https://community.splunk.com/t5/Deployment-Architecture/Why-do-Splunkforwarder-Processes-Start-Acrobat-Reader/m-p/333017#M12447 <P>They don't - Suggest you check for malware urgently.</P> Wed, 24 Jan 2018 15:49:28 GMT nickhills 2018-01-24T15:49:28Z https://community.splunk.com/t5/Deployment-Architecture/Why-do-Splunkforwarder-Processes-Start-Acrobat-Reader/m-p/333016#M12446 <P>Hi</P> <P>going through sysmon logs I noticed, that the splunkforwarder (version 6.6.3) starts AcroRd32.exe on Windows clients.</P> <P>Does any one know why? We are not indexing/monitoring the pdfs or the paths where the pdfs are located. Can this be turned off?</P> <P>This is a sample event:<BR /> 01/17/2018 03:17:38 PM<BR /> LogName=Microsoft-Windows-Sysmon/Operational<BR /> SourceName=Microsoft-Windows-Sysmon<BR /> EventCode=1<BR /> EventType=4<BR /> Type=Information<BR /> ComputerName=server.domain.org<BR /> User=NOT_TRANSLATED<BR /> Sid=S-1-5-18<BR /> SidType=0<BR /> TaskCategory=Process Create (rule: ProcessCreate)<BR /> OpCode=Info<BR /> RecordNumber=4300197<BR /> Keywords=None<BR /> Message=Process Create:<BR /> UtcTime: 2018-01-17 14:17:34.391<BR /> ProcessGuid: {F0E459B7-5AFE-5A5F-0000-00109C69EE2E}<BR /> ProcessId: 12428<BR /> Image: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe<BR /> <STRONG>CommandLine: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\9A5H81Q9\Untitled (28).pdf"</STRONG><BR /> CurrentDirectory: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\<BR /> User: DOMAIN\user<BR /> LogonGuid: {F0E459B7-F487-5A5E-0000-0020274C0F00}<BR /> LogonId: 0xf4c27<BR /> TerminalSessionId: 1<BR /> IntegrityLevel: Low<BR /> Hashes: MD5=F7C513664BD4A9DB4ABBEB2B5E4E01D2,IMPHASH=1439821F22F484CB770EECF65574FF20<BR /> ParentProcessGuid: {F0E459B7-4701-5A5F-0000-00102595771B}<BR /> ParentProcessId: 11408<BR /> ParentImage: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe<BR /> <STRONG>ParentCommandLine: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2</STRONG></P> <P>Regards <BR /> Chris</P> Wed, 24 Jan 2018 14:54:34 GMT https://community.splunk.com/t5/Deployment-Architecture/Why-do-Splunkforwarder-Processes-Start-Acrobat-Reader/m-p/333016#M12446 chris 2018-01-24T14:54:34Z https://community.splunk.com/t5/Deployment-Architecture/Why-do-Splunkforwarder-Processes-Start-Acrobat-Reader/m-p/333017#M12447 <P>They don't - Suggest you check for malware urgently.</P> Wed, 24 Jan 2018 15:49:28 GMT https://community.splunk.com/t5/Deployment-Architecture/Why-do-Splunkforwarder-Processes-Start-Acrobat-Reader/m-p/333017#M12447 nickhills 2018-01-24T15:49:28Z https://community.splunk.com/t5/Deployment-Architecture/Why-do-Splunkforwarder-Processes-Start-Acrobat-Reader/m-p/333018#M12448 <P>Thx, I have also opened a case with splunk</P> Wed, 24 Jan 2018 22:22:17 GMT https://community.splunk.com/t5/Deployment-Architecture/Why-do-Splunkforwarder-Processes-Start-Acrobat-Reader/m-p/333018#M12448 chris 2018-01-24T22:22:17Z https://community.splunk.com/t5/Deployment-Architecture/Why-do-Splunkforwarder-Processes-Start-Acrobat-Reader/m-p/333019#M12449 <P>Splunk Support here, feedback from chris in the case:</P> <BLOCKQUOTE> <P>" there seems to be an issue with<BR /> sysmon, not reporting the parent<BR /> process correctly sometimes. "</P> </BLOCKQUOTE> <P>Something to keep in mind I guess when looking at reports from sysmon, if other avenues of research (like checking for malware) don't pan out.</P> Mon, 29 Jan 2018 10:08:20 GMT https://community.splunk.com/t5/Deployment-Architecture/Why-do-Splunkforwarder-Processes-Start-Acrobat-Reader/m-p/333019#M12449 mhoogcarspel_sp 2018-01-29T10:08:20Z