normalized_service_binary_field.yml

definition: 'EventCode=7036 | spath input=EventData_Xml path="Binary" output=binary_data | eval trimmed_hexbytes = mvjoin(split(trim(binary_data, "0"), "00"), "") | eval normalized_service_name = if(match(trimmed_hexbytes,"^[0-9A-F]+$"),urldecode(replace(trimmed_hexbytes,"([0-9A-F]{2})","%\1")),trimmed_hexbytes)'
description: customer specific splunk configurations to normalized Windows Event Log System 7036 to recover actual services execution.
  Replace the macro definition with configurations for your Splunk Environment.
name: normalized_service_binary_field