Processes and program runs

Kind

Event - something that happened at a time

Its time is

process started

Built-in rules reading it

25

process.name

string

Full path of the executable that was launched.

process.command_line

string

Full command line, including arguments. Absent whenever the dependency policy is off - not because nothing ran, but because Windows never recorded it. An event without it leaves a selection over it unknown rather than unmatched, and a rule that needs it reports "not run" on a run where the dependency is false or undetermined.
only recorded when policy.process_creation_commandline.enabled is on

process.parent_name

string

Full path of the creating process's executable, as reported by the event itself. Not marked Identity and has no companion PID/time in this vocabulary yet: Processes knows the parent's name at the moment this child was created, but not when the parent itself started, so a parent-process identity is not yet safe to correlate on. A future module that captures a parent's own start time could extend this.

process.pid

int

The new process's own process ID. Always pair with process.start_time when correlating - a bare PID from two different times may not be the same process.

process.parent_pid

int

The creating process's process ID.

process.start_time

time

When a process creation event was recorded. This is process.pid's CompanionTime: a PID is only a safe correlation key paired with the moment it was known to be this specific process, since PIDs are reused.

process.user

string

The account (DOMAIN\name) that started the process.

process.user_sid

string

The SID of the account that started the process - what identifies it whatever its name.

process.logon_id

string

The logon session (hex) the process was started in.

process.run_as

string

The account the new process runs as, when Windows records one different from process.user.

process.token_elevation

string

The kind of token the process was given: default, full (elevated) or limited.
derived: decoded by Signal from the event's TokenElevationType code

process.integrity_level

string

The process's integrity level (low, medium, high, system...).
derived: decoded by Signal from the event's MandatoryLabel SID

process.hashes

string

The executable's hashes as Sysmon recorded them ("SHA256=..." - its configuration chooses the algorithms).

process.launched_by

string

What started the process, when its parent is a host Windows starts work in for others: wmi (WmiPrvSE.exe - a WMI method, local or from another host), wmi_script_consumer (scrcons.exe - a WMI subscription's script), winrm (wsmprovhost.exe - a WinRM remote session) or com_surrogate (dllhost.exe - a COM object, local or from another host through DCOM). Absent for any other parent.
derived: set by Signal from process.parent_name

Kind

State - something true when Signal read the host

Its time is

process started

Built-in rules reading it

8

process.name

string

Full path of the executable that was launched.

process.command_line

string

Full command line, including arguments. Absent whenever the dependency policy is off - not because nothing ran, but because Windows never recorded it. An event without it leaves a selection over it unknown rather than unmatched, and a rule that needs it reports "not run" on a run where the dependency is false or undetermined.
only recorded when policy.process_creation_commandline.enabled is on

process.parent_name

string

Full path of the creating process's executable, as reported by the event itself. Not marked Identity and has no companion PID/time in this vocabulary yet: Processes knows the parent's name at the moment this child was created, but not when the parent itself started, so a parent-process identity is not yet safe to correlate on. A future module that captures a parent's own start time could extend this.

process.pid

int

The new process's own process ID. Always pair with process.start_time when correlating - a bare PID from two different times may not be the same process.

process.parent_pid

int

The creating process's process ID.

process.start_time

time

When a process creation event was recorded. This is process.pid's CompanionTime: a PID is only a safe correlation key paired with the moment it was known to be this specific process, since PIDs are reused.

process.user

string

The account (DOMAIN\name) that started the process.

process.user_sid

string

The SID of the account that started the process - what identifies it whatever its name.

process.launched_by

string

What started the process, when its parent is a host Windows starts work in for others: wmi (WmiPrvSE.exe - a WMI method, local or from another host), wmi_script_consumer (scrcons.exe - a WMI subscription's script), winrm (wsmprovhost.exe - a WinRM remote session) or com_surrogate (dllhost.exe - a COM object, local or from another host through DCOM). Absent for any other parent.
derived: set by Signal from process.parent_name

file.sha256

string

The SHA-256 of the entry's program (lower-case hex), as found at its path when Signal ran - absent when the file was not found or could not be read.
derived: computed by Signal from the file's content

file.sha1

string

The SHA-1 of the same file, computed in the same read as file.sha256 - for matching threat reports and Sysmon, which still name files by it.
derived: computed by Signal from the file's content

file.md5

string

The MD5 of the same file, computed in the same read as file.sha256 - for matching threat reports and Sysmon, which still name files by it.
derived: computed by Signal from the file's content

Kind

Event - something that happened at a time

Its time is

program run (as its source records it)

Built-in rules reading it

3

process.name

string

Full path of the executable that was launched.

process.user_sid

string

The SID of the account that started the process - what identifies it whatever its name.

run.source

string

What recorded the run: Prefetch (one of the program's last 8 runs), BAM or DAM (the Background or Desktop Activity Moderator's latest record of it, per account) or PCA (the Program Compatibility Assistant's list of programs launched from the desktop, Windows 11 22H2 and later).

run.count

int

How many times the program ran, as Prefetch counts it - every run since its Prefetch file was created, not only the 8 it keeps the times of. Absent from the other sources.