[8.16] API - DeviceIoControl events and new final_user_module fields

[jdu2600]

Change Summary

• Add new DeviceIoControl event fields
• Add new final_user_module fields
• Add short descriptions for all fields.

Note - custom documentation has not yet been updated.

Sample values

{ "dll": { "Ext": { "code_signature": [ { "exists": true, "status": "trusted", "subject_name": "Microsoft Windows", "trusted": true } ] }, "hash": { "sha256": "8b9731a4b83e801cda7b918f8194608e91f86b3a86ffb6bb24230b1cc28e1a54" }, "path": "c:\\windows\\system32\\drivers\\pktmon.sys" }, "message": "Endpoint API event - DeviceIoControl", "process": { "Ext": { "api": { "metadata": { "security_descriptor": "O:BAG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:AI(ML;;NW;;;LW)" }, "name": "DeviceIoControl", "parameters": { "device": "\\Device\\PktMonDev", "io_control_code": 27365 }, "summary": "DeviceIoControl( \\Device\\PktMonDev, 0x6ae5 )" } } } }

"call_stack_final_user_module": { "reason": "ntdll.dll|kernel32.dll|ntdll.dll", "name": "Undetermined" }

"call_stack_final_user_module": { "path": "c:\\program files (x86)\\trend micro\\officescan client\\amsi\\tmamsiprovider.dll", "code_signature": [ { "exists": false } ], "protection_provenance_path": "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\dbf5cd6944009aa6004829d5d50a7155\\system.core.ni.dll", "name": "tmamsiprovider.dll", "protection_provenance": "tmamsiprovider.dll", "allocation_private_bytes": 462848, "hash": { "sha256": "ed50be8e398faf3edb680247c51716807ef6abc1f5052e01354facfe2ecb9372" } }

Release Target

8.16

For mapping changes:

• I ran make after making the schema changes, and committed all changes

[pzl]

no notes, good stuff 👍

[jdu2600]

@AsuNa-jp @gabriellandau - I modified some of your descriptions, especially to add short versions.

[gabriellandau]

Should we mention it's SDDL? It may be obvious for Windows folk, but unclear for folks with other backgrounds.

[jdu2600]

🤔 Security descriptors have two formats - binary and string.
If folks don't know what a SD is then they'll quickly discover this when they look it up.