EDR Telemetry Field Reference — Field Guide

1. How to Hunt With This Data

The agent ships two kinds of event, and knowing which one you are looking at is the first skill to build.

A Detection Finding is built as a complete copy of the raw event that triggered it, with the finding taxonomy laid on top. The finding therefore already carries the full context — actor, file, reg_key, src_endpoint, process, unmapped.*, metadata — so you rarely need to go back to the origin event to understand what happened. The origin event's own class is preserved in associated_class_uid / associated_class_name.

The seven-step loop

Whether you are investigating an alert, validating a control, or exploring a suspicion, the same loop applies.

┌─ 1. SCOPE ────────────────────────────────────────────────────────┐
│  device.hostname = "WORKSTATION-01"                               │
│  and time >= <start ms> and time <= <end ms + 60000>              │
│  Add a short tail: findings are emitted just after the activity   │
│  they describe.                                                   │
└───────────────────────────────────────────────────────────────────┘
                              ↓
┌─ 2. LOOK FOR A VERDICT FIRST ─────────────────────────────────────┐
│  class_uid = 2004                        (Detection Finding)      │
│  → finding_info.title / analytic.name    = the rule that fired    │
│  → finding_info.analytic.desc            = why it fired           │
│  → associated_class_uid                  = what kind of activity  │
│                                            triggered it           │
│  Also check: class_uid = 201003          (behaviour detections)   │
│              class_uid = 2001            (browser threats)        │
│              type_name = "yara_detection_event"                   │
└───────────────────────────────────────────────────────────────────┘
                              ↓
┌─ 3. TAKE THE dpid AND PULL THE WHOLE CHAIN ───────────────────────┐
│  device.hostname = "WORKSTATION-01" and dpid = 1247               │
│  ← take the dpid from any event in step 2                         │
│  This returns EVERY event the agent attributed to the same        │
│  logical chain, across all classes AND across processes.          │
│  Keep the host filter: the counter is per-endpoint.               │
└───────────────────────────────────────────────────────────────────┘
                              ↓
┌─ 4. PROFILE THE ACTING PROCESS ───────────────────────────────────┐
│  actor.process.uid = "<uuid>"  ← never reused, unlike pid          │
│  Returns files touched, registry written, DNS resolved, sockets    │
│  opened, modules loaded, APIs called — by that one process         │
│  instance.                                                         │
└───────────────────────────────────────────────────────────────────┘
                              ↓
┌─ 5. WALK THE PROCESS TREE ────────────────────────────────────────┐
│  actor.process.lineage_uid contains "<ancestor uuid>"              │
│  Everything any descendant did. Use this to catch the stages       │
│  that ran in child processes.                                      │
└───────────────────────────────────────────────────────────────────┘
                              ↓
┌─ 6. NO VERDICT? HUNT THE RAW TELEMETRY DIRECTLY ──────────────────┐
│  Use Section 7 (Hunting Index) to go straight to the class and     │
│  field that records the activity you care about, and query it in   │
│  the scoped window from step 1.                                    │
└───────────────────────────────────────────────────────────────────┘
                              ↓
┌─ 7. NOTHING AT ALL? CHECK THE COLLECTION SCOPE ───────────────────┐
│  Section 3. Three things determine whether a class is on the wire: │
│  the global collection switch, the per-class telemetry flag, and   │
│  the fact that classes 201008 / 201009 / 201010 travel only as     │
│  Detection Finding context.                                        │
└───────────────────────────────────────────────────────────────────┘

Why step 2 comes before step 6

Start narrow and widen. A finding, where one exists, answers two questions in a single row — which rule fired, and what the activity actually was.

          Activity you want to explain
                        │
                        ▼
        ┌──────────────────────────────┐
        │  class_uid = 2004            │
        │  Did a rule fire on it?      │
        └──────────────────────────────┘
              │                               │
           YES│                               │NO
              ▼                               ▼
  ┌────────────────────────┐   ┌──────────────────────────────┐
  │ The finding row gives  │   │ Section 7 gives you the      │
  │ you BOTH the rule that │   │ class and field that records │
  │ fired AND the full     │   │ the activity you are after   │
  │ evidence, copied from  │   └──────────────────────────────┘
  │ the origin event       │                  │
  └────────────────────────┘                  ▼
              │                ┌──────────────────────────────┐
              │                │ Nothing at all? That is a    │
              │                │ collection-scope question -  │
              │                │ see Section 3                │
              │                └──────────────────────────────┘
              │                               │
              └────────────────┬──────────────┘
                               ▼
      ┌──────────────────────────────────────────────────┐
      │  WIDEN                                           │
      │    dpid              → the whole activity chain  │
      │    actor.process.uid → everything that process   │
      │                        did                       │
      │    lineage_uid       → everything its            │
      │                        descendants did           │
      └──────────────────────────────────────────────────┘

Timing expectations

• Batches are cut at 5,000 events, 30 seconds, or the moment a detection fires — whichever comes first. Expect activity to become searchable within roughly 30 seconds on a quiet endpoint, and sooner where a detection is involved.
• The raw origin event is pushed before the Detection Finding(s) it produced, so ordering by time reads naturally.
• One raw event that trips N behaviour rules produces N separate Detection Findings, all sharing the same dpid and the same origin context.

Two habits that prevent wrong answers

1. Always pair activity_id with class_uid. Activity IDs are class-specific, so the same number means different things in different classes. activity_id = 6 on its own is ambiguous — it is File Create in File Activity, Start in Scheduled Job Activity and Continue in Windows Service Activity. Only class_uid = 1001 and activity_id = 6 unambiguously means "a file was created".
2. Correlate on UUIDs, never on pids. Windows reuses process IDs. actor.process.uid does not get reused.

2. Anatomy of an Event — The Common Envelope

Every event, in every class, carries the same envelope. Learn it once.

2.1 Classification — "what kind of event is this?"

2.2 Correlation — "how do I tie this to everything else?"

2.3 Time

All timestamps are epoch milliseconds. There is no string date format anywhere in the schema.

2.4 Where — device and tenant

2.5 Product metadata

Browser-sourced events (classes 4002 / 6001 / 6002 / 2001) receive their metadata from the browser extension, so metadata.product may describe the browser or extension rather than the agent.

2.6 Outcome

2.7 Observables

observables is a short array summarising the event's key artefact. It is a convenience filter, not a complete index.

Observable presence by class:

Classes 201003, 201008, 1009, 4002 / 6001 / 6002 / 2001 and YARA detections carry no observables array.

3. Telemetry Delivery and Collection Scope

If an activity produced no telemetry, work through this section before concluding it was not captured.

3.1 Collection and delivery

The agent transforms each captured event into an OCSF JSON object, groups them into batches and uploads over HTTPS.

A batch closes on whichever of these comes first:

• 5,000 events accumulate.
• 30 seconds elapse.
• A detection fires. An alert triggers an immediate flush, so telemetry from around a detection reaches the server without waiting for either threshold above.

Each batch is gzip-compressed and uploaded as one file, and every event in it carries the batch identifier in batch_name. Under normal load there is a short pause (~2 s) between successive uploads.

Retry behaviour on upload failure:

Each dropped batch is reported to the server in its own batch-summary record, so the delivery record stays complete.

Disk safeguards: the telemetry folder is capped at 500 MB and a single compressed batch at 4 MB, which bounds the agent's disk footprint on the endpoint.

3.2 Scope control 1 — the global collection switch

All OCSF telemetry generation sits behind one master switch, delivered as server-side policy. When it is off, nothing is emitted — not even Detection Findings.

3.3 Scope control 2 — per-class telemetry flags

Each class is individually enabled by a bit in a telemetry flag mask. If the bit is clear, that class's raw events are not emitted.

Classes that flow whenever global collection is on, without a per-class flag: YARA detections, Suspicious Behaviour Activity, and all Detection Findings. Browser-sourced classes are also delivered whenever collection is enabled.

The most useful fact in this section: Detection Findings are emitted whenever collection is on and a behaviour fires — independent of the origin class's telemetry flag. So with, say, Module Activity disabled, a module-based behaviour still produces a finding carrying the full module context. Findings present but raw events absent is normally a flag question, not a capture question.

3.4 Scope control 3 — classes that travel as finding context

Three classes fire on essentially every relevant operation, so they are delivered as the context of a Detection Finding rather than as standalone events:

# Correct way to hunt API-call evidence:
class_uid = 2004
and associated_class_uid = 201008
and unmapped.api_telemetry.api_name = "ApiTelemetry_NtCreateRemoteThread"

3.5 Scope control 4 — per-process daily event limits

Each process has a daily allowance per activity type, which keeps any single high-volume process from crowding out telemetry from the rest of the endpoint. Once a process reaches its allowance for a given activity, further events of that type from that process are collected again the next day; every other process is unaffected.

Process Activity and Authentication carry no per-process limit. The remaining classes (1005, 1006, 1009, 1011, 201003—201010, 4006, 3001, 3005, 3006) are bounded by their telemetry flag and by the narrowness of their source rather than by a count.

Reading high-volume activity: where a single process generates activity at this scale, the Detection Finding is the reliable summary of what happened — it is emitted per rule fire and is not subject to these allowances. Use the raw events for the detail and the finding for the verdict.

3.6 Scope control 5 — content filters

4. The Three Correlation Pivots

4.1 dpid — the activity-chain token

dpid (Data Provenance ID) is a correlation token the agent assigns before an event is queued. Every event the agent attributes to the same logical chain of activity carries the same value — including events from different processes.

Always scope a dpid query to one host

Each endpoint runs its own independent counter, seeded at 1000. dpid = 1247 on one machine has no relationship to dpid = 1247 on another. A dpid query without a host filter will pull together unrelated activity from every endpoint that happens to have reached that number.

`

Correct

device.hostname = "WORKSTATION-01" and dpid = 1247

Also correct — componentid identifies one agent installation

componentid = 1001000000012345 and dpid = 1247

`

On agent startup the engine also mints one DPID for each process already running, so a fresh agent on a busy machine will have advanced its counter by a few hundred before it observes anything new. A low value therefore does not mean "early in the incident" — it means "early in this agent's lifetime". Order chains by time, never by dpid.

# The single most valuable investigative query.
# Take the dpid from any event of interest, then:
device.hostname = "WORKSTATION-01" and dpid = 1247

This returns the process launches, file writes, registry keys, DNS lookups, network connections, module loads, service installs and findings the agent grouped into one chain — even where the activity moved between processes and actor.process.uid therefore changes.

Why it beats actor.process.uid: real activity crosses process boundaries (winword.exe → cmd.exe → powershell.exe → an injected explorer.exe). actor.process.uid gives you one hop; dpid gives you the chain.

# Recommended triage pattern:
# 1. Find the findings in your window
class_uid = 2004 and device.hostname = "WORKSTATION-01"
and time >= 1704067200000 and time < 1704070800000

# 2. Collect the distinct dpid values, then for each:
device.hostname = "WORKSTATION-01" and dpid = <value>
# 3. Sort by time — you now have the reconstructed chain.

4.2 actor.process.uid — the process-instance key

A UUID identifying one process instance. It is not reused, so it is safe to pivot on across long windows.

# Everything one process instance did, across every class:
actor.process.uid = "a7f3c9e1-4b2d-4e8a-9c1f-2d3e4f5a6b7c"

Present as actor.process.uid on every class that has an acting process. On Process Activity events the subject process also has its own process.uid.

# Step 1 — find the process instance
class_uid = 1007 and activity_id = 1
and process.name = "powershell.exe"
and process.cmd_line contains "-enc"

# Step 2 — take process.uid from the result, then profile it
actor.process.uid = "<the uid>"

4.3 lineage_uid — the ancestry array

process.lineage_uid and actor.process.lineage_uid are arrays of ancestor process UUIDs, ordered nearest-first (index 0 = parent). Up to 5 ancestors are recorded.

explorer.exe (AAA) → cmd.exe (BBB) → powershell.exe (CCC) → updater.exe (DDD)

For the updater.exe launch event:
  process.uid         = "DDD"
  process.lineage_uid = ["CCC", "BBB", "AAA"]

Because it is a string array, contains matches any element — which makes it a subtree query:

# Every event produced by any descendant of cmd.exe (BBB):
actor.process.lineage_uid contains "BBB"

4.4 Secondary join keys

5. Understanding "Actor" Across All Classes

actor answers "who did this?". Its meaning shifts by class, and getting it wrong is the most common hunting mistake.

5.1 Process Activity — three process objects

Normal:
  cmd.exe (1234) launches powershell.exe (5678)
  process                = powershell.exe (5678)
  process.parent_process = cmd.exe (1234)
  actor.process          = cmd.exe (1234)      ← same

Falsified parent:
  process (9999) launches powershell.exe (5678) claiming explorer.exe (1000)
  process                = powershell.exe (5678)
  process.parent_process = explorer.exe (1000)     ← claimed
  actor.process          = the real creator (9999) ← actual
# Detect a falsified parent process:
class_uid = 1007 and activity_id = 1
and actor.process.pid != process.parent_process.pid

5.2 File, Registry, Network, DNS, Module, Volume, Script, API Telemetry

actor.process is simply the process that performed the action.

5.3 Identity classes (3001, 3005, 3006) — subject vs target

# Who created accounts, and which accounts were created?
class_uid = 3001 and activity_id = 1001
# → actor.user.name = the creator, user.name = the new account

5.4 Authentication (3002)

When one account authenticates as another, actor.user and user differ. That difference is often the whole signal.

5.5 Lifecycle classes (1006, 201004, 1011)

These distinguish who asked from what ran:

For Windows Service Activity: actor.process is populated from the Service Control Manager caller, so it names the process that requested the operation. Service-led events — state changes and stop notifications — are reported by the service itself and carry no caller, so actor.process is not populated on those.

5.6 Detection Finding (2004)

actor is copied wholesale from the origin event, so it means whatever it meant there. If the origin carried no actor, the engine-reported acting pid is used, giving actor.process.pid without the enriched name, command line, hash and user.

5.7 Classes with no meaningful actor

6. Event Class Catalogue

6.0 Class index

6.1 Process Activity (1007)

Activities

Remote process creation is also reported as activity_id = 1 / type_uid = 100701, distinguished by is_remote = true and a populated src_endpoint.

Fields

On a Terminate event for a process the agent never saw launch (for instance when the agent started mid-life), pid, uid and terminated_time are populated and the cached image, hash, user and hierarchy details are not available.

Hunting

# Office applications spawning a shell or script host
class_uid = 1007 and activity_id = 1
and process.name in "cmd.exe","powershell.exe","wscript.exe","cscript.exe","mshta.exe"
and actor.process.name in "winword.exe","excel.exe","powerpnt.exe","outlook.exe"

# Encoded or obfuscated PowerShell invocations
class_uid = 1007 and activity_id = 1
and process.name = "powershell.exe"
and (process.cmd_line contains "-enc" or process.cmd_line contains "-e "
     or process.cmd_line contains "FromBase64String")

# Built-in Windows binaries commonly used to proxy execution
class_uid = 1007 and activity_id = 1
and process.name in "certutil.exe","regsvr32.exe","mshta.exe","wmic.exe",
    "rundll32.exe","bitsadmin.exe","msiexec.exe","installutil.exe","regasm.exe"

# Execution from a user-writable directory
class_uid = 1007 and activity_id = 1
and (process.file.path contains "\AppData\" or process.file.path contains "\Temp\"
     or process.file.path contains "\Public\" or process.file.path contains "\ProgramData\")

# Remotely initiated process creation
class_uid = 1007 and activity_id = 1 and is_remote = true

# Falsified parent process
class_uid = 1007 and activity_id = 1
and actor.process.pid != process.parent_process.pid

# A system binary name running from the wrong directory
class_uid = 1007 and activity_id = 1
and process.name = "svchost.exe"
and process.file.path notcontains "\System32\"

# Proximity search across command lines
actor.process.cmd_line spanNear ("powershell","hidden",10,false)
actor.process.cmd_line spanNear ("certutil","decode",5,true)

6.2 File Activity (1001)

Activities collected

Mutating operations are collected. The class also defines Read (7 / 100102) and Set Attributes (11 / 100106) for completeness of the schema.

Fields

file vs file_result on rename

file.path        = "C:\Users\Admin\Documents\report.docx"     ← BEFORE
file.ext         = "docx"
file_result.path = "C:\Users\Admin\Documents\report.locked"   ← AFTER
file_result.ext  = "locked"

On Create, Write and Delete the two objects hold the same path.

Hunting

# Bulk renames that change the extension
class_uid = 1001 and activity_id = 10
and file.ext in "docx","xlsx","pdf","jpg","png","pptx","txt","csv"
and file_result.ext notin "docx","xlsx","pdf","jpg","png","pptx","txt","csv","tmp"
# group by actor.process.uid and look for high counts in a short window

# Executables written by a script engine
class_uid = 1001 and activity_id in 6,8
and file.ext in "exe","dll","ps1","bat","vbs","js","hta","scr"
and actor.process.name in "powershell.exe","wscript.exe","cscript.exe","cmd.exe","mshta.exe"

# Files placed in a startup folder
class_uid = 1001 and activity_id in 6,8
and file.path contains "\Microsoft\Windows\Start Menu\Programs\Startup"

# Executables written over the network
class_uid = 1001 and activity_id in 6,8 and is_remote = true
and file.ext in "exe","dll","bat","ps1"
# → src_endpoint.ip identifies the source host

# Hidden files created
class_uid = 1001 and activity_id in 6,8 and file.attributes >= 2
# test bit 0x2 in your platform, then confirm by inspecting the value

# Double extensions
class_uid = 1001
and (file.name contains ".pdf.exe" or file.name contains ".doc.exe"
     or file.name contains ".jpg.exe")

# Backup and shadow-copy artefacts deleted
class_uid = 1001 and activity_id = 9
and (file.path contains "\System Volume Information" or file.ext in "bak","vhd","vbk")

# Everything one process touched
class_uid = 1001 and actor.process.uid = "<uid>"

# Track a file by hash across the estate
class_uid = 1001 and file.sha256 = "<sha256>"

6.3 Module Activity (1005)

Activities

Fields

For the technique by which a module was loaded — manual mapping, reflective loading, module stomping — see Suspicious Behaviour Activity (6.9) and API Telemetry Activity (6.13).

Hunting

# Modules loaded from a writable directory rather than a system path
class_uid = 1005
and module.file.path notcontains "\System32\"
and module.file.path notcontains "\WinSxS\"
and module.file.path notcontains "\Program Files"
and (module.file.path contains "\AppData\" or module.file.path contains "\Temp\"
     or module.file.path contains "\ProgramData\")

# Every module loaded into a process instance of interest
class_uid = 1005 and actor.process.uid = "<uid>"

# A specific module by hash, anywhere in the estate
class_uid = 1005 and module.file.sha1 = "<sha1>"

# Modules loaded by binaries that exist to load them
class_uid = 1005
and actor.process.name in "rundll32.exe","regsvr32.exe","mshta.exe"

# Which processes loaded a given DLL name
class_uid = 1005 and module.file.name = "amsi.dll"

6.4 Scheduled Job Activity (1006)

Activities (normalised to the OCSF 0—99 range)

TaskScheduler/Operational EIDs 100, 110, 200 and 325 are pre-spawn bookkeeping and are not collected. EIDs 106, 140, 141 and 142 duplicate the Security audit events and are not collected.

Fields

Hunting

# All task creation and modification
class_uid = 1006 and activity_id in 1,2

# Tasks hidden from the Task Scheduler UI
class_uid = 1006
and unmapped.scheduled_job.scheduled_job_visibility contains "Hidden"

# Tasks that run as SYSTEM with highest privileges
class_uid = 1006 and activity_id in 1,2
and job.run_as.type_id = 3
and unmapped.scheduled_job.scheduled_job_privilege contains "Highest"

# Tasks launching a script engine, or a binary from a writable directory
class_uid = 1006 and activity_id in 1,2
and (job.file.name in "powershell.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe"
     or job.file.path contains "\AppData\" or job.file.path contains "\Temp\"
     or job.file.path contains "\ProgramData\")

# Tasks placed outside the library root
class_uid = 1006 and activity_id = 1
and unmapped.scheduled_job.scheduled_job_location != "\"

# Encoded or download-style payloads in the task command
class_uid = 1006
and (job.cmd_line contains "-enc" or job.cmd_line contains "FromBase64String"
     or job.cmd_line contains "DownloadString" or job.cmd_line contains "IEX")

# Existing tasks disabled or deleted
class_uid = 1006 and activity_id in 3,5

# Tasks registered by an unexpected caller
class_uid = 1006 and activity_id = 1
and actor.process.name notin "schtasks.exe","taskeng.exe","svchost.exe","msiexec.exe"

6.5 Script Activity (1009)

Why this class is unusually valuable: AMSI sees content at the point the engine is about to execute it. A command line can be obfuscated; what reaches AMSI is the material the interpreter actually runs. Up to 10,000 bytes are captured per scan.

Activities

Fields

Hunting

# Download cradles in script bodies
class_uid = 1009
and (script.content contains "DownloadString" or script.content contains "DownloadFile"
     or script.content contains "Invoke-WebRequest" or script.content contains "Net.WebClient"
     or script.content contains "Start-BitsTransfer")

# In-memory assembly loading and memory allocation
class_uid = 1009
and (script.content contains "Reflection.Assembly" or script.content contains "VirtualAlloc"
     or script.content contains "CreateThread" or script.content contains "Add-Type")

# Attempts to tamper with the scan interface itself
class_uid = 1009
and (script.content contains "amsiInitFailed" or script.content contains "AmsiUtils"
     or script.content contains "AmsiScanBuffer")

# Encoding and string-construction obfuscation inside the script
class_uid = 1009
and (script.content contains "FromBase64String" or script.content contains "-join"
     or script.content contains "char[]" or script.content contains "-bxor")

# Office macro execution
class_uid = 1009 and script.type_id = 7

# Credential-access tooling invoked from a script
class_uid = 1009
and (script.content contains "Invoke-Mimikatz" or script.content contains "sekurlsa"
     or script.content contains "MiniDumpWriteDump" or script.content contains "lsass")

# Directory and account enumeration from a script
class_uid = 1009
and (script.content contains "Get-ADUser" or script.content contains "Get-DomainUser"
     or script.content contains "net group" or script.content contains "Get-NetGroupMember")

# Unsigned script files executed
class_uid = 1009 and unmapped.amsi_signer_verified = 0 and script.file.path != ""

# Proximity search on the script body
script.content spanNear ("Invoke-Expression","Base64",30,false)

6.6 Device Power State Activity (1011)

Activities (normalised to the OCSF 0—99 range)

Fields

Hunting

# All shutdown and reboot activity in the window
class_uid = 1011

# Reboots initiated by an unexpected process
class_uid = 1011 and activity_id in 2,5
and actor.process.name notin "shutdown.exe","explorer.exe","winlogon.exe","svchost.exe"

# A comment was left on the shutdown
class_uid = 1011 and unmapped.device_power_state.comment != ""

# Reboot driven from a script engine
class_uid = 1011
and actor.process.name in "powershell.exe","cmd.exe","wscript.exe","cscript.exe"

# Unplanned shutdowns
class_uid = 1011 and unmapped.device_power_state.reason_text contains "Unplanned"

6.7 Registry Key Activity (201001)

Activities

Fields

Read operations are reported as the request is made, so status_detail describes the attempt ("Query Key") rather than an outcome.

Hunting

# Keys created under a persistence location
class_uid = 201001 and activity_id = 101
and (reg_key.path contains "currentversion\run"
     or reg_key.path contains "image file execution options"
     or reg_key.path contains "\services\")

# Registry permission changes from an unexpected process
class_uid = 201001 and activity_id = 106
and actor.process.name notin "services.exe","svchost.exe","msiexec.exe","TrustedInstaller.exe"

# A registry hive was saved to a file
class_uid = 201001 and activity_id = 102 and status_detail = "Save Key"

# Enumeration of a sensitive hive
class_uid = 201001 and activity_id = 102
and reg_key.path contains "\securityproviders\"

# Security-product keys deleted
class_uid = 201001 and activity_id = 104
and reg_key.path contains "windows defender"

# Everything one process did in the registry
class_uid in 201001,201002 and actor.process.uid = "<uid>"

6.8 Registry Value Activity (201002)

Activities

A newly created value is reported as Modify (203), so hunt activity_id in 203,204 when you want writes.

Fields

On Read (202) only name and path are populated. The event is reported as the request is made, so the value type and data are not part of it.

Hunting

# Run-key writes, with the payload
class_uid = 201002 and activity_id = 203
and reg_value.path contains "currentversion\run"
# → reg_value.reg_string_data is the command that will execute at logon

# Run-key payload pointing at a writable directory or a script engine
class_uid = 201002 and activity_id = 203
and reg_value.path contains "currentversion\run"
and (reg_value.reg_string_data contains "\AppData\"
     or reg_value.reg_string_data contains "\Temp\"
     or reg_value.reg_string_data contains "powershell")

# Image File Execution Options debugger hijack
class_uid = 201002 and activity_id = 203
and reg_value.path contains "image file execution options"
and reg_value.name in "Debugger","GlobalFlag","ReportingMode","MonitorProcess"

# Service binary path or worker DLL redirected
class_uid = 201002 and activity_id = 203
and reg_value.path contains "\services\"
and reg_value.name in "ImagePath","ServiceDll"

# Large binary values written by a script engine
class_uid = 201002 and activity_id = 203
and reg_value.type_id = 3
and actor.process.name in "powershell.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe"

# Security-product configuration disabled via policy values
class_uid = 201002 and activity_id = 203
and reg_value.path contains "windows defender"
and reg_value.name in "DisableAntiSpyware","DisableRealtimeMonitoring","DisableBehaviorMonitoring"

# Elevation-prompt settings changed
class_uid = 201002 and activity_id = 203
and reg_value.name in "EnableLUA","ConsentPromptBehaviorAdmin","FilterAdministratorToken"

# Registry writes from processes outside the usual system paths
class_uid = 201002 and activity_id = 203
and actor.process.file.path notcontains "System32"
and actor.process.file.path notcontains "Program Files"

6.9 Suspicious Behaviour Activity (201003)

Activities

Filter this class on class_uid = 201003.

Fields

Reading message — it is a JSON document, not prose. Its keys:

Because driverSuspReason is a name string, substring matching works directly:

class_uid = 201003 and message contains "PROCESS_HOLLOWING_DETECTION"

Detection reasons, grouped by theme

Hunting

# Every behaviour judged suspicious in the window
class_uid = 201003

# Only what it actually blocked
class_uid = 201003 and status_detail contains "blocked"

# Injection and image-tampering family
class_uid = 201003
and (message contains "INJECTION" or message contains "HOLLOWING"
     or message contains "SHELLCODE_INJECTED" or message contains "THREAD_EXECUTION_HIJACK")

# Access to the credential-store process
class_uid = 201003
and (message contains "LSASS_OPEN_HANDLE" or message contains "LSASS_REMOTE_THREAD")

# Directory replication requests
class_uid = 201003 and message contains "ReplicatingDirectoryChanges"

# Event-log clearing
class_uid = 201003 and message contains "LOG_CLEARED"

# Interference with monitoring
class_uid = 201003
and (message contains "ETW_PATCHING" or message contains "EDR_ETW_SESSION_STOPING"
     or message contains "APIHook_Patching" or message contains "DIRECT_SYSCALL")

# Confirmed encryption activity
class_uid = 201003 and message contains "CONFIRMED_RANSOMWARE_DETECTION"

# Logon anomalies
class_uid = 201003 and message contains "LOGON_AN"

# Critical-severity detections
class_uid = 201003 and message contains "\"severity\": \"critical\""

# Both sides of an injection pair
class_uid = 201003 and (message contains "\"isInjector\": true"
                        or message contains "\"isInjectee\": true")

6.10 Windows Service Activity (201004)

Activities (normalised to the OCSF 0—99 range)

Caller-led versus service-led events — essential to reading this class correctly:

A single service start produces two records: 204 (the caller that invoked the start) and 105 running (the launched worker). Use 204 for attribution and 105 for confirmation.

Fields

Hunting

# All service installation
class_uid = 201004 and activity_id = 1

# New SYSTEM-level service running from a writable directory
class_uid = 201004 and activity_id = 1
and unmapped.win_service_lifecycle.persistence_flags contains "runs-as-localsystem"
and (win_service.service_file.path contains "\Temp\"
     or win_service.service_file.path contains "\AppData\"
     or win_service.service_file.path contains "\ProgramData\"
     or win_service.service_file.path contains "\Users\")

# Driver services installed
class_uid = 201004 and activity_id = 1 and win_service.service_type_id in 1,2

# Service binary path changed after installation
class_uid = 201004 and activity_id = 2 and win_service.service_file.path != ""

# Start type flipped to automatic
class_uid = 201004 and activity_id = 2
and unmapped.win_service_lifecycle.start_type_transition contains "Auto"

# Security and backup services stopped
class_uid = 201004 and activity_id = 4
and (win_service.name contains "Defender"
     or win_service.name in "WinDefend","Sense","MsSecFlt","wuauserv","VSS","BITS","SQLWriter")

# Who stopped services? (caller-led control events carry the caller)
class_uid = 201004 and activity_id = 4
and actor.process.name in "sc.exe","net.exe","net1.exe","powershell.exe","taskkill.exe"

# Shared-host worker DLL outside the system directory
class_uid = 201004 and win_service.service_dll_file.path != ""
and win_service.service_dll_file.path notcontains "\System32\"

# Services configured to restart themselves automatically
class_uid = 201004
and unmapped.win_service_lifecycle.persistence_flags contains "auto-restart-configured"

# An unexpected process answered the service start
class_uid = 201004 and message contains "UNEXPECTED process"

# Remotely created services
class_uid = 201004 and activity_id = 1 and is_remote = true

6.11 WMI Activity (201005)

Activities — the full 1600-block value is reported:

Fields

Attribution on EID 5861 and EID 21: these events are emitted by the WMI subscription service rather than by the process that created the subscription, so actor.process reflects that service. To attribute the install, correlate back to the Create events (EID 11 / 20) for the same filter or consumer name, or pivot on dpid.

Hunting

# A subscription binding went live — the highest-value WMI query
class_uid = 201005 and activity_id = 1605

# A subscription actually executed
class_uid = 201005 and activity_id = 1609

# Any object written into the subscription namespace
class_uid = 201005 and activity_id = 1603
and unmapped.wmi_activity.wmi_namespace contains "subscription"

# Command-line consumer payloads
class_uid = 201005
and unmapped.wmi_activity.consumer_type = "CommandLineEventConsumer"
and unmapped.wmi_activity.consumer_command_line != ""

# Inline script consumer payloads
class_uid = 201005 and unmapped.wmi_activity.consumer_script_text != ""

# Encoded payload in a consumer
class_uid = 201005
and (unmapped.wmi_activity.consumer_command_line contains "-enc"
     or unmapped.wmi_activity.consumer_command_line contains "FromBase64String"
     or unmapped.wmi_activity.consumer_script_text contains "FromBase64String")

# Trigger types commonly used for persistence
class_uid = 201005
and (unmapped.wmi_activity.filter_query contains "__InstanceCreationEvent"
     or unmapped.wmi_activity.filter_query contains "Win32_LogonSession"
     or unmapped.wmi_activity.filter_query contains "__TimerEvent"
     or unmapped.wmi_activity.filter_query contains "Win32_ProcessStartTrace")

# Temporary subscriptions
class_uid = 201005 and activity_id = 1606

# Security-product enumeration through WMI
class_uid = 201005 and activity_id = 1602
and (unmapped.wmi_activity.filter_query contains "AntiVirusProduct"
     or unmapped.wmi_activity.filter_query contains "FirewallProduct")

# Subscription removal
class_uid = 201005 and activity_id = 1604

# One install, end to end
class_uid = 201005 and unmapped.wmi_activity.operation_id = "<id>"

6.12 Command Activity (201007)

Activities

Filter this class on class_uid = 201007.

Fields

Hunting

# Any remote interactive shell session
class_uid = 201007 and is_remote = true
# → unmapped.command_activity.remote_ip is the client address

# Host and domain enumeration typed into a shell
class_uid = 201007
and (unmapped.command_activity.input_command contains "whoami"
     or unmapped.command_activity.input_command contains "systeminfo"
     or unmapped.command_activity.input_command contains "ipconfig"
     or unmapped.command_activity.input_command contains "net user"
     or unmapped.command_activity.input_command contains "net group"
     or unmapped.command_activity.input_command contains "nltest"
     or unmapped.command_activity.input_command contains "arp -a")

# Credential-access commands
class_uid = 201007
and (unmapped.command_activity.input_command contains "lsass"
     or unmapped.command_activity.input_command contains "mimikatz"
     or unmapped.command_activity.input_command contains "reg save"
     or unmapped.command_activity.input_command contains "ntdsutil"
     or unmapped.command_activity.input_command contains "vssadmin")

# Commands that weaken defences or destroy recovery points
class_uid = 201007
and (unmapped.command_activity.input_command contains "wevtutil"
     or unmapped.command_activity.input_command contains "vssadmin delete"
     or unmapped.command_activity.input_command contains "bcdedit"
     or unmapped.command_activity.input_command contains "Set-MpPreference"
     or unmapped.command_activity.input_command contains "netsh advfirewall")

# Enumeration that actually returned data
class_uid = 201007
and unmapped.command_activity.input_command contains "net group"
and unmapped.command_activity.output_command != ""

# Full transcript of one shell session, in order
class_uid = 201007
and unmapped.command_activity.process_uuid = "<uuid>"
# sort by time

6.13 API Telemetry Activity (201008)

How to query this class. It is delivered as the context of a Detection Finding rather than as a standalone event:

`

class_uid = 2004 and associated_class_uid = 201008

`

Activities

One activity by design — the API identity travels in unmapped.api_telemetry.api_name and in type_name.

Fields

Data-handling note that shapes detections: buffer contents are not captured for the cryptography, compression and registry APIs. You get addresses, lengths, algorithm and mode names, and key or value names and types — not key material, plaintext or registry value data. Build detections on the call sequence, not on payload bytes.

Hooked APIs by purpose

Hunting

# The cross-process memory-and-thread sequence.
# Every hit is genuinely cross-process — self-operations are not reported.
class_uid = 2004 and associated_class_uid = 201008
and unmapped.api_telemetry.api_name in
    "ApiTelemetry_NtAllocateVirtualMemoryRemote",
    "ApiTelemetry_NtWriteVirtualMemoryRemote",
    "ApiTelemetry_NtProtectVirtualMemoryRemote",
    "ApiTelemetry_NtCreateRemoteThread"
# group by actor.process.uid and order by time to see the sequence

# A write directly into executable memory in another process
class_uid = 2004
and unmapped.api_telemetry.api_name = "ApiTelemetry_NtWriteVirtualMemoryRemoteExecutable"

# Credential-store reads
class_uid = 2004 and associated_class_uid = 201008
and (unmapped.api_telemetry.api_name contains "Cred"
     or unmapped.api_telemetry.api_name contains "Vault")

# Protected-data decryption
class_uid = 2004 and unmapped.api_telemetry.api_name = "ApiTelemetry_CryptUnprotectData"

# Symmetric key derivation and bulk decryption
class_uid = 2004 and associated_class_uid = 201008
and unmapped.api_telemetry.api_name in
    "ApiTelemetry_BCryptGenerateSymmetricKey","ApiTelemetry_BCryptDeriveKeyPBKDF2",
    "ApiTelemetry_BCryptDecrypt","ApiTelemetry_CryptDeriveKey","ApiTelemetry_CryptDecrypt"

# Unpacking and decoding
class_uid = 2004 and associated_class_uid = 201008
and (unmapped.api_telemetry.api_name contains "Decompress"
     or unmapped.api_telemetry.api_name contains "CryptStringToBinary"
     or unmapped.api_telemetry.api_name = "ApiTelemetry_FDICopy")

# Environment and anti-analysis probing
class_uid = 2004 and associated_class_uid = 201008
and unmapped.api_telemetry.api_name in
    "ApiTelemetry_NtQueryInformationProcess","ApiTelemetry_IsNativeVhdBoot",
    "ApiTelemetry_GlobalMemoryStatusEx","ApiTelemetry_GetLastInputInfo",
    "ApiTelemetry_NtDelayExecution","ApiTelemetry_BlockInput"

# Token duplication and impersonation
class_uid = 2004 and associated_class_uid = 201008
and unmapped.api_telemetry.api_name in
    "ApiTelemetry_NtDuplicateToken","ApiTelemetry_ImpersonateLoggedOnUser",
    "ApiTelemetry_SetThreadToken"

# Windows being hidden
class_uid = 2004 and unmapped.api_telemetry.api_name contains "NtUserShowWindow"

# Registry used as a payload store
class_uid = 2004 and associated_class_uid = 201008
and unmapped.api_telemetry.api_name in
    "ApiTelemetry_RegSetValueExW","ApiTelemetry_RegQueryValueExW"

# Search the arguments for a value
class_uid = 2004 and associated_class_uid = 201008
and unmapped.api_telemetry.parameter contains "lsass"

6.14 Volume Activity (201009)

Query as class_uid = 2004 and associated_class_uid = 201009. This class carries no file object, so a raw-device access is never confused with a regular file access.

Activities (normalised to the OCSF 0—99 range)

Fields

Hunting

# A write to the boot record
class_uid = 2004 and associated_class_uid = 201009
and activity_id = 3 and unmapped.volume.offset = 0

# Any raw write to a physical disk
class_uid = 2004 and associated_class_uid = 201009
and activity_id = 3 and unmapped.volume.raw_volume_type = "PhysicalDisk"

# Raw reads that bypass file permissions
class_uid = 2004 and associated_class_uid = 201009
and activity_id = 2 and unmapped.volume.raw_volume_type = "LogicalVolume"

# Shadow-copy access
class_uid = 2004 and associated_class_uid = 201009
and unmapped.volume.raw_volume_type = "VssShadow"

# Raw access from a process outside the system directory
class_uid = 2004 and associated_class_uid = 201009
and actor.process.file.path notcontains "System32"

# Large raw writes
class_uid = 2004 and associated_class_uid = 201009
and activity_id = 3 and unmapped.volume.length > 1048576

# Raw access to removable media
class_uid = 2004 and associated_class_uid = 201009
and unmapped.volume.device_characteristics >= 1
# test bit 0x1 in your platform

6.15 On-Write Scan Result Activity (201010)

Query as class_uid = 2004 and associated_class_uid = 201010.

Activities

Fields

Hunting

# Malicious binaries written to disk, with the writing process
class_uid = 2004 and associated_class_uid = 201010
and unmapped.on_write_scan_result.is_malware = 1
# → actor.process.* is the writer; file.path is the payload

# Unsigned executables written by a script engine
class_uid = 2004 and associated_class_uid = 201010
and unmapped.on_write_scan_result.is_signed = 0
and actor.process.name in "powershell.exe","wscript.exe","cscript.exe","mshta.exe","cmd.exe"

# Renamed binaries
class_uid = 2004 and associated_class_uid = 201010
and unmapped.on_write_scan_result.original_file_name != ""
and unmapped.on_write_scan_result.original_file_name != file.name

# High-confidence model detections
class_uid = 2004 and associated_class_uid = 201010
and unmapped.on_write_scan_result.confidence > 0.9

# .NET assemblies written to disk
class_uid = 2004 and associated_class_uid = 201010
and unmapped.on_write_scan_result.source_file_type = 4

# DLLs written outside the system directory
class_uid = 2004 and associated_class_uid = 201010
and unmapped.on_write_scan_result.source_file_type = 2
and file.path notcontains "\System32\"

6.16 Network Activity (4001)

Activities

Network events are reported as Traffic. Endpoints, ports, protocol and transferred volume are the fields to build on.

Fields

Direction semantics — source and destination are assigned from the endpoint's point of view:

Outbound (a browser reaching a website):
  connection_info.direction_id = 2
  src_endpoint.ip = 192.168.1.100    src_endpoint.port = 52431   ← local
  dst_endpoint.ip = 142.250.189.206  dst_endpoint.port = 443     ← remote

Inbound (a remote host reaching local file sharing):
  connection_info.direction_id = 1
  src_endpoint.ip = 10.0.0.50        src_endpoint.port = 49832   ← remote
  dst_endpoint.ip = 192.168.1.100    dst_endpoint.port = 445     ← local

For outbound hunting filter on dst_endpoint.*; for inbound hunting filter on src_endpoint.*.

Hunting

# Outbound TCP to uncommon ports
class_uid = 4001 and connection_info.direction_id = 2
and connection_info.protocol_name = "tcp"
and dst_endpoint.port notin 80,443,53,22,25,587,8080,8443,445,139,135,3389

# Script engines and utility binaries reaching the network
class_uid = 4001 and connection_info.direction_id = 2
and actor.process.name in "powershell.exe","wscript.exe","cscript.exe","mshta.exe",
    "rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe"

# Large outbound transfers
class_uid = 4001 and connection_info.direction_id = 2 and traffic.bytes > 50000000

# Inbound connections to a workstation
class_uid = 4001 and connection_info.direction_id = 1

# Connections to a specific address
class_uid = 4001 and dst_endpoint.ip = "203.0.113.42"

# ICMP traffic
class_uid = 4001 and connection_info.protocol_num in 1,58

# Regular small outbound connections — candidate beaconing.
# Group by dst_endpoint.ip + actor.process.uid and look for a high count
# of small, evenly spaced events.
class_uid = 4001 and connection_info.direction_id = 2 and traffic.bytes < 2000

# Outbound connections to administrative ports
class_uid = 4001 and connection_info.direction_id = 2
and dst_endpoint.port in 445,135,139,3389,5985,5986
and actor.process.name notin "svchost.exe","System","lsass.exe"

# Many distinct destination ports from one process — port scanning
class_uid = 4001 and connection_info.direction_id = 2
# group by actor.process.uid, count distinct dst_endpoint.port

6.17 DNS Activity (4003)

Activities

Fields

Hunting

# Long or high-entropy names, and high query volume per process.
# Both are the practical signals for name-based tunnelling.
class_uid = 4003 and activity_id = 401
# evaluate query.hostname length and entropy in your platform,
# and group by actor.process.uid to find volume outliers

# Bursts of failed resolutions from one process
class_uid = 4003 and activity_id = 402 and rcode_id = 3
# group by actor.process.uid, alert when the count exceeds ~50 in five minutes

# Resolution from a process that does not normally resolve names
class_uid = 4003 and activity_id = 401
and actor.process.name notin "svchost.exe","chrome.exe","firefox.exe","msedge.exe","dns.exe"

# Uncommon top-level domains
class_uid = 4003 and activity_id = 401
and (query.hostname endswith ".xyz" or query.hostname endswith ".top"
     or query.hostname endswith ".tk")

# Dynamic-DNS and tunnelling service providers
class_uid = 4003 and activity_id = 401
and (query.hostname contains "ngrok" or query.hostname contains "duckdns"
     or query.hostname contains "no-ip" or query.hostname contains "dynu"
     or query.hostname contains "trycloudflare")

# Resolution to a specific address
class_uid = 4003 and activity_id = 402 and answers.rdata contains "203.0.113.42"

# DNS over TCP
class_uid = 4003 and connection_info.protocol_name = "tcp"

# Non-standard DNS opcodes
class_uid = 4003 and query.opcode_id notin 0

# Every name one process resolved
class_uid = 4003 and actor.process.uid = "<uid>"

6.18 SMB Activity (4006)

Activities

Endpoint assignment — src_endpoint is always the SMB client (initiator) and dst_endpoint the SMB server (responder), regardless of which side this endpoint is on. The agent determines this from the request/response flag and the packet direction.

Fields

Hunting

# Who authenticated to this host over SMB, and as whom?
class_uid = 4006 and activity_id = 1802 and unmapped.smb.nt_status = 0
# → src_endpoint.ip = source host, dst_endpoint.owner.name = the account used

# New remote sessions established
class_uid = 4006 and unmapped.smb.is_session_create = true

# NTLM authentication where Kerberos would be expected
class_uid = 4006 and activity_id = 1802 and unmapped.smb.auth_protocol = "NTLMSSP"

# Legacy SMB1
class_uid = 4006 and unmapped.smb.is_smb1_protocol = true

# A downgraded dialect was selected
class_uid = 4006 and activity_id = 1801
and unmapped.smb.selected_dialect notin "0x0311","0x0302","0x0300"

# Failed SMB authentication, excluding the normal challenge leg
class_uid = 4006 and activity_id = 1802
and unmapped.smb.nt_status != 0 and unmapped.smb.nt_status != 3221225494

# Service principal names requested over SMB
class_uid = 4006 and dst_endpoint.svc_name != ""

# One client across sessions and addresses
class_uid = 4006 and unmapped.smb.client_guid = "<guid>"

# Full transcript of one remote session
class_uid = 4006 and unmapped.smb.session_uuid = "<uuid>"

# One host reaching many others over SMB — share discovery
class_uid = 4006 and connection_info.direction_id = 2
# group by src_endpoint.ip, count distinct dst_endpoint.ip

6.19 Authentication (3002)

Activities

Fields

Network logon note: inbound network connections have no existing session context on the receiving side, so the subject fields arrive empty or as a null SID. On failed network logons the agent omits user.domain and user.uid rather than reporting those placeholder values.

Hunting

# Repeated authentication failures against one account
class_uid = 3002 and status_id = 2
# group by user.name + src_endpoint.ip, alert on high counts in a short window

# One source failing against many accounts
class_uid = 3002 and status_id = 2 and logon_type_id = 3
# group by src_endpoint.ip, count distinct user.name

# A success following a run of failures from the same source
class_uid = 3002 and status_id = 1 and src_endpoint.ip = "<ip from the failures>"

# Remote desktop sessions
class_uid = 3002 and activity_id = 501 and logon_type_id = 10

# NTLM on a network logon where Kerberos is expected
class_uid = 3002 and activity_id = 501
and logon_type_id = 3 and auth_protocol_id = 1

# Service tickets issued with weak encryption
class_uid = 3002 and activity_id = 504
and unmapped.kerberos_ticket.ticket_encryption_type in
    "RC4-HMAC","RC4-HMAC-EXP","DES-CBC-CRC","DES-CBC-MD5"

# One account requesting tickets for many distinct services
class_uid = 3002 and activity_id = 504
# group by user.name, count distinct dst_endpoint.svc_name

# Ticket-granting tickets issued without pre-authentication
class_uid = 3002 and activity_id = 503
and unmapped.kerberos_ticket.pre_auth_type = "None"

# Kerberos password-guessing
class_uid = 3002 and activity_id = 506
and status_detail contains "Pre-authentication failed"

# Delegation-capable tickets
class_uid = 3002 and activity_id in 503,504
and unmapped.kerberos_ticket.ticket_options contains "Forwardable"
and unmapped.kerberos_ticket.ticket_options contains "Ok-As-Delegate"

# Clock-skew anomalies on ticket operations
class_uid = 3002 and status_detail contains "Clock skew"

# Machine accounts logging on interactively
class_uid = 3002 and activity_id = 501
and logon_type_id in 2,10 and user.name endswith "$"

# Logons using explicitly supplied alternate credentials
class_uid = 3002 and logon_type_id = 9

# What did that session go on to do?
session.uid = "<the logon's session.uid>"

6.20 Account Change (3001)

Activities

Computer-account events use activity_id = 1099 with activity_name = "Computer Object Created" or "Computer Object Deleted", and type_name = "Account Change: Computer Object Created" / "... Deleted". Filter on activity_name to separate them.

Fields

Hunting

# Accounts created
class_uid = 3001 and activity_id = 1001
# → actor.user.name is the creator, user.name is the new account

# Local accounts created
class_uid = 3001 and activity_id = 1001 and unmapped.is_local = true

# Accounts created by a script engine or command-line tool
class_uid = 3001 and activity_id = 1001
and actor.process.name in "powershell.exe","cmd.exe","wscript.exe","cscript.exe","net.exe","net1.exe"

# A new account carrying another account's SID history
class_uid = 3001 and activity_id = 1001 and unmapped.sid_history != ""

# A logon script assigned at creation
class_uid = 3001 and activity_id = 1001 and unmapped.script_path != ""

# Password reset performed by somebody other than the account owner
class_uid = 3001 and activity_id = 1006 and actor.user.name != user.name

# Accounts disabled or deleted
class_uid = 3001 and activity_id in 1003,1004

# Dormant accounts re-enabled
class_uid = 3001 and activity_id = 1002

# Lockout bursts
class_uid = 3001 and activity_id = 1005

# Computer accounts created
class_uid = 3001 and activity_id = 1099 and activity_name = "Computer Object Created"

# Attempted but denied account operations
class_uid = 3001 and status_id = 2

# What else happened in the same session?
session.uid = "<session identifier>"

6.21 User Access Management (3005)

Activities

Fields

Hunting

# All privilege assignment
class_uid = 3005 and activity_id = 1401

# Privileges that permit reading another process's memory
class_uid = 3005 and privileges contains "SeDebugPrivilege"

# Privileges that permit driver loading, ownership changes or full impersonation
class_uid = 3005
and (privileges contains "SeTcbPrivilege"
     or privileges contains "SeLoadDriverPrivilege"
     or privileges contains "SeTakeOwnershipPrivilege"
     or privileges contains "SeImpersonatePrivilege")

# Backup and restore rights, which bypass file permissions entirely
class_uid = 3005
and (privileges contains "SeBackupPrivilege" or privileges contains "SeRestorePrivilege")

# The right to run as a service
class_uid = 3005 and privileges contains "SeServiceLogonRight"

# The right to log on remotely
class_uid = 3005 and privileges contains "SeRemoteInteractiveLogonRight"

# A privilege granted to an account created in the same window
class_uid = 3005 and user.name = "<account from an Account Change event>"

6.22 Group Management (3006)

Activities

Member additions are collected.

Fields

Hunting

# All group membership additions
class_uid = 3006 and activity_id = 1103

# Additions to privileged groups
class_uid = 3006 and activity_id = 1103
and group.name in "Administrators","Domain Admins","Enterprise Admins",
    "Schema Admins","Backup Operators","Account Operators","Server Operators",
    "Print Operators","Remote Desktop Users","DnsAdmins","Group Policy Creator Owners"

# A local administrator added on a workstation
class_uid = 3006 and activity_id = 1103
and group.name = "Administrators" and unmapped.is_local = true

# Group changes made from a command line rather than a management console
class_uid = 3006 and activity_id = 1103
and actor.process.name in "powershell.exe","cmd.exe","net.exe","net1.exe","wscript.exe"

# The full sequence — account created, added to a group, granted privileges.
# Pivot on the logon session or on the account name.
session.uid = "<session identifier>"

6.23 Detection Finding (2004)

Activities

How a finding is assembled — this shapes how you query it:

1. The origin event's OCSF form is built.
2. That entire event is copied, so every context field travels with the finding: actor, process, file, file_result, reg_key, reg_value, src_endpoint, dst_endpoint, connection_info, traffic, url, query, answers, module, job, win_service, script, unmapped.*, device, metadata.
3. The origin's class is captured into associated_class_uid / associated_class_name.
4. The finding taxonomy is applied: class_uid = 2004, category_uid = 2, type_uid = 200401, activity_id = 1901.
5. finding_info is populated from the rule definition.
6. The same dpid as the origin event is applied.

A finding is self-contained: you do not need the origin event to understand what happened. You do need associated_class_uid to know which context fields to read.

Fields

finding_info is populated from the rule definition held on the endpoint. Where the definition is not present locally, the finding is still emitted — carrying severity_id = 2 and the origin context — with finding_info empty.

Findings that ride on the origin event: two rules — identifiers 90001 and 2156622 — attach finding_info to the origin event and keep that event's own class, rather than producing a separate finding. A complete finding sweep is therefore:

class_uid = 2004 or finding_info.uid != "" or type_name = "yara_detection_event"

Hunting

# The triage entry query
class_uid = 2004
and device.hostname = "WORKSTATION-01"
and time >= <start ms> and time <= <end ms + 60000>
# Read: finding_info.title, finding_info.analytic.desc, associated_class_name, dpid

# Findings for a specific rule, across the estate
finding_info.uid = "<rule uid>"

# Findings by rule name
class_uid = 2004 and finding_info.title contains "Encoded"

# Which findings came from WMI activity?
class_uid = 2004 and associated_class_uid = 201005

# Findings whose evidence is an API call
class_uid = 2004 and associated_class_uid = 201008

# Findings mapped to a given technique or tactic
class_uid = 2004 and finding_info.attacks.technique.uid = "T1055"
class_uid = 2004 and finding_info.attacks.tactic.name = "Persistence"

# What is firing most, and from which activity classes?
class_uid = 2004
# group by finding_info.title, then by associated_class_name

# Findings without a rule definition attached
class_uid = 2004 and finding_info.uid = ""

# Findings attached to their origin event
class_uid != 2004 and finding_info.uid != ""

# From a finding to the whole chain (keep the host filter — dpid is per-endpoint)
device.hostname = "WORKSTATION-01" and dpid = <the finding's dpid>

6.24 YARA Detection

How to filter this event. YARA detections are identified by their type_name; the numeric classification fields (class_uid, type_uid, activity_id) are not used for this event, and severity is carried in the severity string and in yara_detection.severity. Filter on type_name or on a yara_detection.* field:

`

type_name = "yara_detection_event"

`

Fields

Each matched rule produces its own event, so one file matching three rules yields three events. Every rule metadata attribute is a separately indexed field rather than a single concatenated description, so any of them can be filtered directly.

Hunting

# All YARA detections in the window
type_name = "yara_detection_event"

# By threat or family name
type_name = "yara_detection_event" and yara_detection.threat_name contains "Agent"

# By a specific rule
yara_detection.rule_name = "<rule name>"

# High-severity rule matches
type_name = "yara_detection_event" and yara_detection.severity in "critical","high"

# By rule category
type_name = "yara_detection_event" and yara_detection.category_name contains "ransomware"

# Every rule that matched one file
type_name = "yara_detection_event" and file.path = "C:\Temp\sample.exe"

# The same file across the estate, by hash
type_name = "yara_detection_event" and file.hashes.value = "<sha256>"

# Pivot to what the associated process did
actor.process.uid = "<uid from the YARA event>"

6.25 Browser classes: HTTP (4002), Web Resources (6001), App Lifecycle (6002), Security Finding (2001)

Envelope differences from other classes:

• category_uid, category_name, severity_id, severity, status_id, status, time, timezone_offset, type_uid and type_name come from the browser payload rather than from the agent's defaults.
• No observables array is added.
• metadata is supplied by the browser payload, so metadata.product may describe the browser or the extension.
• actor.process is the browser process, enriched from the browser-reported pid and UUID.

Activity offsets — the browser reports a small activity identifier and the agent applies a class-specific offset:

type_uid and type_name pass through from the browser payload, e.g. 400201 with "HTTP Activity: Open".

6.25.1 HTTP Activity (4002)

# Executables downloaded through the browser
class_uid = 4002 and action = "Download"
and (http_activity_fields.file_name endswith ".exe"
     or http_activity_fields.file_name endswith ".dll"
     or http_activity_fields.file_name endswith ".ps1"
     or http_activity_fields.file_name endswith ".hta"
     or http_activity_fields.file_name endswith ".scr")

# Large uploads
class_uid = 4002 and action = "Upload" and http_activity_fields.file_size > 10000000

# Blocked by the web filter — the attempt still happened
class_uid = 4002 and action in "WebFilterBlocked","DownloadBlocked","UploadBlocked"

# Downloads from a bare address rather than a domain name
class_uid = 4002 and action = "Download"
and http_request.url.domain = ""

6.25.2 Web Resources Activity (6001)

6.25.3 Application Lifecycle (6002) — browser extensions

# Extensions installed
class_uid = 6002 and ext_lifecycle_fields.ext_event = "Install"

# Extensions able to read every page
class_uid = 6002 and ext_lifecycle_fields.ext_host_perms contains "<all_urls>"

# Extensions updating from outside an official store
class_uid = 6002 and ext_lifecycle_fields.ext_event = "Install"
and ext_lifecycle_fields.ext_update_url notcontains "google.com"
and ext_lifecycle_fields.ext_update_url notcontains "microsoft.com"

# High-impact permission requests
class_uid = 6002
and (ext_lifecycle_fields.ext_permissions contains "webRequest"
     or ext_lifecycle_fields.ext_permissions contains "cookies"
     or ext_lifecycle_fields.ext_permissions contains "clipboardRead"
     or ext_lifecycle_fields.ext_permissions contains "nativeMessaging"
     or ext_lifecycle_fields.ext_permissions contains "debugger")

6.25.4 Security Finding (2001) — browser-threat findings

Two related events are produced: the detection itself, and — where the page placed a command on the clipboard — a follow-up carrying that content. Both share unmapped.detection_time, which correlates them.

# All browser-threat findings
class_uid = 2001

# Findings that captured clipboard content
class_uid = 2001 and unmapped.copied_command != ""

# Clipboard content that would run a command interpreter
class_uid = 2001
and (unmapped.copied_command contains "powershell"
     or unmapped.copied_command contains "-enc"
     or unmapped.copied_command contains "mshta"
     or unmapped.copied_command contains "curl")

# Did the content actually run? Take a distinctive fragment of
# copied_command and look for it in execution telemetry:
class_uid = 1007 and activity_id = 1 and process.cmd_line contains "<fragment>"
class_uid = 1009 and script.content contains "<fragment>"

# High-scoring detections only
class_uid = 2001 and unmapped.score_clickfix > 150

# By detector family
class_uid = 2001 and unmapped.threat_type = "pastejacking"

# Correlate a detection with its clipboard follow-up
class_uid = 2001 and unmapped.detection_time = <value>

7. Hunting Index — What You Want to Find → Where to Look

Use this when you know the behaviour you are looking for and need the class and field that record it.

Where a rule already covers the behaviour, class_uid = 2004 gives you the verdict and the evidence in one row. This index is what you use when no rule fired, when you are hunting proactively, or when you want the raw activity behind a finding.

7.1 Execution — what ran and how

7.2 Persistence — what will run again later

7.3 Privilege and access changes

7.4 Evasion and interference with monitoring

7.5 Cross-process memory and image manipulation

7.6 Credential and secret access

7.7 Discovery and enumeration

7.8 Lateral movement

7.9 Collection, staging and exfiltration

7.10 Network activity and outbound command channels

7.11 Destructive and disruptive activity

7.12 Files and binaries

8. Hunting Playbooks

Each playbook assumes you have already scoped to a host and window:

device.hostname = "WORKSTATION-01" and time >= <start> and time < <end + 60000>

8.1 Profiling a suspicious process

You have a process name, pid, hash or UUID and want to know everything it did.

# 1. Find the launch event and capture process.uid
class_uid = 1007 and activity_id = 1
and process.name = "<name>"          # or process.file.sha256 = "<hash>"

# 2. Everything that process instance did, across all classes
actor.process.uid = "<process.uid from step 1>"

# 3. Break it down by class
class_uid = 1001 and actor.process.uid = "<uid>"    # files
class_uid = 201002 and actor.process.uid = "<uid>"  # registry values
class_uid = 4001 and actor.process.uid = "<uid>"    # network
class_uid = 4003 and actor.process.uid = "<uid>"    # name resolution
class_uid = 1005 and actor.process.uid = "<uid>"    # modules loaded
class_uid = 1009 and actor.process.uid = "<uid>"    # script content

# 4. Where did it come from? Read process.parent_process.* and
#    actor.process.* on the launch event, then walk upward:
class_uid = 1007 and process.uid = "<the parent's uid>"

# 5. What did its children do?
actor.process.lineage_uid contains "<uid>"

# 6. Any verdicts against it?
class_uid in 2004,201003 and actor.process.uid = "<uid>"

# 7. The whole chain it belongs to
<scope> and dpid = <the dpid from any of its events>

8.2 Investigating persistence on a host

# 1. Sweep every persistence-bearing class at once
class_uid in 1006,201004,201005,201002 and <scope>

# 2. Scheduled tasks
class_uid = 1006 and activity_id in 1,2
# read: job.name, job.cmd_line, job.file.path, job.run_as.name,
#       unmapped.scheduled_job.scheduled_job_visibility,
#       unmapped.scheduled_job.scheduled_job_privilege,
#       unmapped.scheduled_job.scheduled_job_triggers,
#       actor.process.name  (who registered it)

# 3. Services
class_uid = 201004 and activity_id in 1,2
# read: win_service.name, win_service.service_file.path,
#       win_service.service_start_name, win_service.service_start_type,
#       win_service.service_type_id,
#       unmapped.win_service_lifecycle.persistence_flags,
#       actor.process.name  (the SCM caller)

# 4. WMI subscriptions — check the install and the execution
class_uid = 201005 and activity_id in 1603,1605,1609
# read: unmapped.wmi_activity.filter_query          (the trigger)
#       unmapped.wmi_activity.consumer_type
#       unmapped.wmi_activity.consumer_command_line (the payload)
#       unmapped.wmi_activity.consumer_script_text
# 1605 = the binding went live; 1609 = it actually ran

# 5. Registry autostart values, with the payload
class_uid = 201002 and activity_id = 203
and reg_value.path contains "currentversion\run"
# read: reg_value.name, reg_value.reg_string_data

# 6. Startup-folder files
class_uid = 1001 and activity_id in 6,8
and file.path contains "\Start Menu\Programs\Startup"

# 7. Who did all of this, and what else did they do?
<scope> and dpid = <from any of the above>
session.uid = "<from any event that carries one>"

Checklist

• [ ] Is the payload captured (job.cmd_line / reg_value.reg_string_data / consumer_command_line)?
• [ ] Is the registering caller attributed (actor.process.name)?
• [ ] For WMI, did you get both the install and the delivery event?
• [ ] Does the persistence run as a privileged account (job.run_as, win_service.service_start_name)?
• [ ] Does session.uid join back to a logon?

8.3 Investigating credential access

# 1. Behaviour verdicts
class_uid = 201003
and (message contains "LSASS_OPEN_HANDLE" or message contains "LSASS_REMOTE_THREAD"
     or message contains "ReplicatingDirectoryChanges")

# 2. API-level evidence
class_uid = 2004 and associated_class_uid = 201008
and (unmapped.api_telemetry.api_name contains "Cred"
     or unmapped.api_telemetry.api_name contains "Vault"
     or unmapped.api_telemetry.api_name = "ApiTelemetry_CryptUnprotectData")

# 3. Registry hive saved to file
class_uid = 201001 and activity_id = 102 and status_detail = "Save Key"

# 4. Raw volume or shadow-copy reads
class_uid = 2004 and associated_class_uid = 201009
and unmapped.volume.raw_volume_type in "VssShadow","LogicalVolume"

# 5. Prerequisite privileges granted
class_uid = 3005
and (privileges contains "SeDebugPrivilege" or privileges contains "SeBackupPrivilege")

# 6. Commands typed
class_uid = 201007
and (unmapped.command_activity.input_command contains "lsass"
     or unmapped.command_activity.input_command contains "reg save"
     or unmapped.command_activity.input_command contains "vssadmin"
     or unmapped.command_activity.input_command contains "ntdsutil")

# 7. Scripted access
class_uid = 1009
and (script.content contains "MiniDumpWriteDump" or script.content contains "sekurlsa"
     or script.content contains "lsass")

# 8. Output artefacts written
class_uid = 1001 and activity_id in 6,8
and (file.ext in "dmp","dit","hive","bin" or file.name contains "lsass")

# 9. Authentication anomalies that follow
class_uid = 3002 and <scope>

8.4 Investigating cross-process memory activity

# 1. Behaviour verdicts
class_uid = 201003
and (message contains "INJECTION" or message contains "HOLLOWING"
     or message contains "SHELLCODE_INJECTED" or message contains "REFLECTIVE"
     or message contains "THREAD_EXECUTION_HIJACK" or message contains "MODULE_STOMPING")

# 2. The API sequence — every hit is against a foreign process
class_uid = 2004 and associated_class_uid = 201008
and unmapped.api_telemetry.api_name in
    "ApiTelemetry_NtAllocateVirtualMemoryRemote",
    "ApiTelemetry_NtWriteVirtualMemoryRemote",
    "ApiTelemetry_NtWriteVirtualMemoryRemoteExecutable",
    "ApiTelemetry_NtProtectVirtualMemoryRemote",
    "ApiTelemetry_NtCreateRemoteThread",
    "ApiTelemetry_NtUnmapViewOfSectionRemote"
# order by time, group by actor.process.uid — you should see
# allocate → write → protect → create-thread

# 3. Processes created suspended
class_uid = 2004 and associated_class_uid = 201008
and unmapped.api_telemetry.api_name contains "Suspended"

# 4. Both sides of the pair
class_uid = 201003
and (message contains "\"isInjector\": true" or message contains "\"isInjectee\": true")

# 5. Modules that appeared in the target afterwards
class_uid = 1005 and actor.process.uid = "<target uid>"

# 6. What the target process then did
actor.process.uid = "<target uid>"

# 7. The whole chain
<scope> and dpid = <from step 1 or 2>

8.5 Investigating lateral movement into a host

# 1. Who authenticated in, as whom, and how?
class_uid = 3002 and activity_id = 501 and is_remote = true
# read: user.name, src_endpoint.ip, logon_type_id, auth_protocol_id, session.uid

# 2. SMB session detail — protocol and identity
class_uid = 4006 and activity_id = 1802
# read: src_endpoint.ip, dst_endpoint.owner.name,
#       unmapped.smb.auth_protocol, unmapped.smb.is_smb1_protocol,
#       unmapped.smb.client_guid

# 3. Files that arrived over the network
class_uid = 1001 and is_remote = true and activity_id in 6,8
# read: file.path, src_endpoint.ip

# 4. Execution mechanisms
class_uid = 1007 and activity_id = 1 and is_remote = true      # remote process creation
class_uid = 201004 and activity_id = 1 and is_remote = true    # remote service creation
class_uid = 201005 and activity_id in 1602,1603                # remote WMI operations

# 5. Interactive shell that followed
class_uid = 201007 and is_remote = true

# 6. Everything done in that logon session
session.uid = "<from step 1>"

# 7. Where did they go next?
class_uid = 4001 and connection_info.direction_id = 2
and dst_endpoint.port in 445,135,139,3389,5985,5986
and actor.process.uid = "<uid of what they ran>"

8.6 Investigating destructive or encryption activity

# 1. Behaviour verdict
class_uid = 201003
and (message contains "RANSOMWARE_DETECTION" or message contains "OBFUSCATED_FILE_ENCRYPTED")

# 2. Bulk renames that changed the extension
class_uid = 1001 and activity_id = 10 and file.ext != file_result.ext
# group by actor.process.uid, count — a sharp spike is the signal

# 3. Cryptography sequence
class_uid = 2004 and associated_class_uid = 201008
and unmapped.api_telemetry.api_name in
    "ApiTelemetry_BCryptGenerateSymmetricKey","ApiTelemetry_BCryptDeriveKeyPBKDF2",
    "ApiTelemetry_BCryptDecrypt","ApiTelemetry_CryptDeriveKey","ApiTelemetry_CryptDecrypt"

# 4. Recovery interference
class_uid = 201003 and message contains "VSS_TAMPER_PROTECTION"

class_uid = 201007
and (unmapped.command_activity.input_command contains "vssadmin delete"
     or unmapped.command_activity.input_command contains "wbadmin delete"
     or unmapped.command_activity.input_command contains "bcdedit")

class_uid = 201004 and activity_id = 4 and win_service.name in "VSS","SQLWriter","BITS"

# 5. Boot-record or bulk raw writes
class_uid = 2004 and associated_class_uid = 201009
and activity_id = 3 and unmapped.volume.offset = 0

# 6. Reboot, and any comment left on it
class_uid = 1011 and unmapped.device_power_state.comment != ""

# 7. Note files dropped
class_uid = 1001 and activity_id in 6,8
and (file.name contains "README" or file.name contains "DECRYPT"
     or file.name contains "RECOVER")

# 8. The full chain and the entry point
<scope> and dpid = <from step 1 or 2>

8.7 Building a coverage picture

Useful when validating a control, reviewing detection quality, or sanity-checking a quiet window.

# Which classes produced data on this host?
<scope>
# group by class_uid — cross-check the result against the
# collection scope in Section 3

# What is firing, and from which activity classes?
class_uid = 2004 and <scope>
# group by finding_info.title, then by associated_class_name

# How many distinct activity chains were identified?
class_uid = 2004 and <scope> and dpid != 0
# count distinct dpid

# Rule versions in play — useful when comparing two time periods
class_uid = 2004 and <scope>
# group by finding_info.analytic.version

# Delivery batches covering the window
<scope>
# group by batch_name, order by time

9. Complete Enum Reference

9.1 activity_id — by class

Always pair activity_id with class_uid.

Two numbering conventions are in use. Classes whose activity vocabulary maps onto the OCSF canonical list report the OCSF 0—99 identifier: 1001, 1006, 1007, 1011, 201004 and 201009. The remaining classes report a namespaced identifier drawn from a per-class block. Both are stable; read the values from the table above and always qualify them with class_uid.

9.2 class_uid — event class

YARA detections are identified by type_name = "yara_detection_event" — see 6.24.

9.3 category_uid — event category

Network Activity (4001) and DNS Activity (4003) are categorised as System Activity; SMB Activity (4006) is categorised as Network Activity. Filter on class_uid rather than category_uid when selecting network telemetry.

9.4 type_uid — composite event type

type_uid = class_uid × 100 + ocsf_activity_id.

Suspicious Behaviour Activity (201003) and Command Activity (201007) are filtered by class_uid; they do not carry a type_uid.

9.5 severity_id — event severity

YARA detections carry their severity in the severity string and in yara_detection.severity.

9.6 status_id — activity status

9.7 logon_type_id — Windows logon type

Authentication (3002) only.

is_remote = true is set for types 3, 8, 10 and 12. Windows does not use logon type 6.

9.8 auth_protocol_id — authentication protocol

Read the raw string in auth_protocol when you need to distinguish Negotiate from Kerberos proper.

9.9 rcode_id — DNS response code

9.10 query.opcode_id — DNS operation code

9.11 connection_info enums

direction_id: 0 Unknown, 1 Inbound, 2 Outbound, 3 Lateral, 4 Local.

protocol_num (IANA): 0 HOPOPT, 1 ICMP, 6 TCP, 17 UDP, 58 ICMPv6.

protocol_ver_id: 4 IPv4, 6 IPv6.

9.12 user.type_id — account type

Applies to user, actor.user, process.user, actor.process.user, process.parent_process.user, job.run_as and dst_endpoint.owner.

9.13 file.type_id — file type

To identify directory creation specifically, use File Activity activity_id = 20.

9.14 hashes[].algorithm_id — hash algorithm

9.15 reg_value.type_id — registry value type

9.16 script.type_id — script type

9.17 observables[].type_id — observable type

9.18 device.type_id and device.os.type_id

device.type_id: 0 Unknown, 1 Server, 2 Desktop, 3 Laptop, 4 Tablet, 5 Mobile, 6 Virtual, 7 IoT, 8 Browser, 9 Firewall, 10 Switch, 11 Hub, 12 Router, 13 IDS, 14 IPS, 15 Load Balancer, 99 Other.

device.os.type_id: 0 Unknown, 99 Other, 100 Windows, 101 Windows Mobile, 200 Linux, 201 Android, 300 macOS, 301 iOS, 302 iPadOS, 400 Solaris, 401 AIX, 402 HP-UX.

To segment an estate by platform, device.os.version and your asset inventory are the most reliable inputs.

9.19 module.load_type_id — module load type

For the technique behind a load, use Suspicious Behaviour Activity (201003) and API Telemetry Activity (201008).

9.20 win_service enums

service_start_type_id: 0 Unknown, 1 Boot, 2 System, 3 Auto, 4 Demand, 5 Disabled, 99 Other.

service_type_id: 0 Unknown, 1 Kernel driver, 2 Filesystem driver, 3 Own process, 4 Share process, 5 Recognizer driver, 6 Adapter, 99 Other. Caption modifiers appended to service_type: " [user service]", " [user-service instance]", " [interactive]", " [packaged]".

service_category_id: 0 Unknown, 1 Kernel Mode (types 1, 2, 5, 6), 2 User Mode (types 3, 4), 99 Other.

9.21 unmapped.volume enums

raw_volume_type (string): "PhysicalDisk", "LogicalVolume", "VssShadow", "Unknown".

fs_type (string): "RAW", "NTFS", "FAT", "EXFAT", "REFS", "CDFS", "UDFS", "LANMAN", "WEBDAV", "RDPDR", "NFS", "MUP", "CSVFS", "NPFS", "MSFS", "GPFS", "PSFS", "OPENAFS", "CIMFS", and others; "Unknown" where unmapped.

device_characteristics (bitmask): 0x1 removable media, 0x2 read-only, 0x4 floppy, 0x8 write-once, 0x10 remote/network device, 0x20 mounted, 0x40 virtual volume, 0x80 autogenerated name, 0x100 secure open, 0x800 plug-and-play, 0x1000 terminal-services device, 0x2000 WebDAV device.

operation (un-normalised): 2500 Unknown, 2501 Open, 2502 Read, 2503 Write.

9.22 unmapped.on_write_scan_result.source_file_type

9.23 finding_info.analytic.type_id

10. Field Types and Search Operators

10.1 Field types

String[] fields: process.lineage_uid, actor.process.lineage_uid, privileges, unmapped.sid_history, unmapped.scheduled_job.scheduled_job_triggers, unmapped.win_service_lifecycle.persistence_flags, win_service.service_dependencies, finding_info.types, finding_info.analytic.data_sources, reg_value.reg_string_list_data, ext_lifecycle_fields.ext_permissions, ext_lifecycle_fields.ext_host_perms, unmapped.emails.

JSONArray fields: observables, answers, finding_info.attacks, unmapped.analytic_steps, web_resources, web_resources_result, and every hashes array.

10.2 Search operators

spanNear syntax:

field spanNear ("term1","term2"[,distance[,ordered]])

process.cmd_line spanNear ("powershell","hidden",10,false)
script.content   spanNear ("Invoke-Expression","Base64",30,false)
process.cmd_line spanNear ("certutil","decode",5,true)

10.3 Boolean logic

Combine with and, or, not; use parentheses to control precedence.

class_uid = 1007
and activity_id = 1
and actor.process.user.type_id = 3
and process.name = "powershell.exe"
class_uid = 1001
and (file.ext = "exe" or file.ext = "ps1")
and file.path contains "Temp"
class_uid = 3002
and status_id = 2
and not src_endpoint.ip = "192.168.1.10"

10.4 Time-range patterns

Every timestamp is epoch milliseconds.

# A specific 24-hour window
time >= 1704067200000 and time < 1704153600000

# A window with a short tail so trailing findings are included
time >= 1704067200000 and time <= 1704070860000

# Scope by process creation time
actor.process.created_time >= 1704067200000
and actor.process.created_time < 1704153600000

# Name-resolution events in a range
class_uid = 4003 and query_time >= 1704067200000 and query_time < 1704153600000

DateTime fields by class:

Schema: OCSF — metadata.version reports 1.3.0, with OCSF 1.7/1.8 object shapes and nine private extension classes in the 201xxx range Product:Endpoint CentralEvent classes documented: 27, plus YARA detections