WitFoo-Artifact ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: userName=alice ::: message={"behaviors":[{"alleged_filetype":"exe","behavior_id":"4748","cmdline":"\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=2120 --field-trial-handle=1980,i,5369582960041416159,4070558654925991561,262144 --variations-seed-version=1 /prefetch:8","confidence":100,"control_graph_id":"ctg:1dc4f51a6af846cebd666fa21c07e02f:322123191848","description":"A file written to the file-system was classified as Adware/PUP based on its SHA256 hash.","device_id":"1dc4f51a6af846cebd666fa21c07e02f","display_name":"Detect OnWrite Adware/PUP Hash","filename":"brave.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe","ioc_description":"\\Device\\HarddiskVolume3\\Users\\spstewart\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Cwaynee\\Cwaynee_Data\\f_000e91","ioc_source":"file_write","ioc_type":"hash_sha256","ioc_value":"be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db","md5":"","objective":"Falcon Detection Method","parent_details":{"parent_cmdline":"\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe\" --disable-domain-reliability --enable-dom-distiller --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --sync-url=https://sync-v2.brave.com/v2 --lso-url=https://no-thanks.invalid --variations-server-url=https://variations.brave.com/seed --variations-insecure-server-url=https://variations.brave.com/seed --flag-switches-begin --flag-switches-end --component-updater=url-source=https://go-updater.brave.com/extensions","parent_md5":"7d086f7f29cd9d79b6521562ccd24187","parent_process_graph_id":"pid:1dc4f51a6af846cebd666fa21c07e02f:3947865039808","parent_sha256":"725c84ea63af8526d87de9430abd6d080f50d5aa933d59653473dc8583bff5c8"},"pattern_disposition":128,"pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":false,"quarantine_file":true,"quarantine_mwayneine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"scenario":"NGAV","severity":30,"sha256":"be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db","tactic":"Malware","tactic_id":"CSTA0001","technique":"PUP","technique_id":"CST0013","timestamp":"2024-02-22T20:11:39Z","triggering_process_graph_id":"pid:1dc4f51a6af846cebd666fa21c07e02f:3947880936648","user_id":"S-1-12-1-3095492793-1333718436-2362835387-799903294","user_name":"alice"}],"behaviors_processed":["pid:1dc4f51a6af846cebd666fa21c07e02f:3947880936648:4748"],"cid":"47b7f823f5804dd9862681183ba9999d","created_timestamp":"2024-02-22T20:11:47.155056639Z","date_updated":"2024-02-22T20:11:52Z","detection_id":"ldt:1dc4f51a6af846cebd666fa21c07e02f:322123191848","device":{"agent_load_flags":"1","agent_local_time":"2024-02-19T08:21:40.427Z","agent_version":"7.06.17807.0","bios_manufacturer":"Dell Inc.","bios_version":"1.21.0","cid":"47b7f823f5804dd9862681183ba9999d","config_id_base":"65994763","config_id_build":"17807","config_id_platform":"3","device_id":"1dc4f51a6af846cebd666fa21c07e02f","external_ip":"108.234.90.204","first_seen":"2023-03-10T14:21:28Z","groups":["6297e232e6564507aa02babd05cadd3c"],"hostname":"SPSTEWART-LT","last_login_timestamp":"2024-02-19T13:23:07Z","last_login_user":"alice","last_seen":"2024-02-22T20:09:32Z","local_ip":"225.231.83.109","mac_address":"04-33-c2-70-dd-11","major_version":"10","minor_version":"0","modified_timestamp":"2024-02-22T20:09:52Z","os_version":"Windows 10","platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","status":"normal","system_manufacturer":"Dell Inc.","system_product_name":"Latitude 5511"},"email_sent":false,"first_behavior":"2024-02-22T20:11:39Z","hostinfo":{"domain":""},"last_behavior":"2024-02-22T20:11:39Z","max_confidence":100,"max_severity":30,"max_severity_displayname":"Low","quarantined_files":[{"id":"1dc4f51a6af846cebd666fa21c07e02f_be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db","sha256":"be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db","state":"quarantined"}],"seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new"} ::: filePath=\Device\HarddiskVolume3\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe ::: fileHash=be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db ::: clientHostname=SPSTEWART-LT ::: clientIP=225.231.83.109 ::: fileName=brave.exe ::: program=crowdstrike_falcon ::: clientMAC=04-33-c2-70-dd-11
Product: Falcon
Vendor: Crowdstrike