Missing field

[cristeigabriela]

Hello! Events such as 4688, which represents process creation, store the new process' PID in the NewProcessId field, I believe adding this to the currently supported fields would make sense. Thank you for the library.

[cristeigabriela]

I think this could be catalogued as a different issue, but I've noticed that there seems to be an issue with the strategy applied to getting PID values.

Running the following:

powershell "Get-WinEvent -FilterHashTable @{ProviderName='Microsoft-Windows-Security-Auditing'} -MaxEvents 1 | ConvertTo-Json"

Outputted the following when the tail event was a process termination:

{
    "Id":  4689,
    "Version":  0,
    "Qualifiers":  null,
    "Level":  0,
    "Task":  13313,
    "Opcode":  0,
    "Keywords":  -9214364837600034816,
    "RecordId":  1490735,
    "ProviderName":  "Microsoft-Windows-Security-Auditing",
    "ProviderId":  "54849625-5478-4994-a5ba-3e3b0328c30d",
    "LogName":  "Security",
    "ProcessId":  4,
    "ThreadId":  14860,
    "MachineName":  "botnet",
    "UserId":  null,
    "TimeCreated":  "\/Date(1669649034075)\/",
    "ActivityId":  null,
    "RelatedActivityId":  null,
    "ContainerLog":  "Security",
    "MatchedQueryIds":  [

                        ],
    "Bookmark":  {

                 },
    "LevelDisplayName":  "Information",
    "OpcodeDisplayName":  "Info",
    "TaskDisplayName":  "Process Termination",
    "KeywordsDisplayNames":  [
                                 "Audit Success"
                             ],
    "Properties":  [
                       {
                           "Value":  "S-1-5-21-3378006324-3538808376-2707923682-1001"
                       },
                       {
                           "Value":  "gabriel"
                       },
                       {
                           "Value":  "botnet"
                       },
                       {
                           "Value":  606285
                       },
                       {
                           "Value":  1
                       },
                       {
                           "Value":  17976
                       },
                       {
                           "Value":  "C:\\Windows\\System32\\backgroundTaskHost.exe"
                       }
                   ],
    "Message":  "A process has exited.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-3378006324-3538808376-2707923682-1001\r\n\tAccount Name:\t\tgabriel\r\n\tAccount Domain:\t\tbotnet\r\n\tLogon ID:\t\t0x9404D\r\n\r\nProcess Information:\r\n\tProcess ID:\t0x4638\r\n\tProcess Name:\tC:\\Windows\\System32\\backgroundTaskHost.exe\r\n\tExit Status:\t0x1"
}

The issue is, when we read the message, it says the Process ID is 0x4638, but when we read the JSON, it says the Process ID is 4.

Am I doing something wrong, or is this an issue with the strategy applied?

---

Edit at a later time, not to bump and bother the author who may, potentially, not even care about the project anymore - I've added PID functionality in my fork of this package, and also added the field that I needed. https://github.com/SystemMonitorTools/windows-event-reader

For those interested, the issue is due to Convert-ToJson in PowerShell over the message, for some reason it can convert normal fields which contain hex to Json but it has failed to on the command that the project generates. Didn't look into why.