Windows.Events.ProcessCreation

name: Windows.Events.ProcessCreation
description: |
  Monitors for Windows process creation events using WMI
  Win32_ProcessStartTrace and enriches them with parent and call chain
  information.
  
  This method is not as good as the kernel mechanism used by Sysmon.
  It is more reliable to use Sysmon instead via the
  `Windows.Sysinternals.SysmonLogForward` artifact.

type: CLIENT_EVENT

sources:
  - precondition:
      SELECT OS From info() where OS = 'windows'
    query: |
      -- Add a small delay to allow the process tracker to catch up
      -- for enrichments.
      LET Delayed = SELECT * FROM delay(query={
         SELECT * FROM wmi_events(
             query="SELECT * FROM Win32_ProcessStartTrace",
             wait=5000000,   // Do not time out.
             namespace="ROOT/CIMV2")
      }, delay=2)

      // Convert the timestamp from WinFileTime to Epoch.
      SELECT timestamp(winfiletime=atoi(string=Parse.TIME_CREATED)) as Timestamp,
          Parse.ParentProcessID as PPID,
          Parse.ProcessID as PID,
          Parse.ProcessName as Name,
          process_tracker_get(id=Parse.ProcessID).Data.CommandLine AS CommandLine,
          process_tracker_get(id=Parse.ParentProcessID).Data.CommandLine AS ParentCommandLine,
          join(array=process_tracker_callchain(id=Parse.ProcessID).Data.Name,
               sep=" <- ") AS CallChain
      FROM Delayed