process-events.md: Description of Process GUIDs is not right.

Abierto
#31 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
42/100
Tipo de issue
Documentación
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
c
Área
documentation

Línea de trabajo

Start with process-events.md and compare its Process GUID description with GenerateUniqueId in sysmonCommon/eventsCommon.h and set_ProcCreate_info in ebpfKern/sysmonProcCreate.c. Investigate the unresolved Windows behavior if possible, then update the documentation to accurately distinguish the machine ID, process start time, and process start key from the process ID.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Looking at the Sysmon/Linux sources, GUIDs are constructed by concatenating the "machine id", the start time of the process (UNIX-style, seconds since 1970-1-1), and a "process start key" which is not defined in the userspace component (function GenerateUniqueId in sysmonCommon/eventsCommon.h):

	*(DWORD*) pResult = machineId;
	pResult += sizeof(DWORD);
	*(DWORD*) pResult = seconds;
	pResult += sizeof(DWORD);
	*(DWORD64*) pResult = ProcessStartKey;

The "process key" is taken from m_EventBody.m_ProcessCreateEvent.m_ProcessKey which for Linux is created in the eBPF code (set_ProcCreate_info in ebpfKern/sysmonProcCreate.c):

    // get the process key - this is the end of the text segment currently as it should be
    // a) randomised for a PIE executable; and
    // b) dependent on the amount of code in the process
    event->m_ProcessKey = (uint64_t)derefPtr(task, config->offsets.mm_end_code);

I'm still in the process of looking at Sysmon/Windows with a disassembler, so I can't yet speak to what happens there. However, from the logs I have looked at, I don't recognize the process id as part of the process GUID.

Lenguaje dominante
Python
Estrellas
1.4k
Forks
186
Sin PR fusionados en 30 d

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de trustedsec/SysmonCommunityGuide

Todos los issues de trustedsec/SysmonCommunityGuide

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.