sysmon.exe
Associated Error Codes
Below lists error codes and symbolic names found for this module.
| Code | Found in | Description |
|---|---|---|
| 0x30000000 | 11 | Info |
| 0x40060001 | 11 | Process Create: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! FileVersion: %6!s! Description: %7!s! Product: %8!s! Company: %9!s! OriginalFileName: %10!s! CommandLine: %11!s! CurrentDirectory: %12!s! User: %13!s! LogonGuid: %14!s! LogonId: %15!s! TerminalSessionId: %16!s! IntegrityLevel: %17!s! Hashes: %18!s! ParentProcessGuid: %19!s! ParentProcessId: %20!s! ParentImage: %21!s! ParentCommandLine: %22!s! ParentUser: %23!s! |
| 0x40060002 | 11 | File creation time changed: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! TargetFilename: %6!s! CreationUtcTime: %7!s! PreviousCreationUtcTime: %8!s! User: %9!s! |
| 0x40060003 | 11 | Network connection detected: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! User: %6!s! Protocol: %7!s! Initiated: %8!s! SourceIsIpv6: %9!s! SourceIp: %10!s! SourceHostname: %11!s! SourcePort: %12!s! SourcePortName: %13!s! DestinationIsIpv6: %14!s! DestinationIp: %15!s! DestinationHostname: %16!s! DestinationPort: %17!s! DestinationPortName: %18!s! |
| 0x40060004 | 11 | Sysmon service state changed: UtcTime: %1!s! State: %2!s! Version: %3!s! SchemaVersion: %4!s! |
| 0x40060005 | 11 | Process terminated: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! User: %6!s! |
| 0x40060006 | 11 | Driver loaded: RuleName: %1!s! UtcTime: %2!s! ImageLoaded: %3!s! Hashes: %4!s! Signed: %5!s! Signature: %6!s! SignatureStatus: %7!s! |
| 0x40060007 | 11 | Image loaded: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! ImageLoaded: %6!s! FileVersion: %7!s! Description: %8!s! Product: %9!s! Company: %10!s! OriginalFileName: %11!s! Hashes: %12!s! Signed: %13!s! Signature: %14!s! SignatureStatus: %15!s! User: %16!s! |
| 0x40060008 | 11 | CreateRemoteThread detected: RuleName: %1!s! UtcTime: %2!s! SourceProcessGuid: %3!s! SourceProcessId: %4!s! SourceImage: %5!s! TargetProcessGuid: %6!s! TargetProcessId: %7!s! TargetImage: %8!s! NewThreadId: %9!s! StartAddress: %10!s! StartModule: %11!s! StartFunction: %12!s! SourceUser: %13!s! TargetUser: %14!s! |
| 0x40060009 | 11 | RawAccessRead detected: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! Device: %6!s! User: %7!s! |
| 0x4006000a | 11 | Process accessed: RuleName: %1!s! UtcTime: %2!s! SourceProcessGUID: %3!s! SourceProcessId: %4!s! SourceThreadId: %5!s! SourceImage: %6!s! TargetProcessGUID: %7!s! TargetProcessId: %8!s! TargetImage: %9!s! GrantedAccess: %10!s! CallTrace: %11!s! SourceUser: %12!s! TargetUser: %13!s! |
| 0x4006000b | 11 | File created: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! TargetFilename: %6!s! CreationUtcTime: %7!s! User: %8!s! |
| 0x4006000c | 11 | Registry object added or deleted: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! ProcessGuid: %4!s! ProcessId: %5!s! Image: %6!s! TargetObject: %7!s! User: %8!s! |
| 0x4006000d | 11 | Registry value set: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! ProcessGuid: %4!s! ProcessId: %5!s! Image: %6!s! TargetObject: %7!s! Details: %8!s! User: %9!s! |
| 0x4006000e | 11 | Registry object renamed: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! ProcessGuid: %4!s! ProcessId: %5!s! Image: %6!s! TargetObject: %7!s! NewName: %8!s! User: %9!s! |
| 0x4006000f | 11 | File stream created: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! TargetFilename: %6!s! CreationUtcTime: %7!s! Hash: %8!s! Contents: %9!s! User: %10!s! |
| 0x40060010 | 11 | Sysmon config state changed: UtcTime: %1!s! Configuration: %2!s! ConfigurationFileHash: %3!s! |
| 0x40060011 | 11 | Pipe Created: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! ProcessGuid: %4!s! ProcessId: %5!s! PipeName: %6!s! Image: %7!s! User: %8!s! |
| 0x40060012 | 11 | Pipe Connected: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! ProcessGuid: %4!s! ProcessId: %5!s! PipeName: %6!s! Image: %7!s! User: %8!s! |
| 0x40060013 | 11 | WmiEventFilter activity detected: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! Operation: %4!s! User: %5!s! EventNamespace: %6!s! Name: %7!s! Query: %8!s! |
| 0x40060014 | 11 | WmiEventConsumer activity detected: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! Operation: %4!s! User: %5!s! Name: %6!s! Type: %7!s! Destination: %8!s! |
| 0x40060015 | 11 | WmiEventConsumerToFilter activity detected: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! Operation: %4!s! User: %5!s! Consumer: %6!s! Filter: %7!s! |
| 0x40060016 | 11 | Dns query: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! QueryName: %5!s! QueryStatus: %6!s! QueryResults: %7!s! Image: %8!s! User: %9!s! |
| 0x40060017 | 11 | File Delete archived: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! User: %5!s! Image: %6!s! TargetFilename: %7!s! Hashes: %8!s! IsExecutable: %9!s! Archived: %10!s! |
| 0x40060018 | 11 | Clipboard changed: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! Session: %6!s! ClientInfo: %7!s! Hashes: %8!s! Archived: %9!s! User: %10!s! |
| 0x40060019 | 11 | Process Tampering: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! Type: %6!s! User: %7!s! |
| 0x4006001a | 11 | File Delete logged: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! User: %5!s! Image: %6!s! TargetFilename: %7!s! Hashes: %8!s! IsExecutable: %9!s! |
| 0x4006001b | 11 | File Block Executable: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! User: %5!s! Image: %6!s! TargetFilename: %7!s! Hashes: %8!s! |
| 0x4006001c | 11 | File Block Shredding: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! User: %5!s! Image: %6!s! TargetFilename: %7!s! Hashes: %8!s! IsExecutable: %9!s! |
| 0x4006001d | 11 | File Executable Detected: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! User: %5!s! Image: %6!s! TargetFilename: %7!s! Hashes: %8!s! |
| 0x50000002 | 11 | Error |
| 0x50000004 | 11 | Information |
| 0x70000001 | 11 | Process Create (rule: ProcessCreate) |
| 0x70000002 | 11 | File creation time changed (rule: FileCreateTime) |
| 0x70000003 | 11 | Network connection detected (rule: NetworkConnect) |
| 0x70000004 | 11 | Sysmon service state changed |
| 0x70000005 | 11 | Process terminated (rule: ProcessTerminate) |
| 0x70000006 | 11 | Driver loaded (rule: DriverLoad) |
| 0x70000007 | 11 | Image loaded (rule: ImageLoad) |
| 0x70000008 | 11 | CreateRemoteThread detected (rule: CreateRemoteThread) |
| 0x70000009 | 11 | RawAccessRead detected (rule: RawAccessRead) |
| 0x7000000a | 11 | Process accessed (rule: ProcessAccess) |
| 0x7000000b | 11 | File created (rule: FileCreate) |
| 0x7000000c | 11 | Registry object added or deleted (rule: RegistryEvent) |
| 0x7000000d | 11 | Registry value set (rule: RegistryEvent) |
| 0x7000000e | 11 | Registry object renamed (rule: RegistryEvent) |
| 0x7000000f | 11 | File stream created (rule: FileCreateStreamHash) |
| 0x70000010 | 11 | Sysmon config state changed |
| 0x70000011 | 11 | Pipe Created (rule: PipeEvent) |
| 0x70000012 | 11 | Pipe Connected (rule: PipeEvent) |
| 0x70000013 | 11 | WmiEventFilter activity detected (rule: WmiEvent) |
| 0x70000014 | 11 | WmiEventConsumer activity detected (rule: WmiEvent) |
| 0x70000015 | 11 | WmiEventConsumerToFilter activity detected (rule: WmiEvent) |
| 0x70000016 | 11 | Dns query (rule: DnsQuery) |
| 0x70000017 | 11 | File Delete archived (rule: FileDelete) |
| 0x70000018 | 11 | Clipboard changed (rule: ClipboardChange) |
| 0x70000019 | 11 | Process Tampering (rule: ProcessTampering) |
| 0x7000001a | 11 | File Delete logged (rule: FileDeleteDetected) |
| 0x7000001b | 11 | File Block Executable (rule: FileBlockExecutable) |
| 0x7000001c | 11 | File Block Shredding (rule: FileBlockShredding) |
| 0x7000001d | 11 | File Executable Detected (rule: FileExecutableDetected) |
| 0x700000ff | 11 | Error report |
| 0xb0010011 | 11 | Pipe Created: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! ProcessGuid: %4!s! ProcessId: %5!s! PipeName: %6!s! Image: %7!s! User: %8!s! |
| 0xb0010012 | 11 | Pipe Connected: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! ProcessGuid: %4!s! ProcessId: %5!s! PipeName: %6!s! Image: %7!s! User: %8!s! |
| 0xb0020008 | 11 | CreateRemoteThread detected: RuleName: %1!s! UtcTime: %2!s! SourceProcessGuid: %3!s! SourceProcessId: %4!s! SourceImage: %5!s! TargetProcessGuid: %6!s! TargetProcessId: %7!s! TargetImage: %8!s! NewThreadId: %9!s! StartAddress: %10!s! StartModule: %11!s! StartFunction: %12!s! SourceUser: %13!s! TargetUser: %14!s! |
| 0xb0020009 | 11 | RawAccessRead detected: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! Device: %6!s! User: %7!s! |
| 0xb002000b | 11 | File created: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! TargetFilename: %6!s! CreationUtcTime: %7!s! User: %8!s! |
| 0xb002000c | 11 | Registry object added or deleted: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! ProcessGuid: %4!s! ProcessId: %5!s! Image: %6!s! TargetObject: %7!s! User: %8!s! |
| 0xb002000d | 11 | Registry value set: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! ProcessGuid: %4!s! ProcessId: %5!s! Image: %6!s! TargetObject: %7!s! Details: %8!s! User: %9!s! |
| 0xb002000e | 11 | Registry object renamed: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! ProcessGuid: %4!s! ProcessId: %5!s! Image: %6!s! TargetObject: %7!s! NewName: %8!s! User: %9!s! |
| 0xb002000f | 11 | File stream created: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! TargetFilename: %6!s! CreationUtcTime: %7!s! Hash: %8!s! Contents: %9!s! User: %10!s! |
| 0xb0030004 | 11 | Sysmon service state changed: UtcTime: %1!s! State: %2!s! Version: %3!s! SchemaVersion: %4!s! |
| 0xb0030005 | 11 | Process terminated: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! User: %6!s! |
| 0xb0030007 | 11 | Image loaded: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! ImageLoaded: %6!s! FileVersion: %7!s! Description: %8!s! Product: %9!s! Company: %10!s! OriginalFileName: %11!s! Hashes: %12!s! Signed: %13!s! Signature: %14!s! SignatureStatus: %15!s! User: %16!s! |
| 0xb003000a | 11 | Process accessed: RuleName: %1!s! UtcTime: %2!s! SourceProcessGUID: %3!s! SourceProcessId: %4!s! SourceThreadId: %5!s! SourceImage: %6!s! TargetProcessGUID: %7!s! TargetProcessId: %8!s! TargetImage: %9!s! GrantedAccess: %10!s! CallTrace: %11!s! SourceUser: %12!s! TargetUser: %13!s! |
| 0xb0030010 | 11 | Sysmon config state changed: UtcTime: %1!s! Configuration: %2!s! ConfigurationFileHash: %3!s! |
| 0xb0030013 | 11 | WmiEventFilter activity detected: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! Operation: %4!s! User: %5!s! EventNamespace: %6!s! Name: %7!s! Query: %8!s! |
| 0xb0030014 | 11 | WmiEventConsumer activity detected: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! Operation: %4!s! User: %5!s! Name: %6!s! Type: %7!s! Destination: %8!s! |
| 0xb0030015 | 11 | WmiEventConsumerToFilter activity detected: RuleName: %1!s! EventType: %2!s! UtcTime: %3!s! Operation: %4!s! User: %5!s! Consumer: %6!s! Filter: %7!s! |
| 0xb00300ff | 11 | Error report: UtcTime: %1!s! ID: %2!s! Description: %3!s! |
| 0xb0040006 | 11 | Driver loaded: RuleName: %1!s! UtcTime: %2!s! ImageLoaded: %3!s! Hashes: %4!s! Signed: %5!s! Signature: %6!s! SignatureStatus: %7!s! |
| 0xb0050001 | 11 | Process Create: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! FileVersion: %6!s! Description: %7!s! Product: %8!s! Company: %9!s! OriginalFileName: %10!s! CommandLine: %11!s! CurrentDirectory: %12!s! User: %13!s! LogonGuid: %14!s! LogonId: %15!s! TerminalSessionId: %16!s! IntegrityLevel: %17!s! Hashes: %18!s! ParentProcessGuid: %19!s! ParentProcessId: %20!s! ParentImage: %21!s! ParentCommandLine: %22!s! ParentUser: %23!s! |
| 0xb0050002 | 11 | File creation time changed: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! TargetFilename: %6!s! CreationUtcTime: %7!s! PreviousCreationUtcTime: %8!s! User: %9!s! |
| 0xb0050003 | 11 | Network connection detected: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! User: %6!s! Protocol: %7!s! Initiated: %8!s! SourceIsIpv6: %9!s! SourceIp: %10!s! SourceHostname: %11!s! SourcePort: %12!s! SourcePortName: %13!s! DestinationIsIpv6: %14!s! DestinationIp: %15!s! DestinationHostname: %16!s! DestinationPort: %17!s! DestinationPortName: %18!s! |
| 0xb0050016 | 11 | Dns query: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! QueryName: %5!s! QueryStatus: %6!s! QueryResults: %7!s! Image: %8!s! User: %9!s! |
| 0xb0050017 | 11 | File Delete archived: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! User: %5!s! Image: %6!s! TargetFilename: %7!s! Hashes: %8!s! IsExecutable: %9!s! Archived: %10!s! |
| 0xb0050018 | 11 | Clipboard changed: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! Session: %6!s! ClientInfo: %7!s! Hashes: %8!s! Archived: %9!s! User: %10!s! |
| 0xb0050019 | 11 | Process Tampering: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! Image: %5!s! Type: %6!s! User: %7!s! |
| 0xb005001a | 11 | File Delete logged: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! User: %5!s! Image: %6!s! TargetFilename: %7!s! Hashes: %8!s! IsExecutable: %9!s! |
| 0xb005001b | 11 | File Block Executable: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! User: %5!s! Image: %6!s! TargetFilename: %7!s! Hashes: %8!s! |
| 0xb005001c | 11 | File Block Shredding: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! User: %5!s! Image: %6!s! TargetFilename: %7!s! Hashes: %8!s! IsExecutable: %9!s! |
| 0xb005001d | 11 | File Executable Detected: RuleName: %1!s! UtcTime: %2!s! ProcessGuid: %3!s! ProcessId: %4!s! User: %5!s! Image: %6!s! TargetFilename: %7!s! Hashes: %8!s! |
| 0xc00600ff | 11 | Error report: UtcTime: %1!s! ID: %2!s! Description: %3!s! |
| 93 entries | ||