Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry

Elastic Stack Beats
1

Hello,

Just noticed something weird with Sysmon configuration in 7.11 (registry events)

image
image1656×421 63.7 KB

As you can see, the actual value of the registry key is in winlog.event_data.Details while imho this should be in registry.value? or at least the part within paranthese..

In a Sysmon event this is set under details:

Registry value set:
RuleName: Suspicious,ImageBeginWithBackslash
EventType: SetValue
UtcTime: 2021-05-22 14:00:07.137
ProcessGuid: {afbc1ce0-0e67-60a9-b709-00000000c900}
ProcessId: 13248
Image: C:\WINDOWS\regedit.exe
TargetObject: HKLM\SOFTWARE\Digipolis\BeheerCredProv\LinkCaption
Details: Wachtwoord vergeten of account geblokkeerd?

In the above example registry.value should be Wachtwoord vergeten of account geblokkeerd? ?

But in 7.11 registry.value is set to LinkCaption..

Best regards,

Willem

2

Anyone?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.