Update Microsoft-Windows-Dhcp-Client-Admin_Microsoft-Windows-Dhcp-Cli…

…ent_50067.map Updated to pull SSID string instead of hex (which may not always match)
EricZimmerman · Dec 20, 2024 · d3a3d79 · d3a3d79
1 parent 40718aa
commit d3a3d79
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/evtx/Maps/Microsoft-Windows-Dhcp-Client-Admin_Microsoft-Windows-Dhcp-Client_50067.map b/evtx/Maps/Microsoft-Windows-Dhcp-Client-Admin_Microsoft-Windows-Dhcp-Client_50067.map
@@ -10,7 +10,7 @@ Maps:
     Values:
       -
         Name: PayloadData1
-        Value: "/Event/EventData/Data[@Name=\"NetworkHint\"]"
+        Value: "/Event/EventData/Data[@Name=\"NetworkHintString\"]"
         Refine: "(?<=, )[^,\\d]+(?=,)"
   -
     Property: PayloadData2
@@ -42,8 +42,8 @@ Maps:
 #     <Security UserID="S-1-5-19" />
 #   </System>
 #   <EventData>
-#     <Data Name="NetworkHintString">WiFi_SSID</Data>
-#     <Data Name="NetworkHint">576946695F53534944</Data>
+#     <Data Name="NetworkHintString">WiFi_SSID_String</Data>
+#     <Data Name="NetworkHint">576946695F535349445F537472696E67</Data>
 #     <Data Name="HWLength">6</Data>
 #     <Data Name="HWAddress">001122334455</Data>
 #   </EventData>