Events pertaining to file transfers through HTTP, FTP, and SMP protocols.
These events belong to the file-xfer metaclass.
The filename field is used in Trellix rules and analytics. The md5,sha1, and sha256 fields are used in intel matching.
Taxonomy | Type | Description |
|---|---|---|
| string | File name or path |
| string | File path |
| string | Any type of message digest hash value |
| string | MD5 hash value |
| string | SHA1 hash value |
| string | SHA256 hash value |
| string | File size |