detection.wiki

Microsoft-Windows-ServerManager-MultiMachine › Event 356

Event ID 356 — Async job creation started.

Provider
Microsoft-Windows-ServerManager-MultiMachine
Channel
Operational
Level
Informational
Task
Automationjobexecution.
Opcode
Start

Description

Async job creation started. Command: Command, Target: Target, State: State, Proxy Instance ID: ID.

Message #

Async job creation started. Command: %2, Target: %3, State: %4, Proxy Instance ID: %1

Fields #

NameDescription
ID GUID—
Command UnicodeString—
Target UnicodeString—
State UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 356,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 1,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:21:41.337170+00:00",
    "event_record_id": 686,
    "correlation": {
      "ActivityID": "1480B89F-E871-42E4-BFB4-C8F88B053137"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4380
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "ID": "97DEB445-282E-4B54-9C43-57E30F4270F5",
    "Command": "ServerManagerShell\\Invoke-_InternalServiceMethod",
    "Target": "localhost",
    "State": "Running"
  },
  "message": ""
}

References #