security_content/data_sources/windows_event_log_capi2_81.yml at 2b6d541b4c179dc3fc0dbabcb420fb98ba1d5f88 · splunk/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
name: Windows Event Log CAPI2 81
id: 463ff898-8135-4c0e-811e-f8629dfc5027
version: 4
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
description: Logs an error when attempting to verify the digital signature of a file, including details about the file path, signature failure, and the process involved.
mitre_components:
    - File Access
    - File Metadata
    - Malware Metadata
    - Application Log Content
    - Process Metadata
source: XmlWinEventLog:Microsoft-Windows-CAPI2/Operational
sourcetype: XmlWinEventLog
separator: EventCode
separator_value: '81'
supported_TA:
    - name: Splunk Add-on for Microsoft Windows
      url: https://splunkbase.splunk.com/app/742
      version: 10.0.1
fields:
    - _time
    - Channel
    - Computer
    - EventCode
    - EventID
    - EventRecordID
    - Guid
    - Keywords
    - Level
    - Name
    - Opcode
    - ProcessID
    - RecordNumber
    - SystemTime
    - System_Props_Xml
    - Task
    - ThreadID
    - UserData_Xml
    - UserID
    - Version
    - date_hour
    - date_mday
    - date_minute
    - date_month
    - date_second
    - date_wday
    - date_year
    - date_zone
    - dvc
    - dvc_nt_host
    - event_id
    - eventtype
    - host
    - id
    - index
    - linecount
    - punct
    - signature_id
    - source
    - sourcetype
    - splunk_server
    - tag
    - tag::eventtype
    - timeendpos
    - timestartpos
    - user_id
    - vendor_product
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CAPI2' Guid='{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}'/><EventID>81</EventID><Version>0</Version><Level>2</Level><Task>80</Task><Opcode>2</Opcode><Keywords>0x4000000000000040</Keywords><TimeCreated SystemTime='2023-10-10T21:05:45.047550700Z'/><EventRecordID>2400597</EventRecordID><Correlation/><Execution ProcessID='2424' ThreadID='2868'/><Channel>Microsoft-Windows-CAPI2/Operational</Channel><Computer>mswin-server.attackrange.local</Computer><Security UserID='S-1-5-18'/></System><UserData><WinVerifyTrust><ActionID>{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}</ActionID><UIChoice value='2'>WTD_UI_NONE</UIChoice><RevocationCheck value='0'/><StateAction value='1'>WTD_STATEACTION_VERIFY</StateAction><Flags value='80001000' WTD_CACHE_ONLY_URL_RETRIEVAL='true' CPD_USE_NT5_CHAIN_FLAG='true'/><FileInfo filePath='C:\Users\Administrator\Downloads\metatwin-master\metatwin-master\20231010_210331\20231010_210331_signed_mimikatz.exe' hasFileHandle='true'/><DigestInfo digestAlgorithm='SHA256' digest='140E97430439F7B8E2332E928581996A701C28D3D33FBC80BCAA2F731F9FEE8D'/><RegPolicySetting value='23C00' WTPF_OFFLINEOK_IND='true' WTPF_OFFLINEOK_COM='true' WTPF_OFFLINEOKNBU_IND='true' WTPF_OFFLINEOKNBU_COM='true' WTPF_IGNOREREVOCATIONONTS='true'/><SignatureSettingsFlags value='20000000' WSS_OUT_FILE_SUPPORTS_SEAL='true'/><SignerInfo><DigestAlgorithm oid='2.16.840.1.101.3.4.2.1' hashName='SHA256'/></SignerInfo><CertificateChain chainRef='{D7D21F37-6E0D-440C-9DF2-E73BC40CD4BF}'/><TimestampInfo format='RFC 3161'><DigestAlgorithm oid='2.16.840.1.101.3.4.2.1' hashName='SHA256'/><SignTime>2021-01-07T23:21:42.655Z</SignTime></TimestampInfo><TimestampChain chainRef='{2BDF7F75-D825-45BA-BC57-1F5E52274842}'/><StepError stepID='32' stepName='TRUSTERROR_STEP_FINAL_OBJPROV'><Result value='80096010'>The digital signature of the object did not verify.</Result></StepError><EventAuxInfo ProcessName='sysmon64.exe'/><CorrelationAuxInfo TaskId='{44B713F2-FA74-49B2-B3C1-99E5FD2F1667}' SeqNumber='9'/><Result value='80096010'>The digital signature of the object did not verify.</Result></WinVerifyTrust></UserData></Event>