Struct sysmon::ProcessCreateEventData

pub struct ProcessCreateEventData {
    pub utc_time: UtcTime,
    pub process_guid: ProcessGuid,
    pub process_id: u64,
    pub image: Image,
    pub command_line: CommandLine,
    pub current_directory: CurrentDirectory,
    pub user: User,
    pub logon_guid: LogonGuid,
    pub logon_id: LogonId,
    pub terminal_session_id: TerminalSessionId,
    pub integrity_level: IntegrityLevel,
    pub hashes: Hashes,
    pub parent_process_guid: ProcessGuid,
    pub parent_process_id: u64,
    pub parent_image: Image,
    pub parent_command_line: CommandLine,
}

Fields

utc_time: UtcTime

2017-04-28 22:08:22.025

process_guid: ProcessGuid

{A23EAE89-BD56-5903-0000-0010E9D95E00}

process_id: u64

6228

image: Image

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

command_line: CommandLine

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --lang=en-US --no-sandbox --service-request-channel-token=F47498BBA884E523FA93E623C4569B94 --mojo-platform-channel-handle=3432 /prefetch:8

current_directory: CurrentDirectory

C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.81</Data>

user: User

LAB\rsmith

logon_guid: LogonGuid

{A23EAE89-B357-5903-0000-002005EB0700}

logon_id: LogonId

0x7eb05

terminal_session_id: TerminalSessionId

1

integrity_level: IntegrityLevel

Medium

hashes: Hashes

SHA256=6055A20CF7EC81843310AD37700FF67B2CF8CDE3DCE68D54BA42934177C10B57

parent_process_guid: ProcessGuid

{A23EAE89-BD28-5903-0000-00102F345D00}

parent_process_id: u64

13220

parent_image: Image

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

parent_command_line: CommandLine

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"

Trait Implementations

impl Clone for ProcessCreateEventData

fn clone(&self) -> ProcessCreateEventData

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProcessCreateEventData

fn fmt(&self, f: &mut Formatter) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ProcessCreateEventData

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error> where
    __D: Deserializer<'de>, 

Deserialize this value from the given Serde deserializer.

impl Hash for ProcessCreateEventData

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given [Hasher].

fn hash_slice<H>(data: &[Self], state: &mut H) where
    H: Hasher, 

Feeds a slice of this type into the given [Hasher].

impl TryFrom<IntermediaryEventData> for ProcessCreateEventData

type Error = Error

The type returned in the event of a conversion error.

fn try_from(inter: IntermediaryEventData) -> Result<Self>

Performs the conversion.