Add Maps for DCOM:10028, PowerShell:4100, and SMBClient\Connectivity:30807

evtx/Maps/Microsoft-Windows-PowerShell-Operational_Microsoft-Windows-PowerShell_4100.map

@@ -0,0 +1,92 @@
+Author: Andrew Rathbun
+Description: Executing pipeline
+EventId: 4100
+Channel: "Microsoft-Windows-PowerShell/Operational"
+Provider: Microsoft-Windows-PowerShell
+Maps:
+  -
+    Property: UserName
+    PropertyValue: "%User%"
+    Values:
+      -
+        Name: User
+        Value: "/Event/EventData/Data[@Name=\"ContextInfo\"]"
+        Refine: "(?<=User = ).*(?=,         )"
+  -
+    Property: PayloadData1
+    PropertyValue: "Severity = %Severity%"
+    Values:
+      -
+        Name: Severity
+        Value: "/Event/EventData/Data[@Name=\"ContextInfo\"]"
+        Refine: "(?<=Severity = ).*(?=,         Host Name)"
+  -
+    Property: PayloadData2
+    PropertyValue: "Command Name: %CommandName%"
+    Values:
+      -
+        Name: CommandName
+        Value: "/Event/EventData/Data[@Name=\"ContextInfo\"]"
+        Refine: "(?<=Command Name = ).*(?=,         Command Type)"
+  -
+    Property: PayloadData3
+    PropertyValue: "CommandType: %CommandType%"
+    Values:
+      -
+        Name: CommandType
+        Value: "/Event/EventData/Data[@Name=\"ContextInfo\"]"
+        Refine: "(?<=Command Type = ).*(?=,         Script Name)"
+  -
+    Property: PayloadData4
+    PropertyValue: "Script Name: %ScriptName%"
+    Values:
+      -
+        Name: ScriptName
+        Value: "/Event/EventData/Data[@Name=\"ContextInfo\"]"
+        Refine: "(?<=Script Name = ).*(?=,         Command Path)"
+  -
+    Property: PayloadData5
+    PropertyValue: "HostApplication: %HostApplication%"
+    Values:
+      -
+        Name: HostApplication
+        Value: "/Event/EventData/Data[@Name=\"ContextInfo\"]"
+        Refine: "(?<=Host Application = ).*(?=,         Engine Version)"
+  -
+    Property: PayloadData6
+    PropertyValue: "Host Name: %HostName%"
+    Values:
+      -
+        Name: HostName
+        Value: "/Event/EventData/Data[@Name=\"ContextInfo\"]"
+        Refine: "(?<=Host Name = ).*(?=,         Host Version)"
+
+# Documentation:
+# https://www.myeventlog.com/search/show/976
+# http://eventopedia.cloudapp.net/default.aspx?LogType=Windows+Event+Log&LogName=Microsoft-Windows-PowerShell%2FOperational&EventID=4100&action=go
+# https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
+#
+# Example Event Data:
+#<Event>
+#  <System>
+#    <Provider Name="Microsoft-Windows-PowerShell" Guid="a0c1853b-5c40-4b15-8766-3cf6798f985a" />
+#    <EventID>4100</EventID>
+#    <Version>1</Version>
+#    <Level>3</Level>
+#    <Task>106</Task>
+#    <Opcode>19</Opcode>
+#    <Keywords>0x0</Keywords>
+#    <TimeCreated SystemTime="2021-05-11 12:15:09.7936797" />
+#    <EventRecordID>167340</EventRecordID>
+#    <Correlation ActivityID="d01b00f3-0e95-000c-341d-1ckjhg50ed701" />
+#    <Execution ProcessID="3732" ThreadID="8972" />
+#    <Channel>Microsoft-Windows-PowerShell/Operational</Channel>
+#    <Computer>HOSTNAME.domain.com</Computer>
+#    <Security UserID="S-1-5-21-1123545945-19945682763-6826793330-16794" />
+#  </System>
+#  <EventData>
+#    <Data Name="ContextInfo">        Severity = Warning,         Host Name = ConsoleHost,         Host Version = 4.0,         Host ID = 2ed08e6b-9048-4bfe-a06b-3b567920bde4a,         Host Application = powershell -ExecutionPolicy ByPass -FILE C:\Users\username\AppData\Local\5da531d1a4694f6799819de13aac2c08.ps1,         Engine Version = 4.0,         Runspace ID = 35f1b751-df3f-480f-b705-5be201b68ede,         Pipeline ID = 1,         Command Name = Add-Type,         Command Type = Cmdlet,         Script Name = C:\Windows\ltsvc\packages\ABC123465\SpeculationControl.psm1,         Command Path = ,         Sequence Number = 15,         User = DOMAIN\username,         Shell ID = Microsoft.PowerShell, </Data>
+#    <Data Name="UserData"></Data>
+#    <Data Name="Payload">Error Message = Cannot add type. Compilation errors occurred., Fully Qualified Error ID = COMPILER_ERRORS,Microsoft.PowerShell.Commands.AddTypeCommand, </Data>
+#  </EventData>
+#</Event>

evtx/Maps/Microsoft-Windows-SmbClient-Connectivity_Microsoft-Windows-SMBClient_30807.map

@@ -0,0 +1,66 @@
+Author: Andrew Rathbun
+Description: The connection to the share was lost
+EventId: 30807
+Channel: "Microsoft-Windows-SmbClient/Connectivity"
+Provider: Microsoft-Windows-SMBClient
+Maps:
+  -
+    Property: PayloadData1
+    PropertyValue: "ServerName: %ServerName%"
+    Values:
+      -
+        Name: ServerName
+        Value: "/Event/EventData/Data[@Name=\"ServerName\"]"
+  -
+    Property: PayloadData2
+    PropertyValue: "Status: %Status%"
+    Values:
+      -
+        Name: Status
+        Value: "/Event/EventData/Data[@Name=\"Status\"]"
+  -
+    Property: PayloadData3
+    PropertyValue: "SessionId: %SessionId%"
+    Values:
+      -
+        Name: SessionId
+        Value: "/Event/EventData/Data[@Name=\"SessionId\"]"
+  -
+    Property: PayloadData4
+    PropertyValue: "Address: %Address%"
+    Values:
+      -
+        Name: Address
+        Value: "/Event/EventData/Data[@Name=\"Address\"]"
+
+# Documentation:
+# https://windowsbb.com/threads/256606/
+#
+# Example Event Data:
+# <Event>
+#   <System>
+#     <Provider Name="Microsoft-Windows-SMBClient" Guid="988c59c5-0a1c-45b6-a555-0c62276e327d" />
+#     <EventID>30807</EventID>
+#     <Version>2</Version>
+#     <Level>3</Level>
+#     <Task>0</Task>
+#     <Opcode>0</Opcode>
+#     <Keywords>0x400000000000040</Keywords>
+#     <TimeCreated SystemTime="2020-09-30 12:20:27.2339658" />
+#     <EventRecordID>52</EventRecordID>
+#     <Correlation />
+#     <Execution ProcessID="4" ThreadID="192" />
+#     <Channel>Microsoft-Windows-SmbClient/Connectivity</Channel>
+#     <Computer>HOSTNAME.domain.com</Computer>
+#     <Security />
+#   </System>
+#   <EventData>
+#     <Data Name="Status">3267915996</Data>
+#     <Data Name="SessionId">26386799066665</Data>
+#     <Data Name="TreeId">1</Data>
+#     <Data Name="ServerNameLength">12</Data>
+#     <Data Name="ServerName">\HOSTNAME\abc$</Data>
+#     <Data Name="AddressLength">0</Data>
+#     <Data Name="Address"></Data>
+#   </EventData>
+# </Event>

evtx/Maps/System_Microsoft-Windows-DistributedCOM_10028.map

@@ -0,0 +1,59 @@
+Author: Andrew Rathbun
+Description: DCOM was unable to communicate with the computer
+EventId: 10028
+Channel: System
+Provider: Microsoft-Windows-DistributedCOM
+Maps:
+  -
+    Property: RemoteHost
+    PropertyValue: "%IpAddress%"
+    Values:
+      -
+        Name: IpAddress
+        Value: "/Event/EventData/Data[@Name=\"param1\"]"
+  -
+    Property: ExecutableInfo
+    PropertyValue: "%Process%"
+    Values:
+      -
+        Name: Process
+        Value: "/Event/EventData/Data[@Name=\"param3\"]"
+  -
+    Property: PayloadData1
+    PropertyValue: "ProcessID: %ProcessID%"
+    Values:
+      -
+        Name: ProcessID
+        Value: "/Event/EventData/Data[@Name=\"param2\"]"
+
+# Documentation:
+# https://support.solarwinds.com/SuccessCenter/s/article/Event-10028-DCOM-was-unable-to-communicate-with-the-computer?language=en_US
+# https://social.technet.microsoft.com/Forums/ie/en-US/5dd7322f-a3f5-4d86-9886-8702cbc9b4b4/dcom-was-unable-to-communicate-error-id-event-10028?forum=winserver8gen
+# https://www.eventid.net/display-eventid-10028-source-Microsoft-Windows-DistributedCOM-eventno-11243-phase-1.htm
+#
+# Example Event Data:
+#<Event>
+#  <System>
+#    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F36791407E}" EventSourceName="DCOM" />
+#    <EventID Qualifiers="0">10028</EventID>
+#    <Version>0</Version>
+#    <Level>2</Level>
+#    <Task>0</Task>
+#    <Opcode>0</Opcode>
+#    <Keywords>0x8080000000000000</Keywords>
+#    <TimeCreated SystemTime="2021-05-27 09:44:52.123456" />
+#    <EventRecordID>123456</EventRecordID>
+#    <Correlation />
+#    <Execution ProcessID="468" ThreadID="16376" />
+#    <Channel>System</Channel>
+#    <Computer>HOSTNAME.domain.com</Computer>
+#    <Security UserID="S-1-5-21-789336798-1326574676-1801667931-12345" />
+#  </System>
+#  <EventData>
+#    <Data Name="param1">10.23.255.79</Data>
+#    <Data Name="param2">    4679</Data>
+#    <Data Name="param3">C:\Users\username\AppData\Local\Temp\Advanced Port Scanner 2\advanced_port_scanner.exe</Data>
+#    <Data Name="param4">{8BC3F05E-D86B-11D0-A075-00C679B68820}</Data>
+#    <Binary>ec d1 ce d4 68 52 82 02 19 44 52 67 9a 17 22 ec 2d ec 17 10 fa 0a a1 aa 00 ec d2 ce d4 68 52 82 02 19 44 52 67 9a 17 22 ec 18 de c1 44 2f a0 aa 1a a0 10 10 12 34 5e cd 3c ed 46 85 28 20 21 94 45 26 79 a1 72 2e c1 8d ec 32 3f a0 aa 0e cd 4c ed 46 85 28 20 21 94 45 26 79 a1 23 7e c1 8d ec 31 3f a0 aa 0e cd 5c ed 46 85 28 20 21 94 45 26 79 a1 00 60 ec 18 de c3 11 fa 0a a3 aa 01 35 aa 10 aa 2f e0 15 0a 06 79 00 00 ec d6 ce d4 68 52 82 02 19 44 52 67 9a 10 06 0e c1 8d ec 31 8f a0 aa 00</Binary>
+#  </EventData>
+#</Event>