Data Source: Sysmon EventID 7

Created: 2024-05-22

Last Updated: 2026-10-14

ID: 45512fa5-4d55-4088-9d51-f4dedc16fdff

Author: Patrick Bareiss, Splunk

Description

Logs the loading of an image (module) into a process, including details about the image name, file path, and hash information.

Details

Property	Value
Source	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sourcetype	`XmlWinEventLog`
Separator	EventID

Name ▲▼	Technique ▲▼	Type ▲▼
Windows MMC Loaded Script Engine DLL	Reflective Code Loading	Anomaly
Windows Hijack Execution Flow Version Dll Side Load	DLL	Anomaly
MSI Module Loaded by Non-System Binary	DLL	Hunting
Windows NetSupport RMM DLL Loaded By Uncommon Process	Masquerading	Anomaly
Windows DLL Search Order Hijacking Hunt with Sysmon	DLL	Hunting
Windows Scheduled Task DLL Module Loaded	Scheduled Task/Job	TTP
Windows Devtunnels Image Loaded	Proxy	Anomaly
Windows Unsigned DLL Side-Loading	DLL	Anomaly
Windows SqlWriter SQLDumper DLL Sideload	DLL	TTP
CMLUA Or CMSTPLUA UAC Bypass	CMSTP	TTP
Windows Remote Access Software BRC4 Loaded Dll	OS Credential Dumping, Remote Access Tools	Anomaly
Windows Office Product Loading Taskschd DLL	Spearphishing Attachment	Anomaly
Windows Unusual Process Load Mozilla NSS-Mozglue Module	CMSTP	Anomaly
Windows BitDefender Submission Wizard DLL Sideloading	Hijack Execution Flow	TTP
Windows SpeechRuntime COM Hijacking DLL Load	Distributed Component Object Model	TTP
Windows Input Capture Using Credential UI Dll	GUI Input Capture	Hunting
UAC Bypass With Colorui COM Object	CMSTP	TTP
Wbemprox COM Object Execution	CMSTP	TTP
Windows Gather Victim Identity SAM Info	Credentials	Hunting
Windows Unsigned MS DLL Side-Loading	Boot or Logon Autostart Execution, DLL	Anomaly
Loading Of Dynwrapx Module	Dynamic-link Library Injection	TTP
UAC Bypass MMC Load Unsigned Dll	MMC, Bypass User Account Control	TTP
Windows Known GraphicalProton Loaded Modules	DLL	Anomaly
Sunburst Correlation DLL and Network Event	Exploitation for Client Execution	TTP
MS Scripting Process Loading Ldap Module	JavaScript	Anomaly
Windows InstallUtil Credential Theft	InstallUtil	TTP
Windows Credentials Access via VaultCli Module	Windows Credential Manager	Anomaly
Windows Office Product Loading VBE7 DLL	Spearphishing Attachment	Anomaly
Windows DLL Side-Loading In Calc	DLL	TTP
MS Scripting Process Loading WMI Module	JavaScript	Anomaly
Windows Unsigned DLL Side-Loading In Same Process Path	DLL	TTP
Windows Remote Image Load	Command and Scripting Interpreter, Exploitation for Privilege Escalation, Shared Modules, Exploitation for Client Execution	Anomaly
Windows DLL Module Loaded in Temp Dir	Ingress Tool Transfer	Hunting
Windows Cloud Files Filter Loaded by Uncommon Process	Windows Service	Anomaly
Windows Executable in Loaded Modules	Shared Modules	TTP
Windows Office Product Loaded MSHTML Module	Spearphishing Attachment	Anomaly
Windows Known Abused DLL Loaded Suspiciously	DLL	TTP
Spoolsv Suspicious Loaded Modules	Print Processors	TTP
Windows Defender MpClient.dll Loaded by Non-Defender Process	Exploitation for Privilege Escalation	Anomaly

Supported Apps

Splunk Add-on for Sysmon (version 5.0.1)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">Channel</span>
  
  <span class="pill kill-chain">Company</span>
  
  <span class="pill kill-chain">Computer</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">Description</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">dvc_nt_host</span>
  
  <span class="pill kill-chain">event_id</span>
  
  <span class="pill kill-chain">EventChannel</span>
  
  <span class="pill kill-chain">EventCode</span>
  
  <span class="pill kill-chain">EventData_Xml</span>
  
  <span class="pill kill-chain">EventDescription</span>
  
  <span class="pill kill-chain">EventID</span>
  
  <span class="pill kill-chain">EventRecordID</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">FileVersion</span>
  
  <span class="pill kill-chain">Guid</span>
  
  <span class="pill kill-chain">Hashes</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">Image</span>
  
  <span class="pill kill-chain">ImageLoaded</span>
  
  <span class="pill kill-chain">IMPHASH</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">Keywords</span>
  
  <span class="pill kill-chain">Level</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">loaded_file</span>
  
  <span class="pill kill-chain">loaded_file_path</span>
  
  <span class="pill kill-chain">MD5</span>
  
  <span class="pill kill-chain">Name</span>
  
  <span class="pill kill-chain">Opcode</span>
  
  <span class="pill kill-chain">original_file_name</span>
  
  <span class="pill kill-chain">OriginalFileName</span>
  
  <span class="pill kill-chain">os</span>
  
  <span class="pill kill-chain">process_exec</span>
  
  <span class="pill kill-chain">process_guid</span>
  
  <span class="pill kill-chain">process_hash</span>
  
  <span class="pill kill-chain">process_id</span>
  
  <span class="pill kill-chain">process_name</span>
  
  <span class="pill kill-chain">process_path</span>
  
  <span class="pill kill-chain">ProcessGuid</span>
  
  <span class="pill kill-chain">ProcessID</span>
  
  <span class="pill kill-chain">ProcessId</span>
  
  <span class="pill kill-chain">Product</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">RecordID</span>
  
  <span class="pill kill-chain">RecordNumber</span>
  
  <span class="pill kill-chain">RuleName</span>
  
  <span class="pill kill-chain">SecurityID</span>
  
  <span class="pill kill-chain">service_dll_signature_exists</span>
  
  <span class="pill kill-chain">service_dll_signature_verified</span>
  
  <span class="pill kill-chain">severity</span>
  
  <span class="pill kill-chain">severity_id</span>
  
  <span class="pill kill-chain">SHA256</span>
  
  <span class="pill kill-chain">Signature</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">signature_id</span>
  
  <span class="pill kill-chain">SignatureStatus</span>
  
  <span class="pill kill-chain">Signed</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">System_Props_Xml</span>
  
  <span class="pill kill-chain">SystemTime</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::action</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">Task</span>
  
  <span class="pill kill-chain">TaskCategory</span>
  
  <span class="pill kill-chain">ThreadID</span>
  
  <span class="pill kill-chain">TimeCreated</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">User</span>
  
  <span class="pill kill-chain">user</span>
  
  <span class="pill kill-chain">user_id</span>
  
  <span class="pill kill-chain">UserID</span>
  
  <span class="pill kill-chain">UtcTime</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
  <span class="pill kill-chain">Version</span>
  
</div>

Example Log

1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>7</EventID><Version>3</Version><Level>4</Level><Task>7</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-08-14T16:03:24.3068421Z'/><EventRecordID>12799</EventRecordID><Correlation/><Execution ProcessID='3376' ThreadID='4340'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>EC2AMAZ-FKEOM7G</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2026-08-14 16:03:24.305</Data><Data Name='ProcessGuid'>{1b43529b-3c4c-6a7f-c904-000000006300}</Data><Data Name='ProcessId'>8748</Data><Data Name='Image'>C:\Users\Administrator\Desktop\ShieldBreak.exe</Data><Data Name='ImageLoaded'>C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0\MpClient.dll</Data><Data Name='FileVersion'>4.18.26070.9 (797b3603749206dfffe67a1cc891531b0a2cf438)</Data><Data Name='Description'>Client Interface</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>mpclient.dll</Data><Data Name='Hashes'>MD5=BD542955CA16303D5042FA6C519470F6,SHA256=F5BB3463A94C4D87CC90691B474126F5EC1330579DD596F381322C3DAF7F44DC,IMPHASH=E8D5A007E0A362B0C7263E95E1F2C82A</Data><Data Name='Signed'>true</Data><Data Name='Signature'>Microsoft Windows</Data><Data Name='SignatureStatus'>Valid</Data><Data Name='User'>EC2AMAZ-FKEOM7G\Administrator</Data></EventData></Event>

Required Output Fields

Image
ImageLoaded
dest
loaded_file
loaded_file_path
process_exec
process_guid
process_hash
process_id
process_name
process_path
service_dll_signature_exists
service_dll_signature_verified
signature
signature_id
user_id
vendor_product

Source: GitHub | Version: 5