Endpoint ✓ fields verified against sample logs

Sysmon Log Fields: Event IDs, EventData Reference and Examples

Published

One record per piece of endpoint activity Sysmon was configured to watch — a process start, a network connection, a handle opened on another process, a DNS query — carrying the image path, command line, user and parent that the built-in Windows logs leave out.

Official documentation: Sysmon (Windows Sysinternals)

Sample record

  <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
      <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}"/>
      <EventID>1</EventID>
      <TimeCreated SystemTime="2024-01-15T09:00:01.000Z"/>
      <Computer>DESKTOP-ALICE</Computer>
    </System>
    <EventData>
      <Data Name="Image">C:\Program Files\Google\Chrome\Application\chrome.exe</Data>
      <Data Name="CommandLine">chrome.exe --no-first-run</Data>
      <Data Name="User">CORP\alice</Data>
      <Data Name="Hashes">MD5=D41D8CD98F00B204E9800998ECF8427E,SHA256=e3b0c44298fc1c149afb4c8996fb92427ae41e4649b934ca495991b7852b855</Data>
      <Data Name="ParentImage">C:\Windows\explorer.exe</Data>
    </EventData>
  </Event>

From the LogTriage parser test corpus — synthetic data, no real hosts or users.

Field reference

Field Type Meaning Why it matters for security
System.Provider.Namee.g. Microsoft-Windows-Sysmon string Provider that wrote the record; Sysmon events carry this name and the GUID shown in the sample. Filter on it before using EventID — event numbers mean something completely different in other channels.
System.EventIDe.g. 1 integer Which Sysmon event type the record is. The samples contain 1 (process creation), 3 (network connection), 8 (CreateRemoteThread), 10 (process access) and 22 (DNS query). Determines which EventData fields exist; 1, 3, 8, 10 and 22 carry most of the value for intrusion analysis.
System.TimeCreated.SystemTimee.g. 2024-01-15T14:32:05.000Z datetime (UTC) When Sysmon recorded the event, with fractional seconds. Sub-second ordering is what lets you tie a process start to the connection and the LSASS access that follow it.
System.Computere.g. DESKTOP-VICTIM string Host that generated the event. The pivot for scoping — once one host is confirmed, every other field is searched within it first.
EventData.Imagee.g. C:\Windows\System32\cmd.exe string (path) Full path of the executable the event is about (the new process for event 1, the connecting process for event 3). Binaries running from C:\Temp, %APPDATA% or other user-writable directories are worth immediate attention.
EventData.CommandLinee.g. cmd.exe /c powershell -enc JABjAGwAaQBlAG4AdA== string Command line the process was started with (event 1). Encoded PowerShell, download cradles and LOLBin arguments live here; decode -enc payloads before judging.
EventData.ParentImagee.g. C:\Windows\explorer.exe string (path) Executable of the process that created this one (event 1). Parent-child pairs such as an Office application spawning a shell are the backbone of execution detection.
EventData.Usere.g. CORP\jsmith string Account the process ran as, in DOMAIN\user form. Shows whether activity ran as a user, a service account or SYSTEM, and which identity to check in sign-in logs.
EventData.Hashese.g. MD5=5D41402ABC4B2A76B9719D911017C592,SHA256=a0f3c4d2e1b5f789012345678901234567890123456789012345678901234567 string One string of algorithm=value pairs for the image, with the algorithms chosen in the Sysmon configuration. Split on the comma before looking values up in threat intelligence or comparing across hosts.
EventData.SourceIpe.g. 10.0.0.50 IPv4/IPv6 Local address of a network connection (event 3). Confirms which interface or host the connection left from when NAT hides it downstream.
EventData.DestinationPorte.g. 4444 integer Remote port of a network connection (event 3). Unusual high ports from a non-browser image are a common first sign of command and control.
EventData.Protocole.g. tcp string Transport protocol of the connection (event 3). UDP egress from a process with no reason to use it can indicate tunnelling.
EventData.SourceImagee.g. C:\Temp\mimikatz.exe string (path) Process that performed the action against another process (events 8 and 10). The accused binary in credential-dumping and injection detections; check its path, hash and parent next.
EventData.TargetImagee.g. C:\Windows\System32\lsass.exe string (path) Process that was accessed or had a thread created in it (events 8 and 10). lsass.exe as the target is the classic credential-theft signal.
EventData.GrantedAccesse.g. 0x1FFFFF hex string Access mask granted when one process opened a handle to another (event 10). 0x1FFFFF is full access (PROCESS_ALL_ACCESS); masks that include PROCESS_VM_READ (0x0010) allow reading the target's memory.
EventData.QueryNamee.g. www.google.com string Name looked up in a DNS query event (event 22). Links a process on the host to a domain, which is how you attribute beaconing traffic seen at the firewall.

What it records

Sysmon is a Sysinternals service and driver that writes detailed endpoint activity to the Windows event log channel Microsoft-Windows-Sysmon/Operational. Each record is one event of a type Sysmon was configured to watch, with a System block (provider, EventID, TimeCreated, Computer) and an EventData block holding a list of <Data Name="..."> values whose names depend on the event type.

The event types in the samples here are the ones most investigations start with: 1 process creation, with Image, CommandLine, User, Hashes and ParentImage; 3 network connection, with SourceIp, DestinationIp, DestinationPort and Protocol; 8 CreateRemoteThread; 10 process access, with SourceImage, TargetImage and GrantedAccess; and 22 DNS query. Sysmon also covers image loads, file creation, registry changes, named pipes and WMI subscriptions when configured to.

What makes it valuable is the context Windows does not log by itself: the parent of every process, hashes of the image, and which process made a given network connection or DNS lookup.

Where to get it

  • Event Viewer / wevtutil on the host. wevtutil qe Microsoft-Windows-Sysmon/Operational /f:xml /e:Events > sysmon.xml produces exactly the shape of the samples on this page — an <Events> root wrapping <Event> elements.
  • PowerShell. Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational, with .ToXml() on each record when you need the raw fields rather than the rendered message.
  • The saved EVTX file under %SystemRoot%\System32\Winevt\Logs\, collected with the rest of a triage image.
  • Forwarded centrally with Windows Event Forwarding to a collector, or by an agent that subscribes to the channel and ships it to your SIEM.

Parsing pitfalls

  • EventData has no named elements. Every value is a <Data> element with a Name attribute. Naive XML-to-JSON conversion produces an anonymous array; you must re-key on Name.
  • The schema changes per event ID. There is no fixed column set. A query that assumes CommandLine exists silently drops every event that is not a process creation.
  • The same concept has different names. Image and User in event 1 become SourceImage and SourceUser in events 8 and 10. Normalise before correlating.
  • Default XML namespace. <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> breaks XPath expressions written without a namespace prefix.
  • Event ID collisions. Sysmon event 1 is not Security event 1. Always filter on the provider or channel first.
  • Hashes is one string. Split MD5=...,SHA256=... on commas and =; which algorithms appear depends on the Sysmon configuration.
  • Escaped characters. Command lines arrive XML-escaped (&amp;, &lt;, &quot;) and contain backslashes and quotes — unescape before pattern matching.
  • UTC in the XML, local time in the GUI. SystemTime is UTC; Event Viewer renders local time, which creates fake timeline gaps when analysts mix the two.

Detection ideas

  • LSASS credential access: event 10 where TargetImage ends in lsass.exe and SourceImage is not an expected security tool — the basis of the Sysmon LSASS credential dumping rule and of T1003.001.
  • Remote thread injection: event 8 into a process the source has no reason to touch (T1055).
  • Encoded interpreters: event 1 with -enc, -EncodedCommand or FromBase64String in CommandLine, especially under a document-handling parent.
  • Suspicious egress: event 3 where Image sits in C:\Temp, %APPDATA% or another user-writable path, or where DestinationPort is an uncommon high port.
  • Process-to-domain attribution: event 22 on the same Computer within seconds of an event 3 — the DNS answer identifies the infrastructure behind the connection.

Paste an exported Sysmon XML into the free browser analyzer to run these checks locally without uploading the file.

Detections and guides for Sysmon

Frequently Asked Questions

Which Sysmon event IDs are worth reading first in an intrusion?
Event 1 (process creation) for the command line and parent, event 3 (network connection) to tie a process to an external address, event 10 (process access) for handles opened on lsass.exe, event 8 (CreateRemoteThread) for injection, and event 22 (DNS query) to attribute domain lookups to a process. The malicious sample on this page contains all five in sequence.
Why are there no network connection or DNS events on this host?
Sysmon only records what its configuration tells it to record, and many deployments exclude or heavily filter high-volume types. Check the active configuration on the host before concluding the activity did not happen — absence of an event type is a collection gap, not evidence.
How do I turn EventData into named fields?
EventData is a list of identical <Data> elements distinguished by their Name attribute, not by element name, so a generic XML-to-JSON conversion gives you an array rather than a field per value. Key each entry on its Name attribute, and remember the set of names differs per EventID.
Is GrantedAccess 0x1FFFFF on lsass.exe always malicious?
No. 0x1FFFFF is PROCESS_ALL_ACCESS, and endpoint protection, backup and system management tools legitimately open handles to other processes. Judge it on the SourceImage — its path, signature, hash and parent process — and on whether that binary has ever done it on other hosts before.

Analyze Sysmon logs

LogTriage auto-detects this format, enriches every IP, user agent and hash with threat intelligence, and writes an incident report mapped to MITRE ATT&CK.

Try Live Demo → Analyze Your Own Logs