom-CrowdStrike_Process_Events_CL" +SourceRawTable: "CrowdStrike_Process_Events_CL" +TargetASIMTable: "ASimProcessEventLogs" +ParserFilterQuery: | + source + | where event_simpleName in ('WmiCreateProcess', 'UnsignedModuleLoad', 'TerminateProcess', 'SyntheticProcessRollup2', 'ProcessSelfDeleted', 'ProcessRollup2', 'ProcessInjection', 'ProcessBlocked', 'ModuleLoadV3DetectInfo', 'FileWrittenAndExecutedInContainer', 'ExecutableDeleted', 'EndOfProcess') +ParserQuery: | + source + | extend Type = "CrowdStrike_Process_Events_CL" + | where event_simpleName in ('WmiCreateProcess', 'UnsignedModuleLoad', 'TerminateProcess', 'SyntheticProcessRollup2', 'ProcessSelfDeleted', 'ProcessRollup2', 'ProcessInjection', 'ProcessBlocked', 'ModuleLoadV3DetectInfo', 'FileWrittenAndExecutedInContainer', 'ExecutableDeleted', 'EndOfProcess') + | extend + _SourceFields = pack( + "SourceAdditionalFields", AdditionalFields, + "ContextTimeStamp", ContextTimeStamp, "ConfigBuild", ConfigBuild, "ConfigStateHash", ConfigStateHash, + "ContextProcessId", ContextProcessId, "ContextThreadId", ContextThreadId, "BoundingLimitCount", BoundingLimitCount, + "BoundingLimitDuration", BoundingLimitDuration, "Entitlements", Entitlements, "EffectiveTransmissionClass", EffectiveTransmissionClass, + "OciContainerId", OciContainerId, "TreeId", TreeId, + "InjecteeImageFileName", InjecteeImageFileName, "InjectorImageFileName", InjectorImageFileName, + "ParentProcessId", ParentProcessId, "TargetProcessId", TargetProcessId, "ConHostProcessId", ConHostProcessId, + "WritingProcessId", WritingProcessId, "SourceProcessId", SourceProcessId, "TargetFileName", TargetFileName, + "WritingProcessImageFileName", WritingProcessImageFileName, "WritingProcessCommandLine", WritingProcessCommandLine, + "ProcessEndTime", ProcessEndTime, "ModuleName", ModuleName, "TokenType", TokenType, + "RpcClientProcessId", RpcClientProcessId, "TemplateInstanceId", TemplateInstanceId, + "PatternId", PatternId, "Tags", Tags, + "ProcessGroupId", ProcessGroupId, "SyntheticPR2Flags", SyntheticPR2Flags, + "ImageSubsystem", ImageSubsystem, "SourceThreadId", SourceThreadId, "AuthenticodeHashData", AuthenticodeHashData, + "SessionId", SessionId, "ParentAuthenticationId", ParentAuthenticationId, "SignInfoFlags", SignInfoFlags, + "CallStackModuleNamesVersion", CallStackModuleNamesVersion, "CsaProcessDataCollectionInstanceId", CsaProcessDataCollectionInstanceId, "CallStackModuleNames", CallStackModuleNames, + "CreateProcessType", CreateProcessType, "ZoneIdentifier", ZoneIdentifier, "HostUrl", HostUrl, + "TargetThreadId", TargetThreadId, "SignatureErrorState", SignatureErrorState, "ModuleCharacteristics", ModuleCharacteristics, + "PublicKeys", PublicKeys, "ExtendedKeyUsages", ExtendedKeyUsages, "SignatureState", SignatureState, + "MappedFromUserMode", MappedFromUserMode, "FileSigningTime", FileSigningTime, "Certificate", Certificate, + "FileIdentifier", FileIdentifier, "ExecutableBytes", ExecutableBytes, "LoadingProcessOriginalFilename", LoadingProcessOriginalFilename, + "ModuleTagsAsString", ModuleTagsAsString, "ImageDirectoryClassification", ImageDirectoryClassification, "ParentProcessPatternIdList", ParentProcessPatternIdList, + "ModuleLoadMechanism", ModuleLoadMechanism, "PatternIdList", PatternIdList, "ScreenshotsTakenCount", ScreenshotsTakenCount, + "NetworkListenCount", NetworkListenCount, "SuspiciousRawDiskReadCount", SuspiciousRawDiskReadCount, + "NetworkBindCount", NetworkBindCount, "NetworkRecvAcceptCount", NetworkRecvAcceptCount, "ContextData", ContextData, + "NewExecutableWrittenCount", NewExecutableWrittenCount, "ExeAndServiceCount", ExeAndServiceCount, "NetworkCloseCount", NetworkCloseCount, + "SuspectStackCount", SuspectStackCount, "CLICreationCount", CLICreationCount, "UnsignedModuleLoadCount", UnsignedModuleLoadCount, + "UserTime", UserTime, "AllocateVirtualMemoryCount", AllocateVirtualMemoryCount, "ServiceEventCount", ServiceEventCount, + "SnapshotFileOpenCount", SnapshotFileOpenCount, "RemovableDiskFileWrittenCount", RemovableDiskFileWrittenCount, "InjectedDllCount", InjectedDllCount, + "ModuleLoadCount", ModuleLoadCount, "UserMemoryProtectExecutableCount", UserMemoryProtectExecutableCount, "NetworkCapableAsepWriteCount", NetworkCapableAsepWriteCount, + "DnsRequestCount", DnsRequestCount, "ArchiveFileWrittenCount", ArchiveFileWrittenCount, "SetThreadContextCount", SetThreadContextCount, + "SuspiciousCredentialModuleLoadCount", SuspiciousCredentialModuleLoadCount, "FileDeletedCount", FileDeletedCount, "UserMemoryAllocateExecutableCount", UserMemoryAllocateExecutableCount, + "DirectoryCreatedCount", DirectoryCreatedCount, "NetworkConnectCountUdp", NetworkConnectCountUdp, "QueueApcCount", QueueApcCount, + "SuspiciousFontLoadCount", SuspiciousFontLoadCount, "ConHostId", ConHostId, "NetworkConnectCount", NetworkConnectCount, + "BinaryExecutableWrittenCount", BinaryExecutableWrittenCount, "CycleTime", CycleTime, "PrivilegedProcessHandleCount", PrivilegedProcessHandleCount, + "MaxThreadCount", MaxThreadCount, "GenericFileWrittenCount", GenericFileWrittenCount, "ScriptEngineInvocationCount", ScriptEngineInvocationCount, + "RunDllInvocationCount", RunDllInvocationCount, "CreateProcessCount", CreateProcessCount, "KernelTime", KernelTime, + "DirectoryEnumeratedCount", DirectoryEnumeratedCount, "AsepWrittenCount", AsepWrittenCount, "SuspiciousDnsRequestCount", SuspiciousDnsRequestCount, + "DocumentFileWrittenCount", DocumentFileWrittenCount, "ProtectVirtualMemoryCount", ProtectVirtualMemoryCount, "UserMemoryProtectExecutableRemoteCount", UserMemoryProtectExecutableRemoteCount, + "UserMemoryAllocateExecutableRemoteCount", UserMemoryAllocateExecutableRemoteCount, "ExecutableDeletedCount", ExecutableDeletedCount, "RegKeySecurityDecreasedCount", RegKeySecurityDecreasedCount, + "InjectedThreadCount", InjectedThreadCount, "NetworkModuleLoadCount", NetworkModuleLoadCount, "ThreadStartAddress", ThreadStartAddress, + "ThreadExecutionControlType", ThreadExecutionControlType, "PayloadClassification", PayloadClassification, "PayloadClassificationFlags", PayloadClassificationFlags, + "MemoryDescriptionFlags", MemoryDescriptionFlags, "WellKnownTargetFunction", WellKnownTargetFunction, "RemoteAddressIP4", RemoteAddressIP4) + | extend + _IsCreate = event_simpleName in ("ProcessRollup2", "SyntheticProcessRollup2"), + _IsTerminationRequest = event_simpleName == "TerminateProcess", + _EventTime = iif(isnotnull((datetime(1970-01-01) + timestamp * 1ms)), (datetime(1970-01-01) + timestamp * 1ms), TimeGenerated), + _Hostname = tostring(columnifexists("ComputerName", "")), + _OsPid = tostring(tolong(RawProcessId)), + _UsernameType = case(isempty(UserName), "", UserName contains "\\", "Windows", + UserName contains "@", "UPN", "Simple") + | project-rename + EventOriginalType = event_simpleName, + EventOriginalSubType = name, + EventOriginalUid = CrowdStrikeId, + DvcId = aid, + DvcScopeId = cid, + DvcIpAddr = aip + | extend + EventType = iff(_IsCreate, "ProcessCreated", "ProcessTerminated"), + EventStartTime = _EventTime, + EventEndTime = _EventTime, + EventCount = toint(1), + EventResult = iff(_IsTerminationRequest, "NA", "Success"), + EventVendor = "CrowdStrike", + EventProduct = "Falcon Endpoint Protection", + EventSchema = "ProcessEvent", + EventSchemaVersion = "1.0.0", + EventSeverity = "Informational", + EventUid = EventOriginalUid, + DvcIdType = iff(isnotempty(DvcId), "Other", ""), + DvcHostname = _Hostname, + DvcOs = case(event_platform == "Win", "Windows", event_platform == "Lin", "Linux", + event_platform == "Mac", "macOS", ""), + TargetProcessId = iff(_IsTerminationRequest, "", _OsPid), + TargetProcessName = iff(_IsTerminationRequest, "", ImageFileName), + TargetProcessCommandLine = iff(_IsTerminationRequest, "", CommandLine), + TargetProcessCreationTime = iff(not(_IsTerminationRequest) and ProcessStartTime > 0, + (datetime(1970-01-01) + ProcessStartTime * 1s), datetime(null)), + TargetProcessFileOriginalName = iff(_IsTerminationRequest, "", OriginalFilename), + TargetProcessIntegrityLevel = iff(_IsTerminationRequest, "", + case(IntegrityLevel == "0", "Untrusted", IntegrityLevel == "4096", "Low", + IntegrityLevel == "8192", "Medium", IntegrityLevel == "8448", "MediumPlus", + IntegrityLevel == "12288", "High", IntegrityLevel == "16384", "System", + IntegrityLevel == "20480", "ProtectedProcess", "")), + TargetProcessMD5 = iff(not(_IsTerminationRequest) and strlen(MD5HashData) == 32 + and MD5HashData != "00000000000000000000000000000000", tolower(MD5HashData), ""), + TargetProcessSHA1 = iff(not(_IsTerminationRequest) and strlen(SHA1HashData) == 40 + and SHA1HashData != "0000000000000000000000000000000000000000", tolower(SHA1HashData), ""), + TargetProcessSHA256 = iff(not(_IsTerminationRequest) and strlen(SHA256HashData) == 64 + and SHA256HashData != "0000000000000000000000000000000000000000000000000000000000000000", tolower(SHA256HashData), ""), + TargetProcessStatusCode = iff(EventOriginalType == "EndOfProcess", ExitCode, ""), + ActingProcessId = iff(_IsTerminationRequest, _OsPid, ""), + ActingProcessName = case(_IsCreate, iif(isnotempty(ParentImageFileName), ParentImageFileName, ParentBaseFileName), + _IsTerminationRequest, ImageFileName, ""), + ActingProcessCommandLine = case(_IsCreate, ParentCommandLine, _IsTerminationRequest, CommandLine, ""), + ActorUsername = iff(_IsTerminationRequest, UserName, ""), + ActorUsernameType = iff(_IsTerminationRequest, _UsernameType, ""), + ActorUserId = iff(_IsTerminationRequest, UserSid, ""), + ActorUserIdType = iff(_IsTerminationRequest and isnotempty(UserSid), "SID", ""), + ActorSessionId = iff(_IsTerminationRequest, AuthenticationId, ""), + TargetUsername = iff(_IsTerminationRequest, "", UserName), + TargetUsernameType = iff(_IsTerminationRequest, "", _UsernameType), + TargetUserId = iff(_IsTerminationRequest, "", UserSid), + TargetUserIdType = iff(not(_IsTerminationRequest) and isnotempty(UserSid), "SID", ""), + TargetUserSessionId = iff(_IsTerminationRequest, "", AuthenticationId), + ParentProcessName = "", + AdditionalFields = _SourceFields, + DvcEntityKey = "", + ActingProcessEntityKey = "", + ActorUserEntityKey = "", + ActorUserAdditionalIds = parse_json('[]'), + ParentProcessEntityKey = "", + TargetProcessEntityKey = "", + TargetUserEntityKey = "", + TargetUserAdditionalIds = parse_json('[]'), + AdditionalEntities = parse_json('[]') + | extend + _TargetParts = split(replace(@"\\", "/", TargetProcessName), "/"), + _ActingParts = split(replace(@"\\", "/", ActingProcessName), "/") + | extend + Dvc = iif(isnotempty(DvcHostname), DvcHostname, iif(isnotempty(DvcIpAddr), DvcIpAddr, DvcId)), + TargetProcessFilename = tostring(_TargetParts[array_length(_TargetParts) - 1]), + ActingProcessFilename = tostring(_ActingParts[array_length(_ActingParts) - 1]), + Hash = iif(isnotempty(TargetProcessSHA256), TargetProcessSHA256, iif(isnotempty(TargetProcessSHA1), TargetProcessSHA1, TargetProcessMD5)), + HashType = case(isnotempty(TargetProcessSHA256), "SHA256", + isnotempty(TargetProcessSHA1), "SHA", isnotempty(TargetProcessMD5), "MD5", ""), + User = TargetUsername, + Process = TargetProcessName, + CommandLine = TargetProcessCommandLine + | project + TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, EventType, EventResult, + EventVendor, EventProduct, EventSchema, EventSchemaVersion, EventSeverity, + EventOriginalType, EventOriginalSubType, EventOriginalUid, EventUid, + Dvc, DvcId, DvcIdType, DvcScopeId, DvcIpAddr, DvcHostname, DvcOs, DvcEntityKey, + ActorUsername, ActorUsernameType, ActorUserId, ActorUserIdType, ActorSessionId, + ActorUserEntityKey, ActorUserAdditionalIds, + ActingProcessId, ActingProcessName, ActingProcessFilename, ActingProcessCommandLine, + ActingProcessEntityKey, ParentProcessName, ParentProcessEntityKey, + TargetProcessId, TargetProcessName, TargetProcessFilename, TargetProcessCommandLine, + TargetProcessCreationTime, TargetProcessFileOriginalName, TargetProcessIntegrityLevel, + TargetProcessMD5, TargetProcessSHA1, TargetProcessSHA256, TargetProcessStatusCode, + TargetProcessEntityKey, TargetUsername, TargetUsernameType, TargetUserId, + TargetUserIdType, TargetUserSessionId, TargetUserEntityKey, TargetUserAdditionalIds, + User, Process, CommandLine, Hash, HashType, AdditionalFields, AdditionalEntities +Change: + Date: "2026-10-27" + Description: "Initial ingestion-time conversion." diff --git a/Sample Data/ASIM/CrowdStrike_Falcon Endpoint Protection_ProcessEvent_CrowdStrike_Process_Events_CL_IngestedLogs.csv b/Sample Data/ASIM/CrowdStrike_Falcon Endpoint Protection_ProcessEvent_CrowdStrike_Process_Events_CL_IngestedLogs.csv new file mode 100644 index 00000000000..5a8dbeb1c42 --- /dev/null +++ b/Sample Data/ASIM/CrowdStrike_Falcon Endpoint Protection_ProcessEvent_CrowdStrike_Process_Events_CL_IngestedLogs.csv @@ -0,0 +1,11 @@ +TimeGenerated,event_simpleName,timestamp,aip,aid,UserName,event_platform,ContextTimeStamp,name,ConfigBuild,CrowdStrikeId,ConfigStateHash,ContextProcessId,ContextThreadId,BoundingLimitCount,BoundingLimitDuration,Entitlements,EffectiveTransmissionClass,cid,OciContainerId,TreeId,UserSid,ParentBaseFileName,SHA256HashData,MD5HashData,SHA1HashData,CommandLine,InjecteeImageFileName,InjectorImageFileName,IntegrityLevel,ParentProcessId,TargetProcessId,ConHostProcessId,WritingProcessId,SourceProcessId,TargetFileName,ImageFileName,WritingProcessImageFileName,WritingProcessCommandLine,OriginalFilename,ProcessStartTime,ProcessEndTime,ModuleName,AuthenticationId,TokenType,RpcClientProcessId,ParentCommandLine,TemplateInstanceId,ParentImageFileName,PatternId,Tags,ProcessGroupId,RawProcessId,SyntheticPR2Flags,ImageSubsystem,SourceThreadId,AuthenticodeHashData,SessionId,ParentAuthenticationId,SignInfoFlags,CallStackModuleNamesVersion,CsaProcessDataCollectionInstanceId,CallStackModuleNames,CreateProcessType,ZoneIdentifier,HostUrl,TargetThreadId,SignatureErrorState,ModuleCharacteristics,PublicKeys,ExtendedKeyUsages,SignatureState,MappedFromUserMode,FileSigningTime,Certificate,FileIdentifier,ExecutableBytes,LoadingProcessOriginalFilename,ModuleTagsAsString,ImageDirectoryClassification,ParentProcessPatternIdList,ModuleLoadMechanism,PatternIdList,ScreenshotsTakenCount,ExitCode,NetworkListenCount,SuspiciousRawDiskReadCount,NetworkBindCount,NetworkRecvAcceptCount,ContextData,NewExecutableWrittenCount,ExeAndServiceCount,NetworkCloseCount,SuspectStackCount,CLICreationCount,UnsignedModuleLoadCount,UserTime,AllocateVirtualMemoryCount,ServiceEventCount,SnapshotFileOpenCount,RemovableDiskFileWrittenCount,InjectedDllCount,ModuleLoadCount,UserMemoryProtectExecutableCount,NetworkCapableAsepWriteCount,DnsRequestCount,ArchiveFileWrittenCount,SetThreadContextCount,SuspiciousCredentialModuleLoadCount,FileDeletedCount,UserMemoryAllocateExecutableCount,DirectoryCreatedCount,NetworkConnectCountUdp,QueueApcCount,SuspiciousFontLoadCount,ConHostId,NetworkConnectCount,BinaryExecutableWrittenCount,CycleTime,PrivilegedProcessHandleCount,MaxThreadCount,GenericFileWrittenCount,ScriptEngineInvocationCount,RunDllInvocationCount,CreateProcessCount,KernelTime,DirectoryEnumeratedCount,AsepWrittenCount,SuspiciousDnsRequestCount,DocumentFileWrittenCount,ProtectVirtualMemoryCount,UserMemoryProtectExecutableRemoteCount,UserMemoryAllocateExecutableRemoteCount,ExecutableDeletedCount,RegKeySecurityDecreasedCount,InjectedThreadCount,NetworkModuleLoadCount,ThreadStartAddress,ThreadExecutionControlType,PayloadClassification,PayloadClassificationFlags,MemoryDescriptionFlags,WellKnownTargetFunction,RemoteAddressIP4,AdditionalFields,TenantId,Type,_ResourceId +2026-10-21T12:01:00Z,ProcessRollup2,1792584060000,192.0.2.1,00000000000000000000000000000001,SYNTHETIC\sanitized,Win,1792584060.0,ProcessRollup2V19,synthetic-configuration,00000000-0000-4000-8000-000000000001,0,2000000000001,,0,,,,00000000000000000000000000000001,,,S-1-5-21-1000000000-2000000000-3000000000-1001,launcher.exe,1111111111111111111111111111111111111111111111111111111111111111,cccccccccccccccccccccccccccccccc,bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb,"""C:\Synthetic\process1.exe"" --synthetic --endpoint 198.51.100.1",C:\Synthetic\injectee.exe,C:\Synthetic\injector.exe,0,3000000000001,1000000000001,,,2000000000001,C:\Synthetic\sample.bin,C:\Synthetic\process1.exe,,,process1.exe,1792584030.0,0,C:\Synthetic\module.dll,10001,1,,"""C:\Synthetic\launcher.exe"" --synthetic",,C:\Synthetic\launcher.exe,,,,1001,,,,,1,9001,,8,,synthetic-module-a|synthetic-module-b,,,,,,,,,,,1792580460.0,,,,,,,,,,0,,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,,,,,,,"{""Synthetic"":true}",00000000-0000-0000-0000-000000000000,CrowdStrike_Process_Events_CL, +2026-10-21T12:02:00Z,ProcessRollup2,1792584120000,192.0.2.2,00000000000000000000000000000002,sanitized,Lin,1792584120.0,ProcessRollup2LinV14,synthetic-configuration,00000000-0000-4000-8000-000000000002,0,2000000000002,,0,,,,00000000000000000000000000000001,,,,launcher,2222222222222222222222222222222222222222222222222222222222222222,cccccccccccccccccccccccccccccccc,bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb,"""/opt/synthetic/process2"" --synthetic --endpoint 198.51.100.2",C:\Synthetic\injectee.exe,C:\Synthetic\injector.exe,,3000000000002,1000000000002,,,2000000000002,/opt/synthetic/sample.bin,/opt/synthetic/process2,,,process2,1792584090.0,0,/opt/synthetic/module.so,10002,,,"""/opt/synthetic/launcher"" --synthetic",,/opt/synthetic/launcher,,,,1002,,,,,2,9002,,8,,synthetic-module-a|synthetic-module-b,,,,,,,,,,,1792580520.0,,,,,,,,,,0,,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,,,,,,,"{""Synthetic"":true}",00000000-0000-0000-0000-000000000000,CrowdStrike_Process_Events_CL, +2026-10-21T12:03:00Z,ProcessRollup2,1792584180000,192.0.2.3,00000000000000000000000000000003,sanitized,Mac,1792584180.0,ProcessRollup2MacV12,synthetic-configuration,00000000-0000-4000-8000-000000000003,0,2000000000003,,0,,,,00000000000000000000000000000001,,,,launcher,3333333333333333333333333333333333333333333333333333333333333333,cccccccccccccccccccccccccccccccc,bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb,"""/opt/synthetic/process3"" --synthetic --endpoint 198.51.100.3",C:\Synthetic\injectee.exe,C:\Synthetic\injector.exe,,3000000000003,1000000000003,,,2000000000003,/opt/synthetic/sample.bin,/opt/synthetic/process3,,,process3,1792584150.0,0,/opt/synthetic/module.so,10003,,,"""/opt/synthetic/launcher"" --synthetic",,/opt/synthetic/launcher,,,,1003,,,,,3,9003,,8,,synthetic-module-a|synthetic-module-b,,,,,,,,,,,1792580580.0,,,,,,,,,,0,,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,,,,,,,"{""Synthetic"":true}",00000000-0000-0000-0000-000000000000,CrowdStrike_Process_Events_CL, +2026-10-21T12:04:00Z,SyntheticProcessRollup2,1792584240000,192.0.2.4,00000000000000000000000000000004,SYNTHETIC\sanitized,Win,1792584240.0,SyntheticProcessRollup2V15,synthetic-configuration,00000000-0000-4000-8000-000000000004,0,2000000000004,,0,,,,00000000000000000000000000000001,,,S-1-5-21-1000000000-2000000000-3000000000-1001,launcher.exe,4444444444444444444444444444444444444444444444444444444444444444,cccccccccccccccccccccccccccccccc,0000000000000000000000000000000000000000,"""C:\Synthetic\process4.exe"" --synthetic --endpoint 198.51.100.4",C:\Synthetic\injectee.exe,C:\Synthetic\injector.exe,8448,3000000000004,1000000000004,,,2000000000004,C:\Synthetic\sample.bin,C:\Synthetic\process4.exe,,,process4.exe,1792584210.0,0,C:\Synthetic\module.dll,10004,1,,"""C:\Synthetic\launcher.exe"" --synthetic",,C:\Synthetic\launcher.exe,,,,1004,,,,,4,9004,,8,,synthetic-module-a|synthetic-module-b,,,,,,,,,,,1792580640.0,,,,,,,,,,0,,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,,,,,,,"{""Synthetic"":true}",00000000-0000-0000-0000-000000000000,CrowdStrike_Process_Events_CL, +2026-10-21T12:05:00Z,SyntheticProcessRollup2,1792584300000,192.0.2.5,00000000000000000000000000000005,sanitized,Lin,1792584300.0,SyntheticProcessRollup2LinV6,synthetic-configuration,00000000-0000-4000-8000-000000000005,0,2000000000005,,0,,,,00000000000000000000000000000001,,,,launcher,5555555555555555555555555555555555555555555555555555555555555555,00000000000000000000000000000000,bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb,"""/opt/synthetic/process5"" --synthetic --endpoint 198.51.100.5",C:\Synthetic\injectee.exe,C:\Synthetic\injector.exe,,3000000000005,1000000000005,,,2000000000005,/opt/synthetic/sample.bin,/opt/synthetic/process5,,,process5,1792584270.0,0,/opt/synthetic/module.so,10005,,,"""/opt/synthetic/launcher"" --synthetic",,/opt/synthetic/launcher,,,,1005,,,,,5,9005,,8,,synthetic-module-a|synthetic-module-b,,,,,,,,,,,1792580700.0,,,,,,,,,,0,,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,,,,,,,"{""Synthetic"":true}",00000000-0000-0000-0000-000000000000,CrowdStrike_Process_Events_CL, +2026-10-21T12:06:00Z,SyntheticProcessRollup2,1792584360000,192.0.2.6,00000000000000000000000000000006,sanitized@sanitized.com,Mac,1792584360.0,SyntheticProcessRollup2MacV6,synthetic-configuration,00000000-0000-4000-8000-000000000006,0,2000000000006,,0,,,,00000000000000000000000000000001,,,,launcher,6666666666666666666666666666666666666666666666666666666666666666,cccccccccccccccccccccccccccccccc,bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb,"""/opt/synthetic/process6"" --synthetic --endpoint 198.51.100.6",C:\Synthetic\injectee.exe,C:\Synthetic\injector.exe,,3000000000006,1000000000006,,,2000000000006,/opt/synthetic/sample.bin,/opt/synthetic/process6,,,process6,1792584330.0,0,/opt/synthetic/module.so,10006,,,"""/opt/synthetic/launcher"" --synthetic",,/opt/synthetic/launcher,,,,1006,,,,,6,9006,,8,,synthetic-module-a|synthetic-module-b,,,,,,,,,,,1792580760.0,,,,,,,,,,0,,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,,,,,,,"{""Synthetic"":true}",00000000-0000-0000-0000-000000000000,CrowdStrike_Process_Events_CL, +2026-10-21T12:07:00Z,EndOfProcess,1792584420000,192.0.2.7,00000000000000000000000000000007,SYNTHETIC\sanitized,Win,1792584420.0,EndOfProcessV15,synthetic-configuration,00000000-0000-4000-8000-000000000007,0,2000000000007,,0,,,,00000000000000000000000000000001,,,S-1-5-21-1000000000-2000000000-3000000000-1001,launcher.exe,7777777777777777777777777777777777777777777777777777777777777777,cccccccccccccccccccccccccccccccc,bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb,"""C:\Synthetic\process7.exe"" --synthetic --endpoint 198.51.100.7",C:\Synthetic\injectee.exe,C:\Synthetic\injector.exe,20480,3000000000007,1000000000007,,,2000000000007,C:\Synthetic\sample.bin,C:\Synthetic\process7.exe,,,process7.exe,1792584390.0,1792584420.0,C:\Synthetic\module.dll,10007,1,,"""C:\Synthetic\launcher.exe"" --synthetic",,C:\Synthetic\launcher.exe,,,,1007,,,,,7,9007,,8,,synthetic-module-a|synthetic-module-b,,,,,,,,,,,1792580820.0,,,,,,,,,,0,0,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,,,,,,,"{""Synthetic"":true}",00000000-0000-0000-0000-000000000000,CrowdStrike_Process_Events_CL, +2026-10-21T12:08:00Z,TerminateProcess,1792584480000,192.0.2.8,00000000000000000000000000000008,sanitized,Lin,1792584480.0,TerminateProcessLinV3,synthetic-configuration,00000000-0000-4000-8000-000000000008,0,2000000000008,,0,,,,00000000000000000000000000000001,,,,launcher,8888888888888888888888888888888888888888888888888888888888888888,cccccccccccccccccccccccccccccccc,bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb,"""/opt/synthetic/process8"" --synthetic --endpoint 198.51.100.8",C:\Synthetic\injectee.exe,C:\Synthetic\injector.exe,,3000000000008,1000000000008,,,2000000000008,/opt/synthetic/sample.bin,/opt/synthetic/process8,,,process8,1792584450.0,0,/opt/synthetic/module.so,10008,,,"""/opt/synthetic/launcher"" --synthetic",,/opt/synthetic/launcher,,,,1008,,,,,8,9008,,8,,synthetic-module-a|synthetic-module-b,,,,,,,,,,,1792580880.0,,,,,,,,,,0,,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,,,,,,,"{""Synthetic"":true}",00000000-0000-0000-0000-000000000000,CrowdStrike_Process_Events_CL, +2026-10-21T12:09:00Z,ProcessInjection,1792584540000,192.0.2.9,00000000000000000000000000000009,SYNTHETIC\sanitized,Win,1792584540.0,ProcessInjectionV9,synthetic-configuration,00000000-0000-4000-8000-000000000009,0,2000000000009,,0,,,,00000000000000000000000000000001,,,S-1-5-21-1000000000-2000000000-3000000000-1001,launcher.exe,9999999999999999999999999999999999999999999999999999999999999999,cccccccccccccccccccccccccccccccc,bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb,"""C:\Synthetic\process9.exe"" --synthetic --endpoint 198.51.100.9",C:\Synthetic\injectee.exe,C:\Synthetic\injector.exe,4096,3000000000009,1000000000009,,,2000000000009,C:\Synthetic\sample.bin,C:\Synthetic\process9.exe,,,process9.exe,1792584510.0,0,C:\Synthetic\module.dll,10009,1,,"""C:\Synthetic\launcher.exe"" --synthetic",,C:\Synthetic\launcher.exe,,,,1009,,,,,9,9009,,8,,synthetic-module-a|synthetic-module-b,,,,,,,,,,,1792580940.0,,,,,,,,,,0,,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,,,,,,,"{""Synthetic"":true}",00000000-0000-0000-0000-000000000000,CrowdStrike_Process_Events_CL, +2026-10-21T12:10:00Z,UnsupportedEventName,1792584600000,192.0.2.10,0000000000000000000000000000000a,SYNTHETIC\sanitized,Win,1792584600.0,ProcessRollup2V19,synthetic-configuration,00000000-0000-4000-8000-000000000010,0,2000000000010,,0,,,,00000000000000000000000000000001,,,S-1-5-21-1000000000-2000000000-3000000000-1001,launcher.exe,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,cccccccccccccccccccccccccccccccc,bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb,"""C:\Synthetic\process10.exe"" --synthetic --endpoint 198.51.100.10",C:\Synthetic\injectee.exe,C:\Synthetic\injector.exe,8192,3000000000010,1000000000010,,,2000000000010,C:\Synthetic\sample.bin,C:\Synthetic\process10.exe,,,process10.exe,1792584570.0,0,C:\Synthetic\module.dll,10010,1,,"""C:\Synthetic\launcher.exe"" --synthetic",,C:\Synthetic\launcher.exe,,,,1010,,,,,10,9010,,8,,synthetic-module-a|synthetic-module-b,,,,,,,,,,,1792581000.0,,,,,,,,,,0,,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,,,,,,,"{""Synthetic"":true}",00000000-0000-0000-0000-000000000000,CrowdStrike_Process_Events_CL,