Add new maps, minor updates

evtx/Maps/Microsoft-Windows-Storage-ClassPnP-Operational_Microsoft-Windows-Storage-ClassPnP_507.map

@@ -44,6 +44,7 @@ Maps:
 # https://forensixchange.com/posts/19_08_03_usb_storage_forensics_1/
 # https://www.mcbsys.com/blog/2016/08/stordiag-errors-after-windows-10-upgrade/
 # https://www.windowsphoneinfo.com/threads/event-507-completing-a-failed-non-readwrite-scsi-srb-request.275718/
+# https://answers.microsoft.com/en-us/windows/forum/all/event-507-completing-a-failed-non-readwrite-scsi/9f900bc9-8a7d-4a89-a197-d1728af9e59e
 #
 # Example Event Data:
 # <Event>

evtx/Maps/Microsoft-Windows-Sysmon-Operational_Microsoft-Windows-Sysmon_24.map

@@ -0,0 +1,95 @@
+Author: Andrew Rathbun
+Description: ClipboardChange (New content in the clipboard)
+EventId: 24
+Channel: Microsoft-Windows-Sysmon/Operational
+Provider: Microsoft-Windows-Sysmon
+Maps: 
+  - 
+    Property: ExecutableInfo
+    PropertyValue: "%Image%"
+    Values: 
+      - 
+        Name: Image
+        Value: "/Event/EventData/Data[@Name=\"Image\"]"  
+  - 
+    Property: PayloadData1
+    PropertyValue: "ProcessID: %ProcessID%, ProcessGUID: %ProcessGUID%"
+    Values: 
+      - 
+        Name: ProcessGUID
+        Value: "/Event/EventData/Data[@Name=\"ProcessGuid\"]"
+      - 
+        Name: ProcessID
+        Value: "/Event/EventData/Data[@Name=\"ProcessId\"]"
+  - 
+    Property: PayloadData2
+    PropertyValue: "RuleName: %RuleName%"
+    Values: 
+      - 
+        Name: RuleName
+        Value: "/Event/EventData/Data[@Name=\"RuleName\"]"
+  - 
+    Property: PayloadData3
+    PropertyValue: "%Hashes%"
+    Values: 
+      - 
+        Name: Hashes
+        Value: "/Event/EventData/Data[@Name=\"Hashes\"]"
+  - 
+    Property: PayloadData4
+    PropertyValue: "Session: %Session%"
+    Values: 
+      - 
+        Name: Session
+        Value: "/Event/EventData/Data[@Name=\"Session\"]"
+  - 
+    Property: PayloadData5
+    PropertyValue: "ClientInfo: %ClientInfo%"
+    Values: 
+      - 
+        Name: ClientInfo
+        Value: "/Event/EventData/Data[@Name=\"ClientInfo\"]"
+  - 
+    Property: PayloadData6
+    PropertyValue: "Archived: %Archived%"
+    Values: 
+      - 
+        Name: Archived
+        Value: "/Event/EventData/Data[@Name=\"Archived\"]"
+
+# Documentation:
+# https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#events
+# https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES
+# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx - filter on Sysmon
+# sysmon64.exe -s will list examples of data stored for each Sysmon event. This was done for this particular event.
+#
+# Example Event Data:
+#<Event>
+#  <System>
+#    <Provider Name="Microsoft-Windows-Sysmon" Guid="5770385f-c22a-43e0-bf4c-06f5698ffbd9" />
+#    <EventID>23</EventID>
+#    <Version>5</Version>
+#    <Level>4</Level>
+#    <Task>23</Task>
+#    <Opcode>0</Opcode>
+#    <Keywords>0x8000000000000000</Keywords>
+#    <TimeCreated SystemTime="2020-10-20 11:50:56.9994587" />
+#    <EventRecordID>1081</EventRecordID>
+#    <Correlation />
+#    <Execution ProcessID="7212" ThreadID="9748" />
+#    <Channel>Microsoft-Windows-Sysmon/Operational</Channel>
+#    <Computer>DESKTOP-NTSSLJD</Computer>
+#    <Security UserID="S-1-5-18" />
+#  </System>
+#  <EventData>
+#    <data name="RuleName" inType="win:UnicodeString" outType="xs:string" />
+#    <data name="UtcTime" inType="win:UnicodeString" outType="xs:string" />
+#    <data name="ProcessGuid" inType="win:GUID" />
+#    <data name="ProcessId" inType="win:UInt32" outType="win:PID" />
+#    <data name="Image" inType="win:UnicodeString" outType="xs:string" />
+#    <data name="Session" inType="win:UInt32" />
+#    <data name="ClientInfo" inType="win:UnicodeString" outType="xs:string" />
+#    <data name="Hashes" inType="win:UnicodeString" outType="xs:string" />    
+#    <data name="Archived" inType="win:UnicodeString" outType="xs:string" />    
+#  </EventData>
+#</Event>

evtx/Maps/Microsoft-Windows-Sysmon-Operational_Microsoft-Windows-Sysmon_25.map

@@ -0,0 +1,71 @@
+Author: Andrew Rathbun
+Description: ProcessTampering (Process image change)
+EventId: 25
+Channel: Microsoft-Windows-Sysmon/Operational
+Provider: Microsoft-Windows-Sysmon
+Maps: 
+  - 
+    Property: ExecutableInfo
+    PropertyValue: "%Image%"
+    Values: 
+      - 
+        Name: Image
+        Value: "/Event/EventData/Data[@Name=\"Image\"]"  
+  - 
+    Property: PayloadData1
+    PropertyValue: "ProcessID: %ProcessID%, ProcessGUID: %ProcessGUID%"
+    Values: 
+      - 
+        Name: ProcessGUID
+        Value: "/Event/EventData/Data[@Name=\"ProcessGuid\"]"
+      - 
+        Name: ProcessID
+        Value: "/Event/EventData/Data[@Name=\"ProcessId\"]"
+  - 
+    Property: PayloadData2
+    PropertyValue: "RuleName: %RuleName%"
+    Values: 
+      - 
+        Name: RuleName
+        Value: "/Event/EventData/Data[@Name=\"RuleName\"]"
+  -
+    Property: PayloadData6
+    PropertyValue: "Type: %Type%"
+    Values: 
+      - 
+        Name: Type
+        Value: "/Event/EventData/Data[@Name=\"Type\"]"
+
+# Documentation:
+# https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#events
+# https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES
+# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx - filter on Sysmon
+# sysmon64.exe -s will list examples of data stored for each Sysmon event. This was done for this particular event.
+#
+# Example Event Data:
+#<Event>
+#  <System>
+#    <Provider Name="Microsoft-Windows-Sysmon" Guid="5770385f-c22a-43e0-bf4c-06f5698ffbd9" />
+#    <EventID>25</EventID>
+#    <Version>5</Version>
+#    <Level>4</Level>
+#    <Task>23</Task>
+#    <Opcode>0</Opcode>
+#    <Keywords>0x8000000000000000</Keywords>
+#    <TimeCreated SystemTime="2020-10-20 11:50:56.9994587" />
+#    <EventRecordID>1081</EventRecordID>
+#    <Correlation />
+#    <Execution ProcessID="7212" ThreadID="9748" />
+#    <Channel>Microsoft-Windows-Sysmon/Operational</Channel>
+#    <Computer>DESKTOP-NTSSLJD</Computer>
+#    <Security UserID="S-1-5-18" />
+#  </System>
+#  <EventData>
+#    <data name="RuleName" inType="win:UnicodeString" outType="xs:string" />
+#    <data name="UtcTime" inType="win:UnicodeString" outType="xs:string" />
+#    <data name="ProcessGuid" inType="win:GUID" />
+#    <data name="ProcessId" inType="win:UInt32" outType="win:PID" />
+#    <data name="Image" inType="win:UnicodeString" outType="xs:string" />
+#    <data name="Type" inType="win:UnicodeString" outType="xs:string" />
+#   </EventData>
+#</Event>

evtx/Maps/System_EventLog_6008.map

@@ -6,7 +6,7 @@ Provider: EventLog
 Maps:
   -
     Property: PayloadData1
-    PropertyValue: "Time, Date : %Data%"
+    PropertyValue: "Timestamp: %Data%"
     Values:
       -
         Name: Data

evtx/Maps/System_Microsoft-Windows-DriverFrameworks-UserMode_10000.map

@@ -1,5 +1,5 @@
 Author: Hyun Yi @hyuunnn
-Description: Device driver was installed (Device was connected)
+Description: Device driver installations begins (Device connection)
 EventId: 10000
 Channel: "System"
 Provider: "Microsoft-Windows-DriverFrameworks-UserMode"