Skip Navigation
  1. BlackBerry Docs
  2. Cylance Endpoint Security
  3. Cylance Syslog Guide
  4. CylanceOPTICS detection events
  5. CylanceOPTICS PowerShell trace detection events

CylanceOPTICS
 PowerShell trace detection events

These events occur when a detection event that includes a PowerShell trace artifact is triggered. Note that some fields will include command line values that can include commas and colons.
BlackBerry
 recommends that you review and test the parsing of these values by your SIEM or syslog server.
Field
Value
Description
Description
[varies]
This is the name of the detection rule that was triggered.
Detection Rule Id
[varies]
This is the unique detection rule ID.
Device Id
[varies]
This is the unique ID of the device.
Device Last Reported Users
[varies]
These are the last reported device users.
Device Name
[varies]
This is the name of the device that the detection event occurred on.
Event Id
[varies]
This is the unique ID of the detection event.
Event Name
OpticsCaePowershellTraceEvent
This is the detection event involved in a PowerShell trace.
Event Received Timestamp
[varies]
This is the timestamp of when the event was received by
CylanceOPTICS
.
Event Timestamp
[varies]
This is the timestamp of the event that occurred on the device.
Event Type
OpticsCaePowershellTraceEvent
This is the detection event involved a PowerShell trace.
Instigating Process Command Line
[varies]
This is the command line that was used to start the instigating process.
Instigating Process File Path
[varies]
This is the file path of the instigating process executable.
Instigating Process ImageFileSha256
[varies]
This is the SHA256 hash of the process that instigated the action.
Instigating Process Name
[varies]
This is the name of the process that instigated the action.
Instigating Process Owner
[varies]
This is the user that owns the process that instigated the action.
Payload
[varies]
This is the PowerShell modules and/or arguments that were passed into the PowerShell interpreter.
Payload Length
[varies]
This is the length of the observed PowerShell payload field.
Script Block Length
[varies]
This is the length of the observed PowerShell script block text field.
Script Block Text
[varies]
This is the content of a PowerShell script or module that was loaded or executed by the PowerShell interpreter.
Severity
[varies]
The severity of the event:
  • High: A malicious event that requires immediate attention
  • Medium: A suspicious event that should be reviewed
  • Low: An important event that may not be malicious
  • Info: An observed event
Zone Ids
[varies]
This is a list of zone IDs that the device belonged to at the time of the event.
Zone Names
[varies]
These are the zones that the device belongs to.

Example message for Powershell trace detection events

Event Type: OpticsCaePowershellTraceEvent, Event Name: OpticsCaePowershellTraceEvent, Device Name: SECURITYSERVER3, Zone Names: (JeffTesting,JeffSecurityServer), Event Id: 4b199c5c-60dc-4b5c-8dac-86965ba5b051, Severity: Medium, Description: SYSLOG detections - Looking for PowershellTrace get-childitem, Instigating Process Name: powershell.exe, Instigating Process Owner: PENTEST//Administrator, Instigating Process ImageFileSha256: DE96A6E69944335375DC1AC238336066889D9FFC7D73628EF4FE1B1B160AB32C, Event Timestamp: 2022-06-28T18:10:39.547Z, Event Received Timestamp: 2022-06-28T18:10:43Z, Device Last Reported Users: (PENTEST\Administrator), Zone Ids: (F568A8A8E401470282C1FE98FDD1703C,161EB91D79D6466A80182CF685FA7CAA), Detection Rule Id: 9eb1073c-913f-49ab-9b12-2e5a28dad18d, Instigating Process Command Line: powershell gwmi -class win32_process, Instigating Process File Path: c:\windows\system32\windowspowershell\v1.0\powershell.exe, Script Block Text: @{GUID="EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D"Author="Microsoft Corporation"CompanyName="Micros, Script Block Length: 2583, Payload: None, Payload Length: 0, Device Id: c7b79f9f-4fbe-4f90-9658-ec7e17af1954