<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>3</EventID><Version>5</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2019-03-18T16:57:49.089723100Z'/><EventRecordID>8</EventRecordID><Correlation/><Execution ProcessID='4860' ThreadID='4492'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>vagrant-2012-r2</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'></Data><Data Name='UtcTime'>2019-03-18 16:57:47.847</Data><Data Name='ProcessGuid'>{42f11c3b-0bad-5c8c-0000-0010dfbc0000}</Data><Data Name='ProcessId'>924</Data><Data Name='Image'>C:\Windows\System32\svchost.exe</Data><Data Name='User'>NT AUTHORITY\NETWORK SERVICE</Data><Data Name='Protocol'>udp</Data><Data Name='Initiated'>true</Data><Data Name='SourceIsIpv6'>true</Data><Data Name='SourceIp'>2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6</Data><Data Name='SourceHostname'></Data><Data Name='SourcePort'>62141</Data><Data Name='SourcePortName'></Data><Data Name='DestinationIsIpv6'>true</Data><Data Name='DestinationIp'>2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6</Data><Data Name='DestinationHostname'></Data><Data Name='DestinationPort'>53</Data><Data Name='DestinationPortName'>domain</Data></EventData></Event>
