WitFoo-Artifact ::: message={"device_id":"6e36ac138a7a426fa5d2e4a45da72961","timestamp":"2023-09-18T16:11:03Z","behavior_id":"4748","filename":"javaw.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files\\Java\\jdk-20\\bin\\javaw.exe","alleged_filetype":"exe","cmdline":"\"C:\\Program Files\\Java\\jdk-20\\bin\\javaw.exe\" -Xmx4592m -classpath \"zap-2.13.0.jar\" org.zaproxy.zap.ZAP","scenario":"NGAV","objective":"Falcon Detection Method","tactic":"Malware","tactic_id":"CSTA0001","technique":"PUP","technique_id":"CST0013","display_name":"Detect OnWrite Adware/PUP Hash","description":"A file written to the file-system was classified as Adware/PUP based on its SHA256 hash.","severity":30,"confidence":100,"ioc_type":"hash_sha256","ioc_value":"e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851","ioc_source":"file_write","ioc_description":"\\Device\\HarddiskVolume3\\Users\\nighthawk\\OWASP ZAP\\fuzzers\\fuzzdb\\web-backdoors\\exe\\nc.exe","user_name":"nighthawk","user_id":"S-1-12-1-1960846385-1299844409-3992341668-2149414984","control_graph_id":"ctg:6e36ac138a7a426fa5d2e4a45da72961:94493122346","triggering_process_graph_id":"pid:6e36ac138a7a426fa5d2e4a45da72961:900176281143","sha256":"e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851","md5":"","parent_details":{"parent_sha256":"41b3771e22a59da9d0bce7feab0f6f59f7c4967c97e8c882d1a301d638d6af15","parent_md5":"b6bd7778478740744d9f6b11c367b8be","parent_cmdline":"\"C:\\Program Files\\OWASP\\Zed Attack Proxy\\ZAP.exe\" ","parent_process_graph_id":"pid:6e36ac138a7a426fa5d2e4a45da72961:900173951847"},"pattern_disposition":128,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mwayneine":false,"quarantine_file":true,"policy_disabled":false,"kill_parent":false,"operation_blocked":false,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=80.123.246.59 ::: fileHash=e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851 ::: fileName=javaw.exe ::: filePath=\Device\HarddiskVolume3\Program Files\Java\jdk-20\bin\javaw.exe ::: userName=nighthawk ::: clientMAC=00ffc0d6f846 ::: created_at=2023-09-18T16:11:03Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-09-18T16:11:03Z ::: clientHostname=JBETRO-LT4.undefined ::: pipelineEntrypoint=dispatch
{
    "clienthostname": "JBETRO-LT4.undefined",
    "clientmac": "00ffc0d6f846",
    "filehash": "e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851",
    "filename": "javaw.exe",
    "filepath": "\\Device\\HarddiskVolume3\\Program Files\\Java\\jdk-20\\bin\\javaw.exe",
    "message": "WitFoo-Artifact ::: message={\"device_id\":\"6e36ac138a7a426fa5d2e4a45da72961\",\"timestamp\":\"2023-09-18T16:11:03Z\",\"behavior_id\":\"4748\",\"filename\":\"javaw.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Program Files\\\\Java\\\\jdk-20\\\\bin\\\\javaw.exe\",\"alleged_filetype\":\"exe\",\"cmdline\":\"\\\"C:\\\\Program Files\\\\Java\\\\jdk-20\\\\bin\\\\javaw.exe\\\" -Xmx4592m -classpath \\\"zap-2.13.0.jar\\\" org.zaproxy.zap.ZAP\",\"scenario\":\"NGAV\",\"objective\":\"Falcon Detection Method\",\"tactic\":\"Malware\",\"tactic_id\":\"CSTA0001\",\"technique\":\"PUP\",\"technique_id\":\"CST0013\",\"display_name\":\"Detect OnWrite Adware/PUP Hash\",\"description\":\"A file written to the file-system was classified as Adware/PUP based on its SHA256 hash.\",\"severity\":30,\"confidence\":100,\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851\",\"ioc_source\":\"file_write\",\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\nighthawk\\\\OWASP ZAP\\\\fuzzers\\\\fuzzdb\\\\web-backdoors\\\\exe\\\\nc.exe\",\"user_name\":\"nighthawk\",\"user_id\":\"S-1-12-1-1960846385-1299844409-3992341668-2149414984\",\"control_graph_id\":\"ctg:6e36ac138a7a426fa5d2e4a45da72961:94493122346\",\"triggering_process_graph_id\":\"pid:6e36ac138a7a426fa5d2e4a45da72961:900176281143\",\"sha256\":\"e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851\",\"md5\":\"\",\"parent_details\":{\"parent_sha256\":\"41b3771e22a59da9d0bce7feab0f6f59f7c4967c97e8c882d1a301d638d6af15\",\"parent_md5\":\"b6bd7778478740744d9f6b11c367b8be\",\"parent_cmdline\":\"\\\"C:\\\\Program Files\\\\OWASP\\\\Zed Attack Proxy\\\\ZAP.exe\\\" \",\"parent_process_graph_id\":\"pid:6e36ac138a7a426fa5d2e4a45da72961:900173951847\"},\"pattern_disposition\":128,\"pattern_disposition_details\":{\"indicator\":false,\"detect\":false,\"inddet_mask\":false,\"sensor_only\":false,\"rooting\":false,\"kill_process\":false,\"kill_subprocess\":false,\"quarantine_mwayneine\":false,\"quarantine_file\":true,\"policy_disabled\":false,\"kill_parent\":false,\"operation_blocked\":false,\"process_blocked\":false,\"registry_operation_blocked\":false,\"critical_process_disabled\":false,\"bootup_safeguard_enabled\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"kill_action_failed\":false,\"blocking_unsupported_or_disabled\":false,\"suspend_process\":false,\"suspend_parent\":false}} ::: clientIP=80.123.246.59 ::: fileHash=e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851 ::: fileName=javaw.exe ::: filePath=\\Device\\HarddiskVolume3\\Program Files\\Java\\jdk-20\\bin\\javaw.exe ::: userName=nighthawk ::: clientMAC=00ffc0d6f846 ::: created_at=2023-09-18T16:11:03Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-09-18T16:11:03Z ::: clientHostname=JBETRO-LT4.undefined ::: pipelineEntrypoint=dispatch",
    "messagetype": "endpoint_protection_event",
    "productids": [
        7
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 4,
    "severitylabel": "warning",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-09-18T16:11:03Z",
    "tags": [
        "Crowdstrike Detection",
        "endpoint_protection_event"
    ],
    "streamName": "Crowdstrike Detection",
    "clientIP": "80.123.246.59",
    "userName": "nighthawk"
}