Skip to content

process-handle.md

Latest commit

 

History

History
32 lines (23 loc) · 914 Bytes

process-handle.md

File metadata and controls

32 lines (23 loc) · 914 Bytes
Raw

process handle

Schema ID: https://github.com/NextronSystems/jsonlog/thorlog/v3/process-handle | JSON Schema: https://json-schema.org/draft/2020-12/schema | Definition: ProcessHandle

Fields

Field names are shown in UPPERCASE as used in Sigma rules. The lowercase JSON name is shown in parentheses for reference.

Sigma Field JSON Name Type Required Description Example Values
HANDLE handle integer ✅
HANDLE_TYPE handle_type string
NAME name string ✅
TYPE type string ✅

No nested fields in this type.

Sigma Rule Template

logsource:
    product: THOR
    service: "process handle"

detection:
    selection:
        NAME|contains: 'suspicious_name'
    condition: selection

level: medium