System Name Changed 6011 Map

evtx/Maps/System_EventLog_6011.map

@@ -0,0 +1,47 @@
+Author: Reece394
+Description: System Name Changed
+EventId: 6011
+Channel: System
+Provider: EventLog
+Maps:
+  -
+    Property: PayloadData1
+    PropertyValue: "The NetBIOS name and DNS host name of this machine have been changed from %OriginalName% to %NewName%"
+    Values:
+      -
+        Name: OriginalName
+        Value: "/Event/EventData/Data"
+        Refine: "^(.*?)(?=,|$)"
+      -
+        Name: NewName
+        Value: "/Event/EventData/Data"
+        Refine: "(?<=, ).*"
+
+# Documentation:
+# http://eventopedia.cloudapp.net/EventDetails.aspx?id=a4c6ad3e-0b56-40ea-aa6d-c84adcf24897
+# https://community.spiceworks.com/t/finding-old-computer-name-from-dc/826502
+# https://learn.microsoft.com/en-us/answers/questions/1060679/recall-previous-device-names-on-endpoint-manager
+#
+# Example Event Data:
+#<Event>
+#  <System>
+#    <Provider Name="EventLog" />
+#    <EventID Qualifiers="32768">6011</EventID>
+#    <Version>0</Version>
+#    <Level>4</Level>
+#    <Task>0</Task>
+#    <Opcode>0</Opcode>
+#    <Keywords>0x80000000000000</Keywords>
+#    <TimeCreated SystemTime="2024-05-28 00:46:49.8687258" />
+#    <EventRecordID>148</EventRecordID>
+#    <Correlation />
+#    <Execution ProcessID="2592" ThreadID="2676" />
+#    <Channel>System</Channel>
+#    <Computer>DESKTOP-F3BMVE4</Computer>
+#    <Security />
+#  </System>
+#  <EventData>
+#    <Data>WIN-76PGSVBIM7I, DESKTOP-F3BMVE4</Data>
+#    <Binary></Binary>
+#  </EventData>
+#</Event>