add new maps

evtx/Maps/Application_10002.map

@@ -5,21 +5,21 @@ Channel: "Application"
 Provider: "Microsoft-Windows-RestartManager"
 Maps:
   -
-    Property: PayloadData1
-    PropertyValue: "FullPath: %FullPath%"
+    Property: ExecutableInfo 
+    PropertyValue: "%FullPath%"
     Values:
       -
         Name: FullPath
         Value: "/Event/UserData/RmApplicationEvent/FullPath"
   -
-    Property: PayloadData2
+    Property: PayloadData1
     PropertyValue: "DisplayName: %DisplayName%"
     Values:
       -
         Name: DisplayName
         Value: "/Event/UserData/RmApplicationEvent/DisplayName"
   -
-    Property: PayloadData3
+    Property: PayloadData2
     PropertyValue: "Files: %Files%"
     Values:
       -

evtx/Maps/Microsoft-Windows-Application-Experience_Program-Compatibility-Assistant_17.map

@@ -0,0 +1,39 @@
+Author: Hyun Yi @hyuunnn
+Description: Path of executed program
+EventId: 17
+Channel: "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
+Maps:
+  -
+    Property: ExecutableInfo
+    PropertyValue: "%ExePath%"
+    Values:
+      -
+        Name: ExePath
+        Value: "/Event/UserData/ResolverFiredEvent/ExePath"
+
+# Valid properties include:
+
+# <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
+#   <System>
+#     <Provider Name="Microsoft-Windows-Program-Compatibility-Assistant" Guid="{GUID}" /> 
+#     <EventID>17</EventID> 
+#     <Version>0</Version> 
+#     <Level>4</Level> 
+#     <Task>0</Task> 
+#     <Opcode>0</Opcode> 
+#     <Keywords>0x4000000000000000</Keywords> 
+#     <TimeCreated SystemTime="2020-11-25T05:49:55.2080293Z" /> 
+#     <EventRecordID>204</EventRecordID> 
+#     <Correlation /> 
+#     <Execution ProcessID="5848" ThreadID="16956" /> 
+#     <Channel>Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant</Channel> 
+#     <Computer>ComputerName</Computer> 
+#     <Security UserID="S-1-5-18" /> 
+#   </System>
+#   <UserData>
+#     <ResolverFiredEvent xmlns="http://www.microsoft.com/Windows/Diagnosis/PCA/events">
+#         <ExePath>C:\Users\hyuunnn\Desktop\arsenalRecon\Arsenal-Image-Mounter-v3.2.128\ArsenalImageMounter.exe</ExePath> 
+#         <ResolverName>DetectorShim_Win32Exception</ResolverName> 
+#     </ResolverFiredEvent>
+#   </UserData>
+# </Event>

evtx/Maps/Microsoft-Windows-Shell-Core_Operational_28115.map

@@ -5,14 +5,14 @@ Channel: "Microsoft-Windows-Shell-Core/Operational"
 Provider: "Microsoft-Windows-Shell-Core"
 Maps:
   -
-    Property: PayloadData1
-    PropertyValue: "Name: %Name%"
+    Property: ExecutableInfo
+    PropertyValue: "%Name%"
     Values:
       -
         Name: Name
         Value: "/Event/EventData/Data[@Name=\"Name\"]"
   -
-    Property: PayloadData2
+    Property: PayloadData1
     PropertyValue: "AppID: %AppID%"
     Values:
       -

evtx/Maps/Microsoft-Windows-WPD-MTPClassDriver_Operational_1005.map

@@ -0,0 +1,53 @@
+Author: Hyun Yi @hyuunnn
+Description: (Mobile) MTP Connection
+EventId: 1005
+Channel: "Microsoft-Windows-WPD-MTPClassDriver/Operational"
+Maps:
+  -
+    Property: PayloadData1
+    PropertyValue: "Manufacturer: %Manufacturer%"
+    Values:
+      -
+        Name: Manufacturer
+        Value: "/Event/EventData/Data[@Name=\"Manufacturer\"]"
+  -
+    Property: PayloadData2
+    PropertyValue: "Model: %Model%"
+    Values:
+      -
+        Name: Model
+        Value: "/Event/EventData/Data[@Name=\"Model\"]"
+  -
+    Property: PayloadData3
+    PropertyValue: "Version: %Version%"
+    Values:
+      -
+        Name: Version
+        Value: "/Event/EventData/Data[@Name=\"Version\"]"
+
+# Valid properties include:
+
+# <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
+#   <System>
+#     <Provider Name="Microsoft-Windows-WPD-MTPClassDriver" Guid="{GUID}" /> 
+#     <EventID>1005</EventID> 
+#     <Version>0</Version> 
+#     <Level>4</Level> 
+#     <Task>16</Task> 
+#     <Opcode>0</Opcode> 
+#     <Keywords>0x8000000000000000</Keywords> 
+#     <TimeCreated SystemTime="2020-12-05T21:19:30.1410758Z" /> 
+#     <EventRecordID>2</EventRecordID> 
+#     <Correlation /> 
+#     <Execution ProcessID="8444" ThreadID="16952" /> 
+#     <Channel>Microsoft-Windows-WPD-MTPClassDriver/Operational</Channel> 
+#     <Computer>ComputerName</Computer> 
+#     <Security UserID="S-1-5-19" /> 
+#   </System>
+#   <EventData>
+#     <Data Name="Manufacturer">Apple Inc.</Data> 
+#     <Data Name="Model">Apple iPhone</Data> 
+#     <Data Name="Version">12.4.4</Data> 
+#     <Data Name="HackModel">40</Data> 
+#   </EventData>
+# </Event>