LoadedModules collector

The LoadedModules collector shows the loaded modules of running processes.

You can run a search query to display all loaded modules of a process to investigate and perform actions such as:

Collector output

Field	Type	Description
process_id	Number	The process's system identifier.
process_name	String	The name of the running process.
process_imagepath	String	Path to the process's image name.
module_name	String	The name of the module.
module_imagepath	String	Path to the module's image name.
module_reputation	String	The module's reputation name and level (range) defined by TIE or ATP. Known Trusted — [99,100] — This is a trusted file. Most Likely Trusted — [71,85] — Almost certainly a trusted file. Might Be Trusted — [51,70] — Appears to be a benign file. Unknown — [31,50] — Cannot make a determination at this time. Might Be Malicious — [16,30] — Appears to be a suspicious file. Most Likely Malicious — [14,15] — Almost certainly a malicious file. Known Malicious — 1 — This is a malicious file. Not Set — 0 — No reputation has been specified.
module_sha1	String	The SHA-1 hash code for the module.
module_sha2	String	The SHA-256 hash code for the module.
module_md5	String	The MD5 hash code for the module.

Example: Show names of modules with process ID of 71, running on host "osx-elcapitan-01".

LoadedModules where HostInfo hostname equals "osx-elcapitan-01" and LoadedModules id equals 71

Example: Show names of modules with process ID of 71, running on host "osx-elcapitan-01".

LoadedModules where HostInfo hostname equals "osx-elcapitan-01" and LoadedModules id equals 71