PastePile

Evidence formats

Sysmon log analysis

Sysmon records the process, network and registry activity that the Security log misses. Upload the Microsoft-Windows-Sysmon/Operational .evtx file and PastePile reads it with the same Windows compromise pack it uses for Security and System logs. Each case gets a timeline, findings that cite the exact records behind them, a list of what the evidence cannot establish, and hunts compiled to Defender KQL, Sentinel KQL, Splunk SPL, Elastic ES|QL and Sigma for the tools you already run.

On this page

What you can upload

  • Sysmon Operational channel exported as .evtx
  • Sysmon records in Windows System/EventData JSON or JSONL, including compatible Velociraptor output

How to export it

  1. In Event Viewer open Applications and Services Logs, Microsoft, Windows, Sysmon, Operational and Save All Events As EVTX.
  2. Process creation (1), network connection (3), file create (11), registry (12/13) and DNS (22) are all read.

What PastePile checks

  • Process creation chains: Office or browser parents launching script hosts, encoded PowerShell, PowerShell downloads
  • Suspicious built-in binary use, certutil decode or download, remote wmic, bcdedit recovery changes, shadow copy deletion
  • Registry Run keys that launch a script interpreter
  • Defender exclusions added from the command line
  • Rare parent/child pairs and first-seen external destinations, reported as rarity within your upload

Every finding cites the records behind it and states what it does not establish. Statistical signals are reported as rarity within your upload and never become findings. ATT&CK mappings describe what a behavior resembles, not proof that an adversary was present.

What it does not do

  • PastePile reads the events Sysmon was configured to record; it cannot report activity your Sysmon configuration did not capture
  • Rarity is measured only against what you uploaded, not against a global baseline

Example output

The same Windows compromise pack, run on the synthetic demo case C-0001 (a Defender export rather than an .evtx file), produced:

  • F-001 · winword.exe started powershell.exe · high
  • F-002 · PowerShell started with an encoded command · high
  • F-003 · Persistence requested from the command line (scheduled task) · high

All names, hosts and addresses are synthetic. Read the findings with their citations or the client report built from them. For the structure of a client-ready report, see the security incident report template.

Try it

Open the synthetic Office document to encoded PowerShell case to see the timeline, findings, unknowns and report without an account. When you are ready, create an account and compare plans.

Other evidence formats