Azure-Sentinel test ASimAuditEvent

Required items, please complete

Change(s):

ASimAuditEvent parsers to improve Scheduled Task

Nov 27 '25 13:11 v-atulyadav

ASIM parsers have been changed. ARM templates were regenerated from the updated KQL function YAML files. To find the new ARM templates, pull your branch.

Nov 27 '25 13:11 contentautomationbot[bot]

Thanks for the fix @v-atulyadav . Tagging @yummyblabla and @marjoriehahn for awareness.

Now two comments/questions:

How did we identify this issue? Is it a GitHub ticket? an IcM? Otherwise?
It may be a bug in the SecurityEvent connector itself. Did we look into this?

Nov 27 '25 18:11 oshezaf

ASIM parsers have been changed. ARM templates were regenerated from the updated KQL function YAML files. To find the new ARM templates, pull your branch.

Nov 28 '25 06:11 contentautomationbot[bot]

ASIM parsers have been changed. ARM templates were regenerated from the updated KQL function YAML files. To find the new ARM templates, pull your branch.

Nov 28 '25 08:11 contentautomationbot[bot]

Thanks for the fix @v-atulyadav . Tagging @yummyblabla and @marjoriehahn for awareness.

Now two comments/questions:

How did we identify this issue? Is it a GitHub ticket? an IcM? Otherwise?

It may be a bug in the SecurityEvent connector itself. Did we look into this?

Hi @oshezaf,

This is the test PR we have created. The author has submitted it, and we are currently waiting for sample logs to continue testing. https://github.com/Azure/Azure-Sentinel/pull/13170

Nov 28 '25 10:11 v-atulyadav

ASIM parsers have been changed. ARM templates were regenerated from the updated KQL function YAML files. To find the new ARM templates, pull your branch.

Dec 02 '25 13:12 contentautomationbot[bot]

ASIM parsers have been changed. ARM templates were regenerated from the updated KQL function YAML files. To find the new ARM templates, pull your branch.

Dec 03 '25 08:12 contentautomationbot[bot]

Hi @oshezaf

I am the customer that run into these issues while trying to use ASimAuditEvent to develop an analytic rule, and raised the PR with what is really a workaround that I came up with.

It may be a bug in the SecurityEvent connector itself. Did we look into this?

I found that if I used wevutil on a local windows machine, the task data is escaped in the same way as it appears in SecurityEvent. It also appears this way if you query via the ForwardedEvents table on a WEC server, so my guess would be that there is something in the WindowsEvent data connector that unescapes it correctly as part of parsing EventData into a dynamic object which the Security Event doesn't do. If it could be fixed in the Data Connector level instead that would be great!

wevtutil qe Security /q:"*[System[(EventID=4698)]]" /f:xml /c:1

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
	<System>
		<Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/>
		<EventID>4698</EventID>
		<Version>1</Version>
		<Level>0</Level>
		<Task>12804</Task>
		<Opcode>0</Opcode>
		<Keywords>0x8020000000000000</Keywords>
		<TimeCreated SystemTime='2025-12-11T20:49:36.652845400Z'/>
		<EventRecordID>95763572</EventRecordID>
		<Correlation ActivityID='{d90ce5bb-f9ab-4033-9bf4-950c29e08567}'/>
		<Execution ProcessID='876' ThreadID='5452'/>
		<Channel>Security</Channel>
		<Computer>myserver01.mydomain.internal/Computer>
		<Security/>
	</System>
	<EventData>
		<Data Name='SubjectUserSid'>S-1-5-18</Data>
		<Data Name='SubjectUserName'>MYSERVER$</Data>
		<Data Name='SubjectDomainName'>MYDOMAIN</Data>
		<Data Name='SubjectLogonId'>0x3e7</Data>
		<Data Name='TaskName'>\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan</Data>
		<Data Name='TaskContent'>&lt;?xml version="1.0" encoding="UTF-16"?&gt;
&lt;Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"&gt;
  &lt;RegistrationInfo&gt;
    &lt;Description&gt;Periodic scan task.&lt;/Description&gt;
    &lt;URI&gt;\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan&lt;/URI&gt;
  &lt;/RegistrationInfo&gt;
  &lt;Triggers&gt;
    &lt;CalendarTrigger&gt;
      &lt;StartBoundary&gt;2000-01-01T04:55:09&lt;/StartBoundary&gt;
      &lt;EndBoundary&gt;2100-01-01T00:00:00&lt;/EndBoundary&gt;
      &lt;Enabled&gt;true&lt;/Enabled&gt;
      &lt;ScheduleByDay&gt;
        &lt;DaysInterval&gt;1&lt;/DaysInterval&gt;
      &lt;/ScheduleByDay&gt;
    &lt;/CalendarTrigger&gt;
  &lt;/Triggers&gt;
  &lt;Principals&gt;
    &lt;Principal id="LocalSystem"&gt;
      &lt;UserId&gt;S-1-5-18&lt;/UserId&gt;
      &lt;RunLevel&gt;HighestAvailable&lt;/RunLevel&gt;
    &lt;/Principal&gt;
  &lt;/Principals&gt;
  &lt;Settings&gt;
    &lt;MultipleInstancesPolicy&gt;IgnoreNew&lt;/MultipleInstancesPolicy&gt;
    &lt;DisallowStartIfOnBatteries&gt;true&lt;/DisallowStartIfOnBatteries&gt;
    &lt;StopIfGoingOnBatteries&gt;false&lt;/StopIfGoingOnBatteries&gt;
    &lt;AllowHardTerminate&gt;true&lt;/AllowHardTerminate&gt;
    &lt;StartWhenAvailable&gt;true&lt;/StartWhenAvailable&gt;
    &lt;RunOnlyIfNetworkAvailable&gt;false&lt;/RunOnlyIfNetworkAvailable&gt;
    &lt;IdleSettings&gt;
      &lt;Duration&gt;PT0H1M0S&lt;/Duration&gt;
      &lt;WaitTimeout&gt;PT4H0M0S&lt;/WaitTimeout&gt;
      &lt;StopOnIdleEnd&gt;false&lt;/StopOnIdleEnd&gt;
      &lt;RestartOnIdle&gt;false&lt;/RestartOnIdle&gt;
    &lt;/IdleSettings&gt;
    &lt;AllowStartOnDemand&gt;true&lt;/AllowStartOnDemand&gt;
    &lt;Enabled&gt;true&lt;/Enabled&gt;
    &lt;Hidden&gt;false&lt;/Hidden&gt;
    &lt;RunOnlyIfIdle&gt;true&lt;/RunOnlyIfIdle&gt;
    &lt;DisallowStartOnRemoteAppSession&gt;false&lt;/DisallowStartOnRemoteAppSession&gt;
    &lt;UseUnifiedSchedulingEngine&gt;true&lt;/UseUnifiedSchedulingEngine&gt;
    &lt;WakeToRun&gt;false&lt;/WakeToRun&gt;
    &lt;ExecutionTimeLimit&gt;PT72H&lt;/ExecutionTimeLimit&gt;
    &lt;Priority&gt;7&lt;/Priority&gt;
  &lt;/Settings&gt;
  &lt;Actions Context="LocalSystem"&gt;
    &lt;Exec&gt;
      &lt;Command&gt;C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25110.5-0\MpCmdRun.exe&lt;/Command&gt;
      &lt;Arguments&gt;Scan -ScheduleJob -ScanTrigger 55 -IdleScheduledJob&lt;/Arguments&gt;
    &lt;/Exec&gt;
  &lt;/Actions&gt;
&lt;/Task&gt;</Data>
		<Data Name='ClientProcessStartKey'>19140298416329301</Data>
		<Data Name='ClientProcessId'>5696</Data>
		<Data Name='ParentProcessId'>856</Data>
		<Data Name='RpcCallClientLocality'>0</Data>
		<Data Name='FQDN'>myserver01.mydomain.internal</Data>
	</EventData>
</Event>

Dec 13 '25 09:12 andrewj-t

Thanks @andrewj-t for the comprehensive information. We will start with an ASIM fix. Changing security event might be a breaking change and needs to be handled carefully.

Dec 13 '25 22:12 oshezaf